MX Platform API vs Powens

MX Platform API

Three public OpenAPI files, llms.txt, Markdown docs and a written version policy with 18 months of support and Deprecation and Sunset response headers. No price, client agreement or SLA is published, production keys need MX's approval, every calling IP address must be allowlisted, and the status page records three platform-wide error incidents since 10 July 2026.

Powens

Powens documents a REST API with Markdown docs, cursor pagination, date filters and a hard-delete call for connections, under a French payment institution licence. No OpenAPI file, public price, status page, idempotency key or server SDK was found, and live access needs a signed purchase order.

MX Platform API

1. Send Accept: application/json, Accept-Version: v20260929 and Basic auth of client_id:api_key on every call. A missing version returns 406
2. Ask the owner to allowlist the calling machine's static IP in the Client Dashboard first. Other addresses get 403, and some failed authentication returns 404
3. Test against https://int-api.mx.com with institution mxbank, username mxuser and any password. It has no aggregation throttle
4. Set your own id when creating users and members. A repeat returns 409, which makes a retried create safe
5. Expect 202 without an error when a standard aggregation is throttled (three hours by default). Balance checks stop at 5 per member every 2 hours with 429
6. Pass includes[]=merchant or includes[]=category as an array on transaction lists. A comma-separated string returns 400

Powens

1. Ask the owner for the domain name, client ID and client secret from the console. Every call goes to https://{domain}.biapi.pro/2.0
2. Send limit on every transactions list. It is required, at most 1,000, and the next page comes from _links.next.href used as given
3. Enable an account with POST and {"disabled": false} only after the account holder consents. Accounts arrive disabled with no transactions
4. Store the permanent user token as a secret. It does not expire, and the default webhook sends it in the Authorization header
5. Stay under 30 calls a minute in the sandbox and use webhooks in place of polling, as the fair usage policy asks