context7.json

{
  "$schema": "https://context7.com/schema/context7.json",
  "projectTitle": "Wealth Reader API",
  "description": "Bank aggregation API: read-only access to accounts, cards, loans and investment portfolios from banks in 61 countries (PSD2 and non-PSD2).",
  "folders": [],
  "excludeFolders": [
    "docs/fr",
    "docs/ca",
    "docs/da",
    "docs/de",
    "docs/el",
    "docs/fi",
    "docs/ga",
    "docs/it",
    "docs/ja",
    "docs/nl",
    "docs/no",
    "docs/pt",
    "docs/ro",
    "docs/ru",
    "docs/zh"
  ],
  "excludeFiles": [
    "LICENSE"
  ],
  "rules": [
    "Wealth Reader is read-only: it reads balances, transactions, cards, loans and investment portfolios. It never moves money and has no payment endpoint.",
    "There are two integration paths: the iframe widget (web apps) and OAuth (native apps or redirect flows). Both deliver the same normalised JSON.",
    "With the iframe, bank data never travels in the postMessage. It is POSTed to the callback URL configured in the client area.",
    "The callback must answer HTTP 200 with the exact body {\"status\":\"ok\"}. Any other response stops the frontend from receiving 'flow completed'.",
    "operation_id is generated by the integrator on every operation and is the only bridge between the frontend operation and the backend callback. Treat deliveries as idempotent.",
    "The domain that loads the widget must be authorised in the client area before the widget will open.",
    "date_from defaults to yesterday, not to the full history. Ranges over 89 days at European banks may trigger an extra two-factor step.",
    "To refresh data later, POST to https://api.wealthreader.com/entities/ with api_key, code and the token stored from the callback. Never ask the user for the bank password again.",
    "Every error code carries a `fatal` flag. Never retry a fatal error: several of them mean the bank rejected the credentials, and repeating the call locks the user out of their own bank. Retry only non-fatal codes, with backoff. The full table is in api-reference/error-codes.md and live at https://api.wealthreader.com/error-codes/?lang=en",
    "Codes 2017 and 20171 mean the institution offers several second-factor channels: call again with the same session and an `otp_method`.",
    "Warnings in statistics.warnings do not invalidate a read. success stays true and the payload is usable; never fail an operation over a warning.",
    "Product keys are absent when the user holds no such product or when product_types did not ask for it. A missing `portfolios` key means no portfolios, not a failed read.",
    "For a cheap recurring refresh use only_balances=true, and narrow product_types. fetch_transaction_details costs one or more extra requests to the bank per transaction, so keep it out of batch jobs.",
    "Call POST /tokens/revoke/ when a user deletes their account, or their credentials stay in custody on the Wealth Reader side.",
    "A dead token is not recovered through the API: reopen the widget passing the old value in wr_conf.token so the user re-authenticates.",
    "/verify/iban-ownership/, /user/register/, /user/check/, /user/revoke/ and the /batch/ endpoints are optional and not part of a standard integration. Do not propose them unless Wealth Reader has explicitly told the integrator to use them.",
    "Test users: MOCKDATA (successful read), MOCKOTP (two-factor challenge), MOCKLOGINKO (login error). The password can be anything."
  ],
  "url": "https://context7.com/wealth-reader/wealthreader-api-docs",
  "public_key": "pk_xyfzkyCfAqD57n9kYhaXC"
}