# MIB API v1 to v2 Upgrade Tracking

This document tracks all MIB API calls used by thijooree and their upgrade status from v1 to v2.

---

## Summary

**Total API Endpoints:** 28+  
**Categories:** 8  
**Last Updated:** 2026-10-22

---

## API Endpoints by Category

### 1. Authentication & Login (Encrypted API)

| API Code | Endpoint | Purpose | Used By | Status |
|----------|----------|---------|---------|--------|
| `sfunc=r` + `S40` | Key Exchange (Init) | First-time device registration | `MibLoginFlow.kt` | ✅ |
| `sfunc=i` + `S40` | Key Exchange (Login) | Regular login session setup | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `C41` | Registration Init | Initialize device registration flow | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `C42` | OTP Verification | Verify one-time password after registration | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `A41` | Main Login | Submit username/password credentials | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `A44` | Get User Salt | Retrieve user salt for password hashing | `MibLoginFlow.kt` | ✅ |
| `sfunc=n` + `P47` | Switch Profile | Activate different user profile | `MibLoginFlow.kt` | ✅ |

---

### 2. Beneficiary & Contact Management

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `/ajaxBeneficiary/getCategories` | Fetch beneficiary category list | `MibContactsClient.kt` | ☐ |
| `/ajaxBeneficiary/main` | List all contacts (paginated) | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | ☐ |
| `/ajaxBeneficiary/createLocalBeneficiary` | Add new beneficiary | `MibContactsClient.kt`, `AddContactSheetFragment.kt` | ☐ |
| `/ajaxBeneficiary/deleteBeneficiary` | Remove beneficiary | `MibContactsClient.kt`, `ContactsFragment.kt` | ☐ |
| `/ajaxBeneficiary/getProfileImage` | Get contact profile picture | `MibContactsClient.kt` | ☐ |

---

### 3. Fund Transfers

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `/ajaxTransfer/transferInternal` | MIB-to-MIB internal transfer (Bank code 2) | `MibTransferClient.kt`, `TransferFragment.kt` | ☐ |
| `/ajaxTransfer/transferLocal` | Transfer to BML account (Bank code 3) | `MibTransferClient.kt`, `TransferFragment.kt` | ☐ |
| `/ajaxBeneficiary/getAccountName` | Lookup MIB account (17-digit format) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |
| `/AjaxAlias/getIPSAccount` | Lookup IPS/BML account (15-digit format) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |
| `/AjaxAlias/getAlias` | Lookup Favara alias (shortcodes, IDs, email) | `MibTransferClient.kt`, `MibTransferHandler.kt` | ☐ |

---

### 4. Debit Card Operations

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `/ajaxDebitCard/fetchCardInfos` | Retrieve list of debit cards | `MibCardsClient.kt`, `PayWithCardFragment.kt` | ☐ |
| `/ajaxDebitCard/freeze` | Freeze/block debit card | `MibCardsClient.kt` | ☐ |
| `/ajaxDebitCard/unfreeze` | Unfreeze/unblock debit card | `MibCardsClient.kt` | ☐ |

---

### 5. Transaction History

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `/ajaxAccounts/trxHistory` | Fetch account transaction history (paginated) | `MibHistoryClient.kt`, `AccountHistoryFragment.kt`, `TransferHistoryFragment.kt` | ☐ |

---

### 6. Activity & Audit Logs

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `/aProfile/getPagedActivityHistory` | Fetch activity alerts and audit logs (paginated) | `MibActivityHistoryClient.kt` | ☐ |

---

### 7. User Profile

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `GET /personalProfile` | HTML scrape: fullName, username, email, mobile, enrolled date | `MibProfileClient.kt` | ☐ |

---

### 8. Financing & Loans

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `GET /financing?dashurl=1` | Fetch financing/loan deals (HTML parsing) | `MibFinancingClient.kt` | ☐ |

---

### 9. Session Management

| Endpoint | Purpose | Used By | Status |
|----------|---------|---------|--------|
| `POST /aProfile/keepAlive` | Periodic session keep-alive (empty body) | `HomeActivity.kt` | ☐ |

---

## Implementation Files Reference

### Core MIB API Clients
- `app/src/main/java/sh/sar/basedbank/api/mib/MibLoginFlow.kt` - Authentication
- `app/src/main/java/sh/sar/basedbank/api/mib/MibTransferClient.kt` - Transfers & account lookup
- `app/src/main/java/sh/sar/basedbank/api/mib/MibContactsClient.kt` - Contacts/beneficiaries
- `app/src/main/java/sh/sar/basedbank/api/mib/MibCardsClient.kt` - Card operations
- `app/src/main/java/sh/sar/basedbank/api/mib/MibHistoryClient.kt` - Transaction history
- `app/src/main/java/sh/sar/basedbank/api/mib/MibActivityHistoryClient.kt` - Activity logs
- `app/src/main/java/sh/sar/basedbank/api/mib/MibProfileClient.kt` - User profile
- `app/src/main/java/sh/sar/basedbank/api/mib/MibFinancingClient.kt` - Financing

### Security & Utilities
- `app/src/main/java/sh/sar/basedbank/api/mib/MibCrypto.kt` - AES encryption/decryption
- `app/src/main/java/sh/sar/basedbank/api/mib/MibNonce.kt` - Nonce generation (anti-replay)
- `app/src/main/java/sh/sar/basedbank/api/mib/MibModels.kt` - Data models
- `app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt` - Credential storage

### Parsers & Handlers
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibHistoryParser.kt`
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibAccountParser.kt`
- `app/src/main/java/sh/sar/basedbank/util/mibapi/MibContactParser.kt`
- `app/src/main/java/sh/sar/basedbank/ui/home/transfer/MibTransferHandler.kt`

---

## Base URLs

| Type | URL |
|------|-----|
| **Encrypted API** | `https://faisamobilex-smvc-v2.mib.com.mv/index/` |
| **WebView/Data** | `https://faisamobilex-wv.mib.com.mv` |

---

## Authentication & Security

### Session Headers
```
Cookie: mbmodel=IOS-1.0; xxid=<session_id>; IBSID=<session_id>; mbnonce=<nonce>; time-tracker=597
X-Requested-With: XMLHttpRequest
Accept: */*
Origin: https://faisamobilex-wv.mib.com.mv
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
```

### Session Expiry Detection
- HTTP `419` status code
- JSON `reasonCode == "505"` in encrypted response
- Auto-recovery: re-login and retry (once)

### Password Hashing (PGF03)
```
pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))
```

---

## Upgrade Checklist

### Core Implementation
- [x] Update encrypted API endpoint URL
- [x] Update User-Agent header
- [x] Add X-Request-ID header
- [x] Verify Blowfish encryption compatibility
- [x] Test device registration flow
- [x] Test regular login flow
- [x] Test OTP verification
- [x] Test profile switching

### WebView Endpoints (Pending)
- [ ] Test beneficiary management (`/ajaxBeneficiary/*`)
- [ ] Test transfer endpoints (`/ajaxTransfer/*`, `/AjaxAlias/*`)
- [ ] Test debit card endpoints (`/ajaxDebitCard/*`)
- [ ] Test transaction history (`/ajaxAccounts/trxHistory`)
- [ ] Test activity history (`/aProfile/getPagedActivityHistory`)
- [ ] Test user profile scraping (`/personalProfile`)
- [ ] Test financing (`/financing?dashurl=1`)
- [ ] Test session keep-alive (`/aProfile/keepAlive`)

### Validation
- [ ] Verify all account balances display correctly
- [ ] Verify error handling (419, 505) and auto-recovery
- [ ] Verify all data formats match expectations
- [ ] Full end-to-end user flow test

---

**Implementation:** 2026-10-22 ✅  
**WebView Testing:** In progress