DOCSEARCHbyAlgolia
Submit Docs

Revolut Developer Documentation

website·Indexed 43 days ago

https://developer.revolut.com/docs/api-reference/

Technical documentation for Revolut's suite of APIs, including the Merchant API (version 2026-03-12) for order management and authorizations, the Business API for automating accounting and business processes, and the Open Banking API for regulated Third Party Providers (TPPs) under PSD2.

Tokens
7.7K
Snippets
34
Records
62
Agent score
72%

What's inside Revolut

  1. Retrieve a specific order by ID

    Retrieve detailed information about a specific order using its unique identifier. The request requires the Authorization bearer token and the Revolut-Api-Version header set to 2026-03-12.
    curl -X GET "https://merchant.revolut.com/api/orders/123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer sk_1234567890ABCdefGHIjklMNOpqrSTUvwxYZ_1234567890-Ab_cdeFGHijkLMNopq" \
  -H "Revolut-Api-Version: 2026-03-12"

  2. Retrieve a specific order by ID

    Retrieve detailed information about a specific order using the GET /api/orders/{order_id} endpoint. The request requires a Bearer token for authentication and a Revolut-Api-Version header to specify the API version.
    curl -X GET "https://merchant.revolut.com/api/orders/123e4567-e89b-12d3-a456-426614174000" \
  -H "Authorization: Bearer sk_1234567890ABCdefGHIjklMNOpqrSTUvwxYZ_1234567890-Ab_cdeFGHijkLMNopq" \
  -H "Revolut-Api-Version: 2026-08-17"

  4. Authenticate requests to the Revolut Business API

    All Revolut Business API requests require a Bearer token in the Authorization header. Access tokens are obtained during application setup and expire every 40 minutes; a refresh_token is provided to obtain new access tokens.

    Tokens are issued with specific security scopes:

    • READ: Permissions for GET operations.
    • WRITE: Permissions to update counterparties, webhooks, and issue payment drafts.
    • PAY: Permissions to initiate or cancel transactions and currency exchanges.
    • READ_SENSITIVE_CARD_DATA: Permissions to retrieve sensitive card details. Warning: Enabling this scope requires IP whitelisting, or all Business API endpoints will be inaccessible.
    Authorization: Bearer <your_access_token>

  5. Access the Open Banking API as a Regulated Third Party Provider (TPP)

    Payment Initiation Service Providers (PISP) and Account Information Service Providers (AISP) regulated in the EU or UK can access the Revolut Open Banking API without a formal contract. Access is granted by registering the application for production using a valid eIDAS certificate (issued by a Qualified Trust Service Provider in the European List of Trusted Services) or an Open Banking (OBIE) certificate. If a certificate issuer uses a new issuing certificate not yet on Revolut's trust list, developers should contact api-requests@revolut.com.

  8. Authenticate requests to the Revolut Business API

    All Revolut Business API requests require a Bearer token in the Authorization header. Access tokens are obtained via a JWT (JSON Web Token) signature and expire after 40 minutes. A refresh_token is provided during initial setup to obtain new access tokens.

    Available security scopes for access tokens:

    • READ: Permissions for GET operations.
    • WRITE: Permissions to update counterparties, webhooks, and issue payment drafts.
    • PAY: Permissions to initiate or cancel transactions and currency exchanges.
    • READ_SENSITIVE_CARD_DATA: Permissions to retrieve sensitive card details. Note: Enabling this scope requires IP whitelisting; otherwise, all Business API endpoints will be inaccessible.
    curl -H "Authorization: Bearer <your_access_token>" https://b2b.revolut.com/api/1.0/endpoint

  9. Authenticate requests to the Revolut Business API

    All Revolut Business API requests require a Bearer token in the Authorization header. Access tokens are valid for 40 minutes and must be refreshed using a refresh_token obtained during the initial application setup. Tokens are issued based on four security scopes:

    • READ: Permissions for GET operations.
    • WRITE: Permissions to update counterparties, webhooks, and issue payment drafts.
    • PAY: Permissions to initiate or cancel transactions and currency exchanges.
    • READ_SENSITIVE_CARD_DATA: Permissions to retrieve sensitive card details. Note: Enabling this scope requires IP whitelisting; otherwise, all API endpoints will be inaccessible.
    Authorization: Bearer <your_access_token>

  10. Authenticate requests to the Revolut Business API

    The Revolut Business API uses HTTP Bearer authentication. Every request must include an Authorization header with the format Bearer <your_access_token>.

    Access tokens are obtained during the initial application setup and expire every 40 minutes. A refresh_token is provided during setup to obtain new access tokens. To obtain these tokens, a JWT (JSON Web Token) signature is required.

    Authorization: Bearer <your_access_token>

  11. Authenticate requests to the Revolut Merchant API

    All Revolut Merchant API requests require a Bearer token in the Authorization header. You must use a Secret API key generated from your Revolut Business account for server-side calls. Public keys are used only for payment methods at checkout.
    Authorization: Bearer <yourSecretApiKey>

  12. Configure IP whitelisting for sensitive card data access

    If the READ_SENSITIVE_CARD_DATA scope is enabled, you must whitelist the public IP addresses from which your API requests will originate. Private/local IP addresses are not supported.

    Steps to configure:

    1. Log into the Revolut Business web app and navigate to Settings → APIs → Business API.
    2. Select the relevant API certificate.
    3. Enter the public IP(s) in the Production IP whitelist field.
    4. Save the settings.