Ozon Банк для бизнеса — API integration & OpenFinance delivery

Authentication & session

OTP-based login replicating the mobile flow, device registration, long-lived refresh tokens, and role awareness for director vs. accountant vs. employee profiles. Supports multi-entity switching for holdings with several ИП/ООО.

Use case: single sign-on from your ERP into a read-only Ozon Bank statement view, no password sharing.

Statement & transaction API

Fetches current-account operations (income, expense, internal), SBP/QR items, card acquiring credits, budget payments (taxes, contributions), and Ozon Card transfers. Supports paging, date windows, and counterparty filters. Fields exposed: op_id, date, amount, currency, direction, counterparty_name, counterparty_inn, purpose, sbp_qr_id.

Use case: nightly reconciliation with the client's accounting system.

SBP / QR payment bridge

Create SBP payout orders, generate dynamic SBP QR codes for acquiring, poll confirmation status, and receive webhooks when the counterparty bank settles. Handles 15-second settlement windows and retries on transient failures.

Use case: omnichannel retailer closing an online order the moment the customer scans the QR.

1C export / import bridge

Downloads statements as 1C-compatible text (1CClientBankExchange) and uploads payment orders from 1C:Бухгалтерия into the bank. Handles encoding, routing numbers, and validation for INN / KPP / BIC fields.

Use case: fully automated payment-day workflow — no manual statement uploads.

Daily Income savings data

Reads balance, daily interest accrual, deposit/withdrawal history, and current yield for the "Daily Income" account (накопительный счёт Ежедневный доход). Designed for treasury and multi-entity cash management.

Use case: consolidated treasury dashboard across ten legal entities.

Tariffs, limits & certificates

Pulls current-tariff metadata (operation limits, free ATM withdrawal caps, monthly SBP ceilings) and can order digital certificates (account references, tax residency, turnover confirmations).

Use case: automated generation of bank letters for tenders or counterparty KYC packages.

Deliverables checklist

• OpenAPI 3.1 specification for every endpoint we build
• Protocol and auth flow report (OTP, token, device binding, refresh)
• Runnable source code in Python (FastAPI) and/or Node.js (NestJS)
• 1C exchange adapter (1CClientBankExchange format)
• SBP / QR webhook handler and retry logic
• Postman collection + integration test suite
• Compliance notes covering 152-ФЗ, 115-ФЗ, 161-ФЗ
• Deployment guide (Docker + docker-compose, optional K8s manifests)

Example 1: OTP login (pseudocode)

POST /api/v1/ozon-sme/auth/otp/request
Content-Type: application/json

{
  "phone": "+7XXXXXXXXXX",
  "device_id": "erp-bridge-01",
  "role_hint": "accountant"
}

-- then --

POST /api/v1/ozon-sme/auth/otp/confirm
{
  "phone": "+7XXXXXXXXXX",
  "otp": "123456",
  "device_id": "erp-bridge-01"
}

200 OK
{
  "access_token": "...",
  "refresh_token": "...",
  "expires_in": 3600,
  "entities": [
    {"inn": "7701234567", "kpp": "770101001", "type": "OOO"},
    {"inn": "500100000000", "type": "IP"}
  ]
}

Example 2: statement query

POST /api/v1/ozon-sme/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "inn": "7701234567",
  "account_id": "40702810900000012345",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "op_types":  ["SBP", "COUNTERPARTY", "BUDGET"],
  "page": 1,
  "page_size": 200
}

200 OK
{
  "total": 1342,
  "page": 1,
  "items": [
    {
      "op_id": "OP-8f21-...",
      "date": "2026-03-11T09:42:11+03:00",
      "direction": "OUT",
      "amount": 125000.00,
      "currency": "RUB",
      "op_type": "COUNTERPARTY",
      "counterparty": {"name": "OOO Postavschik", "inn": "7702233445", "bic": "044525225"},
      "purpose": "Payment for invoice 2026-0311"
    }
  ]
}

Example 3: SBP settlement webhook

POST https://yourapp.example.com/webhooks/ozon-sme/sbp
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "sbp.payment.settled",
  "occurred_at": "2026-03-11T12:00:05+03:00",
  "merchant_inn": "7701234567",
  "qr_id": "AB12-99F0-...",
  "order_ref": "SHOP-ORD-4477",
  "amount": 499.00,
  "currency": "RUB",
  "payer_masked_phone": "+7(***)***-12-34",
  "status": "SETTLED"
}

-- Recommended handler logic --
1. Verify HMAC signature with shared secret
2. Idempotency check by (event + qr_id)
3. Close order in POS / ERP
4. Ack with 200 within 5 seconds or webhook retries

About our studio

We are an independent technical studio focused on mobile app protocol analysis and authorized API integration for fintech and e-commerce. Our engineers have shipped integrations for banks, payment gateways, marketplaces, and ERP vendors, with a particular emphasis on CIS and global fintech. We operate under NDAs and deliver reproducible, documented source code rather than black-box services.

• Protocol analysis for Android & iOS banking and fintech apps
• Authorized API gateways, SDKs, and webhook infrastructure
• Python, Node.js, Go, Java integration stacks
• Full pipeline: reverse engineering → API design → build → validation → compliance
• Source code delivery from $300 — runnable API source code and documentation; pay after delivery upon satisfaction
• Pay-per-call API hosting — access our hosted API endpoints and pay only for the calls you make, no upfront fee

Contact

Send us the target app name and your requirements — transactions, balances, SBP payouts, 1C bridge, savings, or a full multi-bank rollup — and we will respond with a scope, timeline, and price.

Open contact page →

We reply within one business day. NDAs provided on request.

Engagement workflow

1. Scope confirmation (1–2 days) — you share the target (Ozon Bank for Business) and requirements (e.g. statements + SBP + 1C bridge).
2. Protocol analysis & API design (2–5 business days) — authorization flow, endpoint mapping, OpenAPI draft.
3. Build & internal validation (3–8 business days) — implementation, signed webhooks, integration tests.
4. Docs, samples & test plans (1–2 business days) — Postman collection, README, deployment guide.
5. Delivery & handover — source code, documentation, and (if opted) hosted pay-per-call endpoint.

Typical first delivery: 5–15 business days; dependencies on the client's own sandbox or approvals may extend timelines.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance?

Which engagement model should I pick?