OAuth V1

Legacy OAuth V1 issues tokens for legacy Candescent APIs only (Send Event, Destinations, Get FI Customer, Register User). For Accounts, Alerts, Banking Images, Disclosures, Money Movement, Transactions, and other current APIs, use OAuth V2.

Note: This endpoint may be deprecated in a future release.

End-user benefits

• Secure access to legacy Candescent APIs (Send Event, Destinations, Get FI Customer, Register User).
• Supports institution-level (client_credentials) authentication and retail customer-specific (password) authentication.
• Access tokens expire after 30 minutes by default (token lifetime is configured per application in the financial institution's Apigee application).

Integration capabilities

• Only the password and client_credentials grant types are supported.
• Client credentials — Provides institution-level access without customer credentials. User context must be supplied in the request body for subsequent API calls.
• Password — Intended for first-party retail applications with direct user authentication. The password grant is supported for retail users only; business users must use client_credentials or OAuth V2. Successful responses include di_ficustomer and di_member_number. Token access is limited to the authenticated retail customer.
• Requests require HTTP Basic Authentication with the client_id and client_secret from application registration.
• Request format is application/x-www-form-urlencoded with a grant_type parameter and a Content-Type: application/x-www-form-urlencoded header. When grant_type=password (retail users only), both username and password are required.
• The financial institution (di_fiid) must be authorized for the application; unauthorized institutions return HTTP 401.
• Successful responses return HTTP 200 with an XML payload containing the access_token and expiration information.

Authentication Flows

Step 1: Complete Authentication

Clients must first complete one of the supported authentication flows to obtain an access token.

Client Credentials Grant

Server-to-server (institution-level) authentication. Supported for retail and business use cases.

Password Grant

Direct authentication using retail end-user credentials. Retail users only — not supported for business users.

Step 2: Resolve fiCustomerId for Retail or Business Users

After successful authentication, retrieve the canonical fiCustomerId required for subsequent API calls.

1. Call the following endpoint: GET /v2/fis/{fiId}/fiCustomers/{fiCustomerId}?fiCustomerIdType=<fiCustomerIdType> using a supported customer identifier type via the fiCustomerIdType query parameter.

   Supported values. Default is GUID:

   • GUID
   • MEMNUMBER
   • LOGINID
   • HOSTID

2. From the response, retrieve the id field. This value represents the canonical fiCustomerId (legacy product user GUID).

3. Use this id value as the {fiCustomerId} path parameter for all subsequent API requests that require fiCustomerId in the URL path.

Required headers

Header	Description
Authorization	Basic <BASE64_ENCODED(CLIENT_ID:CLIENT_SECRET)
di_tid	UUID used to trace and correlate requests across services for debugging and logging.
di_fiid	Identifier of the financial institution.
Content-Type	application/x-www-form-urlencoded

Error codes

Code	Message	HTTP status
90001	app does not support client credentials	403
90001	di_ficustomer not authorized	401
90001	di_fiid not authorized	401
90001	login credentials are not valid	401
90001	Quota limit violation	500
90002	Access blocked	403
90002	Client not authorized for this URL	403
90002	Form param 'grant_type' invalid	400
90002	Form param 'password' invalid	400
90002	Form param 'username' invalid	400
90002	Header 'di_fiid' invalid	400
90002	Header 'di_tid' invalid	400
90002	Header 'originating_ip' invalid	400
90002	Header invalid	400
90002	Internal Service Error - contact DI team	500
90003	Internal Service Error - contact DI team	500
90004	Internal Service Error - contact DI team	500
91000	Quota limit violation	500
92000	Spike arrest violation	500

Endpoints

Create OAuth Token (V1)

Issues an OAuth access token for accessing legacy Candescent APIs. The token is scoped