# Tilopay Banking API

> Reference for Tilopay's Banking API (BaaS), generated from its OpenAPI 3.0.3 spec, version 1.0.0.

- kind: api-index
- status: stable
- api_version: 1.0.0
- last_verified: 2026-10-22
- url: https://tilopay.com/en/developers/api-bancario

With our Banking API you can initiate payments (PIN and SINPE Móvil), check their status,
manage your accounts and receive payment event webhooks from your own systems, always
limited to the accounts your access token authorizes.

**It is a separate product from the payment gateway.** It runs on its own
infrastructure, with its own host, credentials and authentication. If you already
integrate our acquiring API, access to this one is enabled separately.

Here you will find the official endpoints, models and flows for version **1.0.0** of the
Banking API.

## What it can do [#que-permite]

**Payments.** Create a payment, fetch it by identifier, list it by account and search it
by `payment_id`, `public_id` or `client_reference`; the available methods are `PIN` and
`SINPE_MOVIL`. Creation only accepts direction `OUT`; `IN` payments remain available in listings and webhooks.
[See payment operations](/en/developers/api-bancario/pagos).

**Accounts.** Validate a destination account before transferring, list your
accounts with or without balances, check an account balance and request statements
asynchronously.
[See account operations](/en/developers/api-bancario/cuentas).

**Webhooks.** Register your encrypted HTTPS destination, see the events you can
subscribe to per payment method and the data structure we send in each one.
[See webhook operations](/en/developers/api-bancario/webhooks).

**Catalogs.** Customer identification person types per country.
[See catalogs](/en/developers/api-bancario/catalogos).

We also provide `GET /api/public/v1/healthz` for health checks, plus `GET
/openapi.yaml` and `GET /docs` with the OpenAPI definition and interactive documentation
right on the API host.

## Environments [#entornos]

There are two environments, with the same routes and contracts. The sandbox one:

```text
https://api-baas-sandbox.tilopay.com
```

Production is the same host without the `-sandbox` suffix:

```text
https://api-baas.tilopay.com
```

Tilopay issues sandbox credentials on request; coordinate access with your merchant contact at Tilopay. When you are ready, we provide production credentials as we enable your access.

## Machine-readable artifacts [#artefactos]

We publish the full Banking API OpenAPI definition, with open CORS, in two formats:

- [openapi.json](/developers/api-bancario/openapi.json)
- [openapi.yaml](/developers/api-bancario/openapi.yaml)

It is independent from our acquiring API definition
([/developers/openapi.json](/developers/openapi.json)): they are two separate products.

## How to get access [#acceso]

Access is restricted and granted on request, for operations in Costa Rica. To learn
about the product and request it, visit [baas.tilopay.com](https://baas.tilopay.com), stating
estimated monthly volume, use case and systems to integrate.

## Where to go next [#siguiente]

1. [Authentication](/en/developers/api-bancario/autenticacion) — login, token exchange and Bearer.
2. [Conventions](/en/developers/api-bancario/convenciones) — envelope, correlation, safe retries, pagination and dates.
3. [Response codes](/en/developers/api-bancario/errores) — full `response_code` catalog.