ahusan/fksar
1
0
Fork 0
forked from thijooree/android
Code Pull Requests Activity
Files
46edefe4d7809aa5c1c4848b386a4d2fa2250989
fksar/docs/mibapi/upgradev2.md
T

13 KiB
Raw Blame History

MIB API v1 to v2 Upgrade Tracking

This document tracks all MIB API calls used by thijooree and their upgrade status from v1 to v2.

Summary

Total API Endpoints: 28+
Categories: 8
Last Updated: 2026-10-22

API Endpoints by Category

1. Authentication & Login (Encrypted API)

API Code Endpoint Purpose Used By Status
sfunc=r + S40 Key Exchange (Init) First-time device registration MibLoginFlow.kt ✅
sfunc=i + S40 Key Exchange (Login) Regular login session setup MibLoginFlow.kt ✅
sfunc=n + C41 Registration Init Initialize device registration flow MibLoginFlow.kt ✅
sfunc=n + C42 OTP Verification Verify one-time password after registration MibLoginFlow.kt ✅
sfunc=n + A41 Main Login Submit username/password credentials MibLoginFlow.kt ✅
sfunc=n + A44 Get User Salt Retrieve user salt for password hashing MibLoginFlow.kt ✅
sfunc=n + P47 Switch Profile Activate different user profile MibLoginFlow.kt ✅
sfunc=n + A80 Accounts Refresh account list/balances for active profile (same shape as P47 accountBalance) — (not used yet) ℹ️
sfunc=n + A83 GIA Accounts {start:1,end:30,statusType:0,includeCount:0} — (not used) ℹ️
sfunc=n + A47 Pending approvals {status:"P",start:0,end:30,includeCount:1} (business profiles) — (not used) ℹ️
sfunc=n + P41 Profile image {imageHash} → base64 JPEG in profileImage — (not used yet) ℹ️
sfunc=n + B46 Beneficiary image {imageHash} → base64 JPEG in profileImage — (not used yet) ℹ️
sfunc=i + P80 Promo banners Encrypted with key1, not session key — (not used) ℹ️

2. Beneficiary & Contact Management

v2 moved all contact calls to the encrypted API (sfunc=n). Bank IDs/names/SWIFT come from B49 (login).

v1 endpoint v2 route Request Used By Status
/ajaxBeneficiary/getCategories B41 Categories come back in every B41 response as categories[] — no separate call MibContactsClient.kt, HomeActivity.kt 🔧 implemented — needs device test
/ajaxBeneficiary/main B41 {start,end,benefType:"A",search:"",includeCount:1,searchCategoryId:0,sortBenef:""} — selects 1-based rnum between start/end inclusive; last row has last:"1" MibContactsClient.kt, AddContactSheetFragment.kt 🔧 implemented — needs device test
/ajaxBeneficiary/createLocalBeneficiary B43 {benefName,benefAccount,bankNo,nickName,transferCy,categoryId,image?,bankName,bankSwift} — nickname > ~20 chars → invalid nick name MibContactsClient.kt, AddContactSheetFragment.kt 🔧 implemented (BML captured; MIB-internal bankName/swift from B49, not captured)
— (new) B52 Update: B43 fields + benefNo, imageChanged:"0"/"1", image when changed MibContactsClient.kt, AddContactSheetFragment.kt (edit mode), ContactDetailsSheetFragment.kt 🔧 implemented — needs device test
/ajaxBeneficiary/deleteBeneficiary B48 {benefNo} MibContactsClient.kt, ContactManager.kt 🔧 implemented — needs device test
/ajaxBeneficiary/getProfileImage B46 {imageHash} → profileImage base64 JPEG MibContactsClient.kt + image loaders 🔧 implemented — needs device test
— B40 Account name lookup {search} → [{benefName,benefAccount,bankCode,benefBankName}] — (check against transfer lookups) ℹ️
— T63 Currencies + rates — (not used) ℹ️

----------|---------|---------|--------| | /ajaxBeneficiary/getCategories | Fetch beneficiary category list | MibContactsClient.kt | ☐ | | /ajaxBeneficiary/main | List all contacts (paginated) | MibContactsClient.kt, AddContactSheetFragment.kt | ☐ | | /ajaxBeneficiary/createLocalBeneficiary | Add new beneficiary | MibContactsClient.kt, AddContactSheetFragment.kt | ☐ | | /ajaxBeneficiary/deleteBeneficiary | Remove beneficiary | MibContactsClient.kt, ContactsFragment.kt | ☐ | | /ajaxBeneficiary/getProfileImage | Get contact profile picture | MibContactsClient.kt | ☐ |

3. Fund Transfers

v2 moved transfers and all destination lookups to the encrypted API (sfunc=n). Failures come back as HTTP 400 with an encrypted body.

v1 endpoint v2 route Request / notes Used By Status
/ajaxTransfer/transferInternal T50 {benefName,benefNo:"0",fromAccountNo,benefAccountNo,transferCy,benefCurrencyCode,amount,bankNo:"2",purpose,otp,otpType:"3"} → data[0].{date,trxId,availableBalance} + accountBalance[] MibTransferClient.kt, MibTransferHandler.kt 🔧 implemented — needs device test
/ajaxTransfer/transferLocal T51 Same as T50 with bankNo:"3" → data[0].{date,trxId} ("Local transfer completed successfully via Favara") MibTransferClient.kt, MibTransferHandler.kt 🔧 implemented — needs device test
/ajaxBeneficiary/getAccountName B40 {search} → data[0].{benefName,benefAccount,bankCode,benefBankName,transferCy?,transferCyDesc?}; bankCode is "MIB" or a BIC (MADVMVMV, MALBMVMV); empty data = not found MibTransferClient.kt 🔧 implemented — needs device test
/AjaxAlias/getIPSAccount B40 as above MibTransferClient.kt 🔧 implemented — needs device test
/AjaxAlias/getAlias B40 as above; phone must be bare 7 digits (+960 … returns empty); Favara ID needs uppercase A (a239225 fails) MibTransferClient.kt 🔧 implemented — needs device test
— T71 / T66 / T63 / T70 AML limits / USD sell rate / currencies / upload settings — (not used) ℹ️

Transfer errors seen:

  • reasonCode 213 "Invalid OTP" (data[0].otpId) and reasonCode 707 "That OTP is already used!" → thijooree waits for the next TOTP window and retries once, then shows the error.
  • reasonCode 201 "Transaction currency does not match From Account currency!"

----------|---------|---------|--------| | /ajaxTransfer/transferInternal | MIB-to-MIB internal transfer (Bank code 2) | MibTransferClient.kt, TransferFragment.kt | ☐ | | /ajaxTransfer/transferLocal | Transfer to BML account (Bank code 3) | MibTransferClient.kt, TransferFragment.kt | ☐ | | /ajaxBeneficiary/getAccountName | Lookup MIB account (17-digit format) | MibTransferClient.kt, MibTransferHandler.kt | ☐ | | /AjaxAlias/getIPSAccount | Lookup IPS/BML account (15-digit format) | MibTransferClient.kt, MibTransferHandler.kt | ☐ | | /AjaxAlias/getAlias | Lookup Favara alias (shortcodes, IDs, email) | MibTransferClient.kt, MibTransferHandler.kt | ☐ |

4. Debit Card Operations

Endpoint Purpose Used By Status
/ajaxDebitCard/fetchCardInfos Retrieve list of debit cards MibCardsClient.kt, PayWithCardFragment.kt ✅ host switched, tested
/ajaxDebitCard/freeze Freeze/block debit card MibCardsClient.kt ✅ host switched, tested
/ajaxDebitCard/unfreeze Unfreeze/unblock debit card MibCardsClient.kt ✅ host switched, tested

5. Transaction History

Endpoint Purpose Used By Status
/ajaxAccounts/trxHistory → sfunc=n + A84 Fetch account transaction history (paginated). v2 moved this to the encrypted API: {accountNo,start:0,end:19,includeCount:true,trxType:0,sortTrx:"date",sortDir:"desc"} (0-based inclusive), response fields unchanged, total_count present MibHistoryClient.kt, HistoryFetcher.kt, TransferHistoryFragment.kt ✅ implemented, tested incl. paging

6. Activity & Audit Logs

Endpoint Purpose Used By Status
/aProfile/getPagedActivityHistory Fetch activity alerts and audit logs (paginated) MibActivityHistoryClient.kt ☐

7. User Profile

Endpoint Purpose Used By Status
GET /personalProfile HTML scrape: fullName, username, email, mobile, enrolled date MibProfileClient.kt ☐

8. Financing & Loans

Endpoint Purpose Used By Status
GET /financing?dashurl=1 Fetch financing/loan deals (HTML parsing) MibFinancingClient.kt ✅ works on -wv-v2

9. Session Management

Endpoint Purpose Used By Status
POST /aProfile/keepAlive Periodic session keep-alive (empty body) HomeActivity.kt 🔧 host switched (seen on -wv-v2 in HAR, 419 after expiry) — needs device test

Implementation Files Reference

Core MIB API Clients

  • app/src/main/java/sh/sar/basedbank/api/mib/MibLoginFlow.kt - Authentication
  • app/src/main/java/sh/sar/basedbank/api/mib/MibTransferClient.kt - Transfers & account lookup
  • app/src/main/java/sh/sar/basedbank/api/mib/MibContactsClient.kt - Contacts/beneficiaries
  • app/src/main/java/sh/sar/basedbank/api/mib/MibCardsClient.kt - Card operations
  • app/src/main/java/sh/sar/basedbank/api/mib/MibHistoryClient.kt - Transaction history
  • app/src/main/java/sh/sar/basedbank/api/mib/MibActivityHistoryClient.kt - Activity logs
  • app/src/main/java/sh/sar/basedbank/api/mib/MibProfileClient.kt - User profile
  • app/src/main/java/sh/sar/basedbank/api/mib/MibFinancingClient.kt - Financing

Security & Utilities

  • app/src/main/java/sh/sar/basedbank/api/mib/MibCrypto.kt - AES encryption/decryption
  • app/src/main/java/sh/sar/basedbank/api/mib/MibNonce.kt - Nonce generation (anti-replay)
  • app/src/main/java/sh/sar/basedbank/api/mib/MibModels.kt - Data models
  • app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt - Credential storage

Parsers & Handlers

  • app/src/main/java/sh/sar/basedbank/util/mibapi/MibHistoryParser.kt
  • app/src/main/java/sh/sar/basedbank/util/mibapi/MibAccountParser.kt
  • app/src/main/java/sh/sar/basedbank/util/mibapi/MibContactParser.kt
  • app/src/main/java/sh/sar/basedbank/ui/home/transfer/MibTransferHandler.kt

Base URLs

Type URL
Encrypted API https://faisamobilex-smvc-v2.mib.com.mv/index/
WebView/Data https://faisamobilex-wv-v2.mib.com.mv (v1: faisamobilex-wv)

Authentication & Security

Session Headers

Cookie: mbmodel=AND-1.0; xxid=<session_id>; IBSID=<session_id>; mbnonce=<nonce>; time-tracker=597
X-Requested-With: XMLHttpRequest
Accept: */*
Origin: https://faisamobilex-wv-v2.mib.com.mv
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Session Expiry Detection

  • HTTP 419 status code
  • JSON reasonCode == "505" in encrypted response
  • Auto-recovery: re-login and retry (once)

Password Hashing (PGF03)

pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))

Upgrade Checklist

Core Implementation

  • Update encrypted API endpoint URL
  • Update User-Agent header
  • Add X-Request-ID header
  • Verify Blowfish encryption compatibility
  • Test device registration flow
  • Test regular login flow
  • Test OTP verification
  • Test profile switching

WebView Endpoints (Pending)

  • Switch all WebView clients to faisamobilex-wv-v2 host and mbmodel=AND-1.0 cookie
  • Capture beneficiary management — moved to encrypted B4x/B52, implemented
  • Test contacts on device (list, add with/without photo, edit, delete, images)
  • Capture transfer endpoints — moved to encrypted T50/T51/B40, implemented with OTP retry
  • Test transfers on device (MIB→MIB, MIB→BML, lookups incl. Favara alias)
  • Capture debit card endpoints (/ajaxDebitCard/*) — unchanged apart from host
  • Test debit card endpoints on device
  • Capture transaction history — moved to encrypted A84, implemented
  • Test transaction history on device (incl. page 2)
  • Test activity history (/aProfile/getPagedActivityHistory)
  • Test user profile scraping (/personalProfile)
  • Test financing (/financing?dashurl=1) — works on -wv-v2
  • Test session keep-alive (/aProfile/keepAlive)

Validation

  • Verify all account balances display correctly
  • Verify error handling (419, 505) and auto-recovery
  • Verify all data formats match expectations
  • Full end-to-end user flow test

Implementation: 2026-10-22 ✅
WebView Testing: In progress

View Git Blame Copy Permalink