{ "openapi": "3.1.0", "info": { "title": "Credicorp public API", "version": "1.0.0", "description": "Public, no-authentication API surface for the Credicorp marketing site. Currently exposes the KB-bounded public \"Credi\" assistant and a health probe.", "contact": { "name": "Credicorp Limited", "url": "https://credicorp.co.uk/contact/" } }, "servers": [ { "url": "https://credicorp.co.uk" } ], "paths": { "/api/credi/public": { "post": { "operationId": "askCredi", "summary": "Ask the public Credi assistant a general question about Credicorp business lending.", "description": "KB-bounded assistant. Answers general questions about products, eligibility and costs. It cannot see or act on any account; account-specific questions return a sign-in handoff. CSRF-protected (double-submit cc_csrf cookie + matching token) and rate-limited.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string", "maxLength": 500, "description": "The visitor question (max 500 characters)." } } } } } }, "responses": { "200": { "description": "An answer (or a sign-in handoff for account-specific questions).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CrediAnswer" } } } }, "403": { "description": "Invalid or missing CSRF token." }, "422": { "description": "Empty message or message longer than 500 characters." }, "429": { "description": "Rate limit exceeded \u2014 try again shortly." } } } }, "/api/rates": { "get": { "operationId": "getRates", "summary": "Machine-readable representative pricing for the three products.", "description": "Read-only JSON: the Business Loan, Credicorp Flex and Credicorp Slice with representative example figures sourced from the published pricing atoms, a disclaimer and a schema.org FinancialProduct mirror. For AI agents and the agent plane. No authentication; safe to cache.", "responses": { "200": { "description": "Product pricing payload.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/api/glossary": { "get": { "operationId": "getGlossary", "summary": "Machine-readable business-finance glossary.", "description": "Read-only JSON list of glossary terms and definitions, for agent consumption. No authentication; safe to cache.", "responses": { "200": { "description": "Glossary payload (terms + definitions).", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/healthz": { "get": { "operationId": "health", "summary": "Liveness/readiness probe for the marketing app.", "responses": { "200": { "description": "The app is up.", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "type": "string", "example": "ok" } } } } } } } } }, "/pay": { "get": { "operationId": "startRepaymentSession", "summary": "Open a secure hosted card-payment session to repay an existing Credicorp agreement.", "description": "Loan-servicing repayment, not retail checkout. Quote the agreement reference (shown on the agreement and every letter/email from Credicorp) to continue to the secure card-payment page on the client portal. The amount is determined by the agreement \u2014 see https://credicorp.co.uk/make-a-payment/ for the human flow and bank-transfer alternative. Signed-in account holders can also pay in the portal.", "servers": [ { "url": "https://clients.credicorp.co.uk" } ], "parameters": [ { "name": "ref", "in": "query", "required": true, "description": "The Credicorp agreement reference the payment is for.", "schema": { "type": "string" } } ], "x-payment-info": { "intent": "session", "method": "card", "amount": null, "currency": "GBP", "description": "Repayment of an existing Credicorp business finance agreement; the amount due is determined by the agreement reference. Card is processed by Stripe on the hosted payment page." }, "responses": { "200": { "description": "The hosted secure card-payment session page." } } } }, "/mcp": { "post": { "operationId": "mcpRpc", "summary": "Public MCP (Model Context Protocol) transport \u2014 JSON-RPC 2.0 over HTTP.", "description": "Unauthenticated, read-only MCP server (initialize, tools/list, tools/call). Reverse-proxied to the Credicorp hub public MCP ring. See https://credicorp.co.uk/.well-known/mcp/server-card.json for the capability surface.", "responses": { "200": { "description": "JSON-RPC 2.0 response from the MCP server." } } }, "get": { "operationId": "mcpServerCardProbe", "summary": "MCP server-card probe.", "responses": { "200": { "description": "MCP server identity / capability probe." } } } }, "/partner/mcp": { "post": { "operationId": "partnerMcpRpc", "summary": "Authenticated, read-only MCP transport (OAuth 2.0 bearer token required).", "description": "Staff/owner read-only MCP tier. Requires a client_credentials bearer token from https://credicorp.co.uk/oauth/token. Reverse-proxied to the hub partner MCP. See https://credicorp.co.uk/.well-known/oauth-protected-resource.", "security": [ { "oauth2ClientCredentials": [] } ], "responses": { "200": { "description": "JSON-RPC 2.0 response from the authenticated MCP server." }, "401": { "description": "Missing or invalid bearer token." } } }, "get": { "operationId": "partnerMcpProbe", "summary": "Authenticated MCP server-card probe.", "security": [ { "oauth2ClientCredentials": [] } ], "responses": { "200": { "description": "Authenticated MCP capability probe." } } } }, "/oauth/token": { "post": { "operationId": "oauthToken", "summary": "OAuth 2.0 token endpoint (client_credentials grant).", "description": "Exchange client_credentials (client_secret_basic or client_secret_post) for a short-lived read-only bearer access token. Reverse-proxied to the hub OAuth plane.", "responses": { "200": { "description": "Access token response (RFC 6749)." }, "400": { "description": "Invalid request / grant." }, "401": { "description": "Invalid client authentication." } } } }, "/oauth/jwks": { "get": { "operationId": "oauthJwks", "summary": "JSON Web Key Set for verifying access tokens (RFC 7517).", "responses": { "200": { "description": "The public JWKS document." } } } }, "/oauth/introspect": { "post": { "operationId": "oauthIntrospect", "summary": "OAuth 2.0 token introspection (RFC 7662).", "description": "Client-authenticated introspection of an access token. Reverse-proxied to the hub.", "responses": { "200": { "description": "Introspection response (RFC 7662)." }, "401": { "description": "Invalid client authentication." } } } } }, "components": { "securitySchemes": { "oauth2ClientCredentials": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://credicorp.co.uk/oauth/token", "scopes": { "mcp:read": "Read-only access to the authenticated MCP tools.", "applications:read": "Read application records.", "customers:read": "Read customer/loan summaries.", "loans:read": "Read loan records.", "ops:read": "Read ops-queue status.", "decisioning:read": "Read the decisioning explainer.", "metrics:read": "Read platform metrics.", "config:read": "Read platform config." } } } } }, "schemas": { "CrediAnswer": { "type": "object", "required": [ "ok" ], "properties": { "ok": { "type": "boolean" }, "answer": { "type": "string", "description": "Sanitised HTML answer." }, "handoff": { "type": "boolean", "description": "Present and true when the user should sign in for account-specific help." }, "error": { "type": "string", "description": "Present on a non-ok response." } } } } }, "x-service-info": { "categories": [ "financial-services", "business-lending", "loan-servicing" ], "docs": { "apiReference": "https://dev.credicorp.co.uk/", "homepage": "https://credicorp.co.uk/", "llms": "https://credicorp.co.uk/llms.txt" }, "mirror": { "url": "https://creditcorp.co.uk/", "description": "Same content with Creditcorp branding." } } }