# Revolut Business > Revolut Business: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads a Revolut Business account’s accounts and balances, bank details, transactions, counterparties, expenses, FX rates and cards (never card numbers), so cash and reconciliation agents can check them against the books. It is read-only, and it is built to refuse a consent that can pay or read card numbers. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | Revolut Business, version `1.0.0` | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Reads | Revolut: Revolut Business API ([the vendor's documentation](https://developer.revolut.com/docs/business/business-api)) | | Family | Finance | | Kind | Bank | | Ways to connect | OAuth approval, Key pair | | Scopes | - Read: `READ` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | Yes | | Personal data | Financial, Contact | | Hosts it may contact | `b2b.revolut.com`, `sandbox-b2b.revolut.com`, `revolut.com`, `{host}` | | Vendor API versions | Business API 1.0 | | Lowest engine version | `0.46.0` | ## What it reads - **Accounts and balances:** balance per account, with name, state and the account’s bank details (IBAN, BIC, account number, sort code, beneficiary). A snapshot: rewritten only when it changes. - **FX rates** for the pairs you name in `fx_pairs` (for example `EUR/USD`). - **Counterparties:** name, type, state and their account identifiers. - **Cards:** only the id, last four digits, state, label, holder, product, whether virtual, and dates. A card number, CVV or expiry is never requested and never recorded. - **Transactions and expenses**, newest first in windows, from the last cursor less a week (so a transaction whose state moved on is read again). Each transaction’s legs carry amount, fee, currency, account, description and counterparty id. Expenses are skipped on plans that do not have them. - The first read goes back `history_days` (default 90, at most 3,650). ## How to connect 1. In Revolut Business, open Settings, APIs, Business API; upload the public key of a key pair you made, with your deployment’s redirect domain. 2. Consent with the **READ** scope only. 3. In LightHouse, open **Setup and admin, Connectors**, choose **Revolut Business**, and give the environment (`production` or `sandbox`) and any `fx_pairs`. 4. Paste the client id, the private key (PEM), the issuer (the redirect domain), and the refresh token (or the one-off authorisation code), and confirm the consent was READ only. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`AAL_REVOLUT` by default): `client_id`, `private_key`, `issuer`, `environment`, and `refresh_token` or `authorization_code`, and `view_only_confirmed` when needed. ## Permissions This collector is **read-only** in what it does: `GET` requests, and one `POST /api/1.0/auth/token` to exchange the token. Its read-only test proves it on every change. Nothing is paid, transferred or changed. - **Refused by the code:** where Revolut’s token answer states the granted `scope`, a consent that includes **WRITE**, **PAY** or **READ_SENSITIVE_CARD_DATA** is refused, naming it. The error is, for example, `Revolut: refused: the credential can pay (PAY scope), read card numbers (READ_SENSITIVE_CARD_DATA); make a view-only one` (naming whichever apply). - **Not detectable by the code:** if the token answer carries no `scope`, Revolut does not state what was consented. The collector then reads only once you have confirmed the certificate was consented with READ only (`view_only_confirmed`); without it the error is `Revolut does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read`. - **Signing:** each access token is minted with a client assertion, a JWT signed here with your private key (RS256; `iss` the issuer, `sub` the client id, `aud` `https://revolut.com`, five minutes). The private key never leaves your store. `revolut.com` is only the audience; it is never contacted. - **Refresh token:** Revolut documents it as not expiring, but a withdrawn consent ends it. When a one-off authorisation code is exchanged, the new refresh token is written back to your own secret store in your deployment (not to Revolut) and the code is dropped. - **Hosts:** only `b2b.revolut.com` or `sandbox-b2b.revolut.com`, over https; redirects are never followed. ## Limits - Business API 1.0. - Requests are paced one second apart and retried on 429 and 5xx with back-off. - Transactions are paged down by `to` date, 1,000 a page; expenses 500. - The access token lasts 40 minutes and is minted again as needed. - Amounts are exact decimals; a number that arrives as a float is refused. ## Data handling - Records hold financial and personal data: balances, bank details, transactions, counterparties’ names and account identifiers, and cardholders’ ids. Documents carry the `label` you give the source (default `confidential`). - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - Errors carry a status and fixed text, never a provider’s body. - The data is audit-ready for your own agents; nothing here certifies anyone against any regulation. ## Troubleshooting | What you see | What it means | What to do | | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | --------------------------------- | | `Revolut: refused: the credential can pay (PAY scope); make a view-only one` | The consent includes a scope that moves money or reads card numbers (named) | Consent again with READ only | | `Revolut does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read` | The consent’s scope is not stated and you have not confirmed | Confirm it was READ only | | `Revolut answered HTTP 401 (consent again in Revolut Business)` | The refresh token was refused (withdrawn or expired consent) | Consent again in Revolut Business | | `Revolut: neither a refresh token nor an authorisation code` | The credential has neither | Re-enter the credential | | `fx_pairs are currency pairs, e.g. EUR/USD` | A pair is not two 3-letter codes | Correct the pair | | `environment is production or sandbox` | The environment is something else | Correct it | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Business API 1.0 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/revolut/