# MIB Transfer API

Transfer endpoints are served from the MIB WebView subdomain, using the same session-cookie auth as
financing and contacts.

## Authentication

```
Cookie: mbmodel=IOS-1.0; xxid=<session_xxid>; IBSID=<session_xxid>; mbnonce=<nonceGenerator>; time-tracker=597
```

All AJAX POST requests also require:

```
X-Requested-With: XMLHttpRequest
Origin: https://faisamobilex-wv.mib.com.mv
Referer: https://faisamobilex-wv.mib.com.mv/transfer/quick
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
```

---

## Endpoints

### 1. Look Up Recipient by Favara Alias

Resolves a Favara ID (alias) to the account holder name and account number before initiating a transfer.

**POST** `https://faisamobilex-wv.mib.com.mv/AjaxAlias/getAlias`

**Request body (form-urlencoded):**

| Field       | Description                              |
|-------------|------------------------------------------|
| `aliasName` | The recipient's Favara ID / alias number |

**Success response (`responseCode: "2"`):**

```json
{
  "success": true,
  "responseCode": "2",
  "reasonCode": "203",
  "reasonText": " Favara ID found",
  "data": {
    "TxId": "BANK00001",
    "CreDtTm": "...",
    "Resp": {
      "Rslt": true,
      "RsltDtls": null
    },
    "CdtrAcct": {
      "Acct": "90100000000000000",
      "FinInstnId": "MADVMVMV"
    },
    "BfyNm": "Account Holder Name",
    "RegDtTm": "2023-01-01T00:00:00"
  }
}
```

**Not found / error response:**

```json
{
  "success": false,
  "responseCode": "0",
  "reasonCode": "400",
  "reasonText": "Alias not found"
}
```

Key fields from `data`:
- `BfyNm` — beneficiary full name (trim whitespace)
- `CdtrAcct.Acct` — resolved account number to use for the transfer
- `CdtrAcct.FinInstnId` — bank institution ID (e.g. `MADVMVMV`, `MALBMVMV`)

**Notes:**
- Use `success` (not `responseCode`) to determine if the lookup succeeded.
- Show `BfyNm` + `CdtrAcct.Acct` to the user as confirmation before proceeding.
- The `reasonText` from error responses should be shown directly to the user.