Update Banking Transaction
Updates editable fields on a banking transaction, identified by transactionId.
Use this endpoint to enrich transactions in your reconciliation flow or ERP — for example, by recording operation context, reconciling the transaction, or classifying it by category and cost center.
Editable fields today:
notes— transaction notes (max 1000 characters). Send an empty string ("") to clear.isConciled— marks the transaction as reconciled. Onlytrueis accepted — reconciling is irreversible via the API.categoryId— numeric category ID.costCenterId— UUID of the cost center (use theidfield from GET /cost-centers/v1/cost-centers).
Rules:
transactionIdmust be the transactionidfrom the statement (GET /statements/v1/banking).- At least one field must be provided in the body.
- Sending
isConciled: falsereturns 400 Bad Request. - A
categoryIdorcostCenterIdthat doesn't exist for the company returns 400 Bad Request. - When the transaction can't be reconciled, the API returns 409 Conflict.
- On success, the API returns 204 No Content (no body).
Example:
curl -X PATCH https://api-sandbox.contasimples.com/statements/v1/banking/106615 \
-H "Authorization: Bearer {TOKEN}" \
-H "Content-Type: application/json" \
-d '{"notes":"Supplier payment","isConciled":true,"categoryId":1146}'
curl -X PATCH "https://api-sandbox.contasimples.com/statements/v1/banking/106615" \
-H "Content-Type: application/json" \
-H "Signature-Input: example_string" \
-H "Signature: example_string" \
-H "Content-Digest: example_string" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-d '{
"notes": "Supplier payment",
"isConciled": true,
"categoryId": 1146,
"costCenterId": "a02f8f63-8b1b-4328-9d7d-0d2e351b8118"
}'
import requests
import json
url = "https://api-sandbox.contasimples.com/statements/v1/banking/106615"
headers = {
"Content-Type": "application/json",
"Signature-Input": "example_string",
"Signature": "example_string",
"Content-Digest": "example_string",
"Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
"notes": "Supplier payment",
"isConciled": true,
"categoryId": 1146,
"costCenterId": "a02f8f63-8b1b-4328-9d7d-0d2e351b8118"
}
response = requests.patch(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://api-sandbox.contasimples.com/statements/v1/banking/106615", {
method: "PATCH",
headers: {
"Content-Type": "application/json",
"Signature-Input": "example_string",
"Signature": "example_string",
"Content-Digest": "example_string",
"Authorization": "Bearer YOUR_API_TOKEN"
},
body: JSON.stringify({
"notes": "Supplier payment",
"isConciled": true,
"categoryId": 1146,
"costCenterId": "a02f8f63-8b1b-4328-9d7d-0d2e351b8118"
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"notes": "Supplier payment",
"isConciled": true,
"categoryId": 1146,
"costCenterId": "a02f8f63-8b1b-4328-9d7d-0d2e351b8118"
}`)
req, err := http.NewRequest("PATCH", "https://api-sandbox.contasimples.com/statements/v1/banking/106615", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Signature-Input", "example_string")
req.Header.Set("Signature", "example_string")
req.Header.Set("Content-Digest", "example_string")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://api-sandbox.contasimples.com/statements/v1/banking/106615')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(uri)
request['Content-Type'] = 'application/json'
request['Signature-Input'] = 'example_string'
request['Signature'] = 'example_string'
request['Content-Digest'] = 'example_string'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
"notes": "Supplier payment",
"isConciled": true,
"categoryId": 1146,
"costCenterId": "a02f8f63-8b1b-4328-9d7d-0d2e351b8118"
}'
response = http.request(request)
puts response.body
{}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"requestId": "123e4567-e89b-12d3-a456-426614174000",
"details": [
"isConciled only accepts true — unmarking a transaction as reconciled is no longer supported"
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Forbidden",
"message": "The request is not allowed for the current credentials",
"code": 403,
"details": {
"requiredScope": "listCategories"
},
"requestId": "123e4567-e89b-12d3-a456-426614174000"
}
{
"error": "Not Found",
"message": "The requested resource was not found",
"code": 404
}
{
"error": "Conflict",
"message": "The request conflicts with the current state of the resource",
"code": 409,
"requestId": "123e4567-e89b-12d3-a456-426614174000"
}
{
"error": "Internal Server Error",
"message": "An unexpected error occurred on the server",
"code": 500,
"requestId": "req_1234567890"
}
/statements/v1/banking/{transactionId}Target server for requests. Edit to use your own host.
Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN
Bearer TOKENBanking transaction ID — use the id field from GET /statements/v1/banking (e.g. 106615).
The media type of the request body
What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.
The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.
Hash of the request body in the RFC 9530 format, with sha-256 or sha-512, for example sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:. It is required when the request has a body and the credential has a public key, and in that case Signature-Input must include the content-digest component.
Transaction notes. Send an empty string ("") to clear.
Marks the transaction as reconciled. Only true is accepted — reconciling is irreversible via the API.
Category ID — use the id field from GET /categories/v1/categories.
UUID of the cost center — use the id field from GET /cost-centers/v1/cost-centers.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN
Path Parameters
Banking transaction ID — use the id field from GET /statements/v1/banking (e.g. 106615).
106615Headers
What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.
The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.
Hash of the request body in the RFC 9530 format, with sha-256 or sha-512, for example sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:. It is required when the request has a body and the credential has a public key, and in that case Signature-Input must include the content-digest component.
Body
Marks the transaction as reconciled. Only true is accepted — reconciling is irreversible via the API.
trueUUID of the cost center — use the id field from GET /cost-centers/v1/cost-centers.
a02f8f63-8b1b-4328-9d7d-0d2e351b8118