fksar/docs/mibapi/upgradev2.md

MIB API v1 to v2 Upgrade Tracking

This document tracks all MIB API calls used by thijooree and their upgrade status from v1 to v2.

---

Summary

Total API Endpoints: 28+
Categories: 8
Last Updated: 2026-10-22

---

API Endpoints by Category

1. Authentication & Login (Encrypted API)

API Code	Endpoint	Purpose	Used By	Status
sfunc=r + S40	Key Exchange (Init)	First-time device registration	MibLoginFlow.kt	✅
sfunc=i + S40	Key Exchange (Login)	Regular login session setup	MibLoginFlow.kt	✅
sfunc=n + C41	Registration Init	Initialize device registration flow	MibLoginFlow.kt	✅
sfunc=n + C42	OTP Verification	Verify one-time password after registration	MibLoginFlow.kt	✅
sfunc=n + A41	Main Login	Submit username/password credentials	MibLoginFlow.kt	✅
sfunc=n + A44	Get User Salt	Retrieve user salt for password hashing	MibLoginFlow.kt	✅
sfunc=n + P47	Switch Profile	Activate different user profile	MibLoginFlow.kt	✅

---

2. Beneficiary & Contact Management

Endpoint	Purpose	Used By	Status
/ajaxBeneficiary/getCategories	Fetch beneficiary category list	MibContactsClient.kt	☐
/ajaxBeneficiary/main	List all contacts (paginated)	MibContactsClient.kt, AddContactSheetFragment.kt	☐
/ajaxBeneficiary/createLocalBeneficiary	Add new beneficiary	MibContactsClient.kt, AddContactSheetFragment.kt	☐
/ajaxBeneficiary/deleteBeneficiary	Remove beneficiary	MibContactsClient.kt, ContactsFragment.kt	☐
/ajaxBeneficiary/getProfileImage	Get contact profile picture	MibContactsClient.kt	☐

---

3. Fund Transfers

Endpoint	Purpose	Used By	Status
/ajaxTransfer/transferInternal	MIB-to-MIB internal transfer (Bank code 2)	MibTransferClient.kt, TransferFragment.kt	☐
/ajaxTransfer/transferLocal	Transfer to BML account (Bank code 3)	MibTransferClient.kt, TransferFragment.kt	☐
/ajaxBeneficiary/getAccountName	Lookup MIB account (17-digit format)	MibTransferClient.kt, MibTransferHandler.kt	☐
/AjaxAlias/getIPSAccount	Lookup IPS/BML account (15-digit format)	MibTransferClient.kt, MibTransferHandler.kt	☐
/AjaxAlias/getAlias	Lookup Favara alias (shortcodes, IDs, email)	MibTransferClient.kt, MibTransferHandler.kt	☐

---

4. Debit Card Operations

Endpoint	Purpose	Used By	Status
/ajaxDebitCard/fetchCardInfos	Retrieve list of debit cards	MibCardsClient.kt, PayWithCardFragment.kt	☐
/ajaxDebitCard/freeze	Freeze/block debit card	MibCardsClient.kt	☐
/ajaxDebitCard/unfreeze	Unfreeze/unblock debit card	MibCardsClient.kt	☐

---

5. Transaction History

Endpoint	Purpose	Used By	Status
/ajaxAccounts/trxHistory	Fetch account transaction history (paginated)	MibHistoryClient.kt, AccountHistoryFragment.kt, TransferHistoryFragment.kt	☐

---

6. Activity & Audit Logs

Endpoint	Purpose	Used By	Status
/aProfile/getPagedActivityHistory	Fetch activity alerts and audit logs (paginated)	MibActivityHistoryClient.kt	☐

---

7. User Profile

Endpoint	Purpose	Used By	Status
GET /personalProfile	HTML scrape: fullName, username, email, mobile, enrolled date	MibProfileClient.kt	☐

---

8. Financing & Loans

Endpoint	Purpose	Used By	Status
GET /financing?dashurl=1	Fetch financing/loan deals (HTML parsing)	MibFinancingClient.kt	☐

---

9. Session Management

Endpoint	Purpose	Used By	Status
POST /aProfile/keepAlive	Periodic session keep-alive (empty body)	HomeActivity.kt	☐

---

Implementation Files Reference

Core MIB API Clients

• app/src/main/java/sh/sar/basedbank/api/mib/MibLoginFlow.kt - Authentication
• app/src/main/java/sh/sar/basedbank/api/mib/MibTransferClient.kt - Transfers & account lookup
• app/src/main/java/sh/sar/basedbank/api/mib/MibContactsClient.kt - Contacts/beneficiaries
• app/src/main/java/sh/sar/basedbank/api/mib/MibCardsClient.kt - Card operations
• app/src/main/java/sh/sar/basedbank/api/mib/MibHistoryClient.kt - Transaction history
• app/src/main/java/sh/sar/basedbank/api/mib/MibActivityHistoryClient.kt - Activity logs
• app/src/main/java/sh/sar/basedbank/api/mib/MibProfileClient.kt - User profile
• app/src/main/java/sh/sar/basedbank/api/mib/MibFinancingClient.kt - Financing

Security & Utilities

• app/src/main/java/sh/sar/basedbank/api/mib/MibCrypto.kt - AES encryption/decryption
• app/src/main/java/sh/sar/basedbank/api/mib/MibNonce.kt - Nonce generation (anti-replay)
• app/src/main/java/sh/sar/basedbank/api/mib/MibModels.kt - Data models
• app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt - Credential storage

Parsers & Handlers

• app/src/main/java/sh/sar/basedbank/util/mibapi/MibHistoryParser.kt
• app/src/main/java/sh/sar/basedbank/util/mibapi/MibAccountParser.kt
• app/src/main/java/sh/sar/basedbank/util/mibapi/MibContactParser.kt
• app/src/main/java/sh/sar/basedbank/ui/home/transfer/MibTransferHandler.kt

---

Base URLs

Type	URL
Encrypted API	https://faisamobilex-smvc-v2.mib.com.mv/index/
WebView/Data	https://faisamobilex-wv.mib.com.mv

---

Authentication & Security

Session Headers

Cookie: mbmodel=IOS-1.0; xxid=<session_id>; IBSID=<session_id>; mbnonce=<nonce>; time-tracker=597
X-Requested-With: XMLHttpRequest
Accept: */*
Origin: https://faisamobilex-wv.mib.com.mv
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Session Expiry Detection

• HTTP 419 status code
• JSON reasonCode == "505" in encrypted response
• Auto-recovery: re-login and retry (once)

Password Hashing (PGF03)

pgf03 = SHA256(clientSalt + SHA256(SHA256(password) + userSalt))

---

Upgrade Checklist

Core Implementation

• Update encrypted API endpoint URL
• Update User-Agent header
• Add X-Request-ID header
• Verify Blowfish encryption compatibility
• Test device registration flow
• Test regular login flow
• Test OTP verification
• Test profile switching

WebView Endpoints (Pending)

• Test beneficiary management (/ajaxBeneficiary/*)
• Test transfer endpoints (/ajaxTransfer/*, /AjaxAlias/*)
• Test debit card endpoints (/ajaxDebitCard/*)
• Test transaction history (/ajaxAccounts/trxHistory)
• Test activity history (/aProfile/getPagedActivityHistory)
• Test user profile scraping (/personalProfile)
• Test financing (/financing?dashurl=1)
• Test session keep-alive (/aProfile/keepAlive)

Validation

• Verify all account balances display correctly
• Verify error handling (419, 505) and auto-recovery
• Verify all data formats match expectations
• Full end-to-end user flow test

---

Implementation: 2026-10-22 ✅
WebView Testing: In progress