fksar/docs/mibapi/upgradev2.md

MIB API v1 to v2 Upgrade Tracking

This document tracks all MIB API calls used by thijooree and their upgrade status from v1 to v2.

---

Summary

Total API Endpoints: 28+
Categories: 8
Last Updated: 2026-10-22

---

API Endpoints by Category

1. Authentication & Login (Encrypted API)

API Code	Endpoint	Purpose	Used By	Status
sfunc=r + S40	Key Exchange (Init)	First-time device registration	MibLoginFlow.kt	✅
sfunc=i + S40	Key Exchange (Login)	Regular login session setup	MibLoginFlow.kt	✅
sfunc=n + C41	Registration Init	Initialize device registration flow	MibLoginFlow.kt	✅
sfunc=n + C42	OTP Verification	Verify one-time password after registration	MibLoginFlow.kt	✅
sfunc=n + A41	Main Login	Submit username/password credentials	MibLoginFlow.kt	✅
sfunc=n + A44	Get User Salt	Retrieve user salt for password hashing	MibLoginFlow.kt	✅
sfunc=n + P47	Switch Profile	Activate different user profile	MibLoginFlow.kt	✅
sfunc=n + A80	Accounts	Refresh account list/balances for active profile (same shape as P47 accountBalance)	— (not used yet)	ℹ️
sfunc=n + A83	GIA Accounts	{start:1,end:30,statusType:0,includeCount:0}	— (not used)	ℹ️
sfunc=n + A47	Pending approvals	{status:"P",start:0,end:30,includeCount:1} (business profiles)	— (not used)	ℹ️
sfunc=n + P41	Profile image	{imageHash} → base64 JPEG in profileImage	— (not used yet)	ℹ️
sfunc=n + B46	Beneficiary image	{imageHash} → base64 JPEG in profileImage	— (not used yet)	ℹ️
sfunc=i + P80	Promo banners	Encrypted with key1, not session key	— (not used)	ℹ️

---

2. Beneficiary & Contact Management

v2 moved all contact calls to the encrypted API (sfunc=n). Bank IDs/names/SWIFT come from B49 (login).

v1 endpoint	v2 route	Request	Used By	Status
/ajaxBeneficiary/getCategories	B41	Categories come back in every B41 response as categories[] — no separate call	MibContactsClient.kt, HomeActivity.kt	🔧 implemented — needs device test
/ajaxBeneficiary/main	B41	{start,end,benefType:"A",search:"",includeCount:1,searchCategoryId:0,sortBenef:""} — selects 1-based rnum between start/end inclusive; last row has last:"1"	MibContactsClient.kt, AddContactSheetFragment.kt	🔧 implemented — needs device test
/ajaxBeneficiary/createLocalBeneficiary	B43	{benefName,benefAccount,bankNo,nickName,transferCy,categoryId,image?,bankName,bankSwift} — nickname > ~20 chars → invalid nick name	MibContactsClient.kt, AddContactSheetFragment.kt	🔧 implemented (BML captured; MIB-internal bankName/swift from B49, not captured)
— (new)	B52	Update: B43 fields + benefNo, imageChanged:"0"/"1", image when changed	MibContactsClient.kt, AddContactSheetFragment.kt (edit mode), ContactDetailsSheetFragment.kt	🔧 implemented — needs device test
/ajaxBeneficiary/deleteBeneficiary	B48	{benefNo}	MibContactsClient.kt, ContactManager.kt	🔧 implemented — needs device test
/ajaxBeneficiary/getProfileImage	B46	{imageHash} → profileImage base64 JPEG	MibContactsClient.kt + image loaders	🔧 implemented — needs device test
—	B40	Account name lookup {search} → [{benefName,benefAccount,bankCode,benefBankName}]	— (check against transfer lookups)	ℹ️
—	T63	Currencies + rates	— (not used)	ℹ️

----------|---------|---------|--------| | /ajaxBeneficiary/getCategories | Fetch beneficiary category list | MibContactsClient.kt | ☐ | | /ajaxBeneficiary/main | List all contacts (paginated) | MibContactsClient.kt, AddContactSheetFragment.kt | ☐ | | /ajaxBeneficiary/createLocalBeneficiary | Add new beneficiary | MibContactsClient.kt, AddContactSheetFragment.kt | ☐ | | /ajaxBeneficiary/deleteBeneficiary | Remove beneficiary | MibContactsClient.kt, ContactsFragment.kt | ☐ | | /ajaxBeneficiary/getProfileImage | Get contact profile picture | MibContactsClient.kt | ☐ |

---

3. Fund Transfers

v2 moved transfers and all destination lookups to the encrypted API (sfunc=n). Failures come back as HTTP 400 with an encrypted body.

v1 endpoint	v2 route	Request / notes	Used By	Status
/ajaxTransfer/transferInternal	T50	{benefName,benefNo:"0",fromAccountNo,benefAccountNo,transferCy,benefCurrencyCode,amount,bankNo:"2",purpose,otp,otpType:"3"} → data[0].{date,trxId,availableBalance} + accountBalance[]	MibTransferClient.kt, MibTransferHandler.kt	🔧 implemented — needs device test
/ajaxTransfer/transferLocal	T51	Same as T50 with bankNo:"3" → data[0].{date,trxId} ("Local transfer completed successfully via Favara")	MibTransferClient.kt, MibTransferHandler.kt	🔧 implemented — needs device test
/ajaxBeneficiary/getAccountName	B40	{search} → data[0].{benefName,benefAccount,bankCode,benefBankName,transferCy?,transferCyDesc?}; bankCode is "MIB" or a BIC (MADVMVMV, MALBMVMV); empty data = not found	MibTransferClient.kt	🔧 implemented — needs device test
/AjaxAlias/getIPSAccount	B40	as above	MibTransferClient.kt	🔧 implemented — needs device test
/AjaxAlias/getAlias	B40	as above; phone must be bare 7 digits (+960 … returns empty); Favara ID needs uppercase A (a239225 fails)	MibTransferClient.kt	🔧 implemented — needs device test
—	T71 / T66 / T63 / T70	AML limits / USD sell rate / currencies / upload settings	— (not used)	ℹ️

Transfer errors seen:

• reasonCode 213 "Invalid OTP" (data[0].otpId) and reasonCode 707 "That OTP is already used!" → thijooree waits for the next TOTP window and retries once, then shows the error.
• reasonCode 201 "Transaction currency does not match From Account currency!"

----------|---------|---------|--------| | /ajaxTransfer/transferInternal | MIB-to-MIB internal transfer (Bank code 2) | MibTransferClient.kt, TransferFragment.kt | ☐ | | /ajaxTransfer/transferLocal | Transfer to BML account (Bank code 3) | MibTransferClient.kt, TransferFragment.kt | ☐ | | /ajaxBeneficiary/getAccountName | Lookup MIB account (17-digit format) | MibTransferClient.kt, MibTransferHandler.kt | ☐ | | /AjaxAlias/getIPSAccount | Lookup IPS/BML account (15-digit format) | MibTransferClient.kt, MibTransferHandler.kt | ☐ | | /AjaxAlias/getAlias | Lookup Favara alias (shortcodes, IDs, email) | MibTransferClient.kt, MibTransferHandler.kt | ☐ |

---

4. Debit Card Operations

Endpoint	Purpose	Used By	Status
/ajaxDebitCard/fetchCardInfos	Retrieve list of debit cards	MibCardsClient.kt, PayWithCardFragment.kt	✅ host switched, tested
/ajaxDebitCard/freeze	Freeze/block debit card	MibCardsClient.kt	✅ host switched, tested
/ajaxDebitCard/unfreeze	Unfreeze/unblock debit card	MibCardsClient.kt	✅ host switched, tested

---

5. Transaction History

Endpoint	Purpose	Used By	Status
/ajaxAccounts/trxHistory → sfunc=n + A84	Fetch account transaction history (paginated). v2 moved this to the encrypted API: {accountNo,start:0,end:19,includeCount:true,trxType:0,sortTrx:"date",sortDir:"desc"} (0-based inclusive), response fields unchanged, total_count present	MibHistoryClient.kt, HistoryFetcher.kt, TransferHistoryFragment.kt	✅ implemented, tested incl. paging

---

6. Activity & Audit Logs

Endpoint	Purpose	Used By	Status
/aProfile/getPagedActivityHistory	Fetch activity alerts and audit logs (paginated)	MibActivityHistoryClient.kt	☐

---

7. User Profile

v1 endpoint	v2 source	Notes	Used By	Status
GET /personalProfile (HTML scrape)	A41 login response	fullName, email	MibLoginFlow.kt	🔧 implemented — needs device test
—	POST /ajaxAlias/getAliasTypes (-wv-v2, empty body)	data[].{id,aliasTypeName,suggestedAlias}: 0 mobile, 1 email, 3 National ID. Tied to the active profile, so the personal profile (profileType 0) is selected first. Fetched at login and cached.	MibProfileClient.kt, SettingsLoginsFragment.kt	🔧 implemented — needs device test
—	POST /ajaxAlias/main	Registered Favara aliases (AlsBfy, CdtrAcct, AdrLine, …)	— (not used)	ℹ️

----------|---------|---------|--------| | GET /personalProfile | HTML scrape: fullName, username, email, mobile, enrolled date | MibProfileClient.kt | ☐ |

---

8. Financing & Loans

Endpoint	Purpose	Used By	Status
GET /financing?dashurl=1	Fetch financing/loan deals (HTML parsing)	MibFinancingClient.kt	✅ works on -wv-v2

---

9. Session Management

Endpoint	Purpose	Used By	Status
POST /aProfile/keepAlive	Periodic session keep-alive (empty body)	HomeActivity.kt	🔧 host switched (seen on -wv-v2 in HAR, 419 after expiry) — needs device test

---

Implementation Files Reference

Core MIB API Clients

• app/src/main/java/sh/sar/basedbank/api/mib/MibLoginFlow.kt - Authentication
• app/src/main/java/sh/sar/basedbank/api/mib/MibTransferClient.kt - Transfers & account lookup
• app/src/main/java/sh/sar/basedbank/api/mib/MibContactsClient.kt - Contacts/beneficiaries
• app/src/main/java/sh/sar/basedbank/api/mib/MibCardsClient.kt - Card operations
• app/src/main/java/sh/sar/basedbank/api/mib/MibHistoryClient.kt - Transaction history
• app/src/main/java/sh/sar/basedbank/api/mib/MibActivityHistoryClient.kt - Activity logs
• app/src/main/java/sh/sar/basedbank/api/mib/MibProfileClient.kt - User profile
• app/src/main/java/sh/sar/basedbank/api/mib/MibFinancingClient.kt - Financing

Security & Utilities

• app/src/main/java/sh/sar/basedbank/api/mib/MibCrypto.kt - AES encryption/decryption
• app/src/main/java/sh/sar/basedbank/api/mib/MibNonce.kt - Nonce generation (anti-replay)
• app/src/main/java/sh/sar/basedbank/api/mib/MibModels.kt - Data models
• app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt - Credential storage

Parsers & Handlers

• app/src/main/java/sh/sar/basedbank/util/mibapi/MibHistoryParser.kt
• app/src/main/java/sh/sar/basedbank/util/mibapi/MibAccountParser.kt
• app/src/main/java/sh/sar/basedbank/util/mibapi/MibContactParser.kt
• app/src/main/java/sh/sar/basedbank/ui/home/transfer/MibTransferHandler.kt

---

Base URLs

Type	URL
Encrypted API	https://faisamobilex-smvc-v2.mib.com.mv/index/
WebView/Data	https://faisamobilex-wv-v2.mib.com.mv (v1: faisamobilex-wv)

---

Authentication & Security

Session Headers

Cookie: mbmodel=AND-1.0; xxid=<session_id>; IBSID=<session_id>; mbnonce=<nonce>; time-tracker=597
X-Requested-With: XMLHttpRequest
Accept: */*
Origin: https://faisamobilex-wv-v2.mib.com.mv
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Session Expiry Detection

• HTTP 419 status code
• JSON reasonCode == "505" in encrypted response
• Auto-recovery: re-login and retry (once)

Password Hashing (PGF03)

pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))

---

Upgrade Checklist

Core Implementation

• Update encrypted API endpoint URL
• Update User-Agent header
• Add X-Request-ID header
• Verify Blowfish encryption compatibility
• Test device registration flow
• Test regular login flow
• Test OTP verification
• Test profile switching

WebView Endpoints (Pending)

• Switch all WebView clients to faisamobilex-wv-v2 host and mbmodel=AND-1.0 cookie
• Capture beneficiary management — moved to encrypted B4x/B52, implemented
• Test contacts on device (list, add with/without photo, edit, delete, images)
• Capture transfer endpoints — moved to encrypted T50/T51/B40, implemented with OTP retry
• Test transfers on device (MIB→MIB, MIB→BML, lookups incl. Favara alias)
• Capture debit card endpoints (/ajaxDebitCard/*) — unchanged apart from host
• Test debit card endpoints on device
• Capture transaction history — moved to encrypted A84, implemented
• Test transaction history on device (incl. page 2)
• Test activity history (/aProfile/getPagedActivityHistory)
• Capture user profile — /personalProfile scrape replaced by A41 + getAliasTypes
• Test login details (name, email, mobile, ID card) on device
• Test financing (/financing?dashurl=1) — works on -wv-v2
• Test session keep-alive (/aProfile/keepAlive)

Validation

• Verify all account balances display correctly
• Verify error handling (419, 505) and auto-recovery
• Verify all data formats match expectations
• Full end-to-end user flow test

---

Implementation: 2026-10-22 ✅
WebView Testing: In progress