Account Opening API

    v1

    Digital account onboarding for individuals, joint accounts, and entities.

    Base URLhttps://ao-api.vcttech.co/
    Open Swagger UI

    Introduction

    The Account Opening API powers a fully digital onboarding flow for brokerages and fintech apps. It is designed to make account opening as simple as possible while preserving the validation, document capture, and disclosure controls required for compliant onboarding.


    This reference is intended for engineering teams integrating the API into their own client-facing applications. For implementation questions, contact your Gato Systems / VCT Technologies representative.

    Environment

    UAT Environment


    Use the UAT environment for all integration and testing work. Production credentials are issued separately once UAT certification is complete.


  1. Base URL: https://ao-api.vcttech.co/
  2. Swagger UI: https://ao-api.vcttech.co/swagger/index.html
  3. OpenAPI spec: https://ao-api.vcttech.co/swagger/v1/swagger.json

    4. The Flow of Account Opening APIs

    The Account Opening APIs are organized around two onboarding flows depending on the type of applicant.


    Company / Organization / LLC Flow


    Used to open accounts for entities. The typical sequence is:


  4. Login API
  5. Company Initial Information API
  6. Company Beneficiary User Information API
  7. Company Account Funding API
  8. Company Other Data API
  9. Company Update API
  10. Company OTP API

    11. Individual User (IU) / Joint Account (JA) Flow


    Used to open accounts for individuals and joint applicants:


  11. Login API
  12. IU/JA Signup Initial Information API
  13. IU/JA Signup Account Funding API
  14. IU/JA Signup Other Data API
  15. IU/JA Signup Update API
  16. IU/JA Signup OTP API
  17. IU/JA All Accounts API
  18. IU/JA Filter Accounts API

    19. API Specifications

    The Account Opening API is grouped into the following modules. All endpoints (other than Token Connect) require a bearer token returned by the Login API.

    Sample Data Encryption

    Sensitive payload data is encrypted before transmission. Two encryption strategies are used depending on the endpoint:


    RSA-encrypted JSON (Account Funding APIs)


    JSON request bodies are encrypted field-by-field with the public RSA key returned by the Login API. Arrays of strings are encrypted per-element; arrays of objects are encrypted per-field-per-element. The encrypted payload preserves the original key structure.


    AES + RSA hybrid for form data (Initial Information & Other Data APIs)


    Form-encoded payloads (including file uploads) are encrypted with AES-256-CBC using a session key/IV pair returned at login. Files (.jpg, .jpeg, .png, .pdf) are read, base64-encoded, then AES-encrypted before being attached. Non-file string fields and arrays are encrypted with the RSA public key, then appended to the form.


    > Implementation snippets and the exact key-exchange handshake are available to licensed integrators on request.

    Disclaimer and Confidentiality Notice

    The information in this documentation is confidential and is provided for the sole use of authorized integrators. It may not be redistributed without prior written consent.


    While care has been taken in preparing this material, no warranty is made as to its accuracy or completeness. Gato Systems and VCT Technologies LLC accept no liability for use of, or reliance on, the information provided here.