Revolut Business

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads a Revolut Business account’s accounts and balances, bank details, transactions, counterparties, expenses, FX rates and cards (never card numbers), so cash and reconciliation agents can check them against the books. It is read-only, and it is built to refuse a consent that can pay or read card numbers. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Revolut Business, version 1.0.0
Reads	Revolut: Revolut Business API (the vendor's documentation)
Family	Finance
Kind	Bank
Ways to connect	OAuth approval, Key pair
Scopes	Read: READ
Read only	Yes, except: [object Object]
Vendor's API can move money	Yes
Personal data	Financial, Contact
Hosts it may contact	b2b.revolut.com, sandbox-b2b.revolut.com, revolut.com, {host}
Vendor API versions	Business API 1.0
Lowest engine version	0.46.0

What it reads

• Accounts and balances: balance per account, with name, state and the account’s bank details (IBAN, BIC, account number, sort code, beneficiary). A snapshot: rewritten only when it changes.
• FX rates for the pairs you name in fx_pairs (for example EUR/USD).
• Counterparties: name, type, state and their account identifiers.
• Cards: only the id, last four digits, state, label, holder, product, whether virtual, and dates. A card number, CVV or expiry is never requested and never recorded.
• Transactions and expenses, newest first in windows, from the last cursor less a week (so a transaction whose state moved on is read again). Each transaction’s legs carry amount, fee, currency, account, description and counterparty id. Expenses are skipped on plans that do not have them.
• The first read goes back history_days (default 90, at most 3,650).

How to connect

1. In Revolut Business, open Settings, APIs, Business API; upload the public key of a key pair you made, with your deployment’s redirect domain.
2. Consent with the READ scope only.
3. In LightHouse, open Setup and admin, Connectors, choose Revolut Business, and give the environment (production or sandbox) and any fx_pairs.
4. Paste the client id, the private key (PEM), the issuer (the redirect domain), and the refresh token (or the one-off authorisation code), and confirm the consent was READ only. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (AAL_REVOLUT by default): client_id, private_key, issuer, environment, and refresh_token or authorization_code, and view_only_confirmed when needed.

Permissions

This collector is read-only in what it does: GET requests, and one POST /api/1.0/auth/token to exchange the token. Its read-only test proves it on every change. Nothing is paid, transferred or changed.

• Refused by the code: where Revolut’s token answer states the granted scope, a consent that includes WRITE, PAY or READ_SENSITIVE_CARD_DATA is refused, naming it. The error is, for example, Revolut: refused: the credential can pay (PAY scope), read card numbers (READ_SENSITIVE_CARD_DATA); make a view-only one (naming whichever apply).
• Not detectable by the code: if the token answer carries no scope, Revolut does not state what was consented. The collector then reads only once you have confirmed the certificate was consented with READ only (view_only_confirmed); without it the error is Revolut does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read.
• Signing: each access token is minted with a client assertion, a JWT signed here with your private key (RS256; iss the issuer, sub the client id, aud https://revolut.com, five minutes). The private key never leaves your store. revolut.com is only the audience; it is never contacted.
• Refresh token: Revolut documents it as not expiring, but a withdrawn consent ends it. When a one-off authorisation code is exchanged, the new refresh token is written back to your own secret store in your deployment (not to Revolut) and the code is dropped.
• Hosts: only b2b.revolut.com or sandbox-b2b.revolut.com, over https; redirects are never followed.

Limits

• Business API 1.0.
• Requests are paced one second apart and retried on 429 and 5xx with back-off.
• Transactions are paged down by to date, 1,000 a page; expenses 500.
• The access token lasts 40 minutes and is minted again as needed.
• Amounts are exact decimals; a number that arrives as a float is refused.

Data handling

• Records hold financial and personal data: balances, bank details, transactions, counterparties’ names and account identifiers, and cardholders’ ids. Documents carry the label you give the source (default confidential).
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• Errors carry a status and fixed text, never a provider’s body.
• The data is audit-ready for your own agents; nothing here certifies anyone against any regulation.

Troubleshooting

What you see	What it means	What to do
Revolut: refused: the credential can pay (PAY scope); make a view-only one	The consent includes a scope that moves money or reads card numbers (named)	Consent again with READ only
Revolut does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read	The consent’s scope is not stated and you have not confirmed	Confirm it was READ only
Revolut answered HTTP 401 (consent again in Revolut Business)	The refresh token was refused (withdrawn or expired consent)	Consent again in Revolut Business
Revolut: neither a refresh token nor an authorisation code	The credential has neither	Re-enter the credential
fx_pairs are currency pairs, e.g. EUR/USD	A pair is not two 3-letter codes	Correct the pair
environment is production or sandbox	The environment is something else	Correct it

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Business API 1.0	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only