General

Who is develop.hsbc designed for?

develop.hsbc is built for software developers from client organisations and third parties who want to integrate HSBC’s APIs into their applications. The portal provides comprehensive tools, technical documentation, sandbox environments, and support to help you get started quickly.

Which markets does develop.hsbc support?

develop.hsbc is HSBC’s global developer portal, supporting both Open Banking and commercial APIs across the majority of markets where HSBC operates.

Commercial APIs: Designed for corporate banking customers worldwide

Open Banking APIs: Available for Hong Kong SAR, UK, Europe, and Mexico. See our Open Banking Get Started guide for market details

File Validator Tool: Supports file validation for HSBCnet, HSBC Connect, SWIFT FileAct, or API submission in most HSBC markets

HSBC Account Insights Tool: Supports most HSBC markets

What's new in registration?

Unified Registration: Access All HSBC APIs with One Journey

We’ve made it easier than ever to get started! With our new, streamlined registration process, a single sign-up gives you instant access to all HSBC Open Banking APIs. If you need corporate API access, you can request it during registration or at any time afterwards—just click the “Request Access” button when prompted (you’ll see it on restricted documentation pages, your user profile, or during DevHub project creation).

How it works:

1. Register for the portal.
2. Activate your account by clicking the link in your activation email.

Good to know:

- Open Banking APIs are available to everyone who registers—no restrictions.

- Corporate API access requires initial approval. You’ll be notified by email once it’s granted.

- Corporate API access: If you requested this, you’ll receive a confirmation email once your access is approved.

- Create a project in DevHub to receive your sandbox credentials and start building.

Why do I need to register?

Browse: View our API catalogue and overviews without registering.

Register: Required for technical documentation, sandbox access, and access to tools like File Validator, HSBC Account Insights and SDKs.

Can multiple users from the same company be added to the same organisation in develop.hsbc?

Yes! When the first user registers, a new organisation is created. Subsequent users from the same company are added to this organisation. Admin users can manage membership and invite others.

Why haven't I received my activation email?

Activation emails may sometimes be filtered into your spam or junk folder by your email provider. Please check these folders to ensure the email hasn't been misplaced. These emails may also be pre-filtered by your company’s mail administrator, meaning you won’t receive them unless your administrator allows messages from do-no-reply@mail.develop.hsbc.com

Who should I contact for further assistance?

If you experience issues, contact our support team via the Help menu.

How can I reset my password?

Use the “Forgotten password” option on the Log On screen.

Which internet browsers are recommended to use with develop.hsbc?

The portal works best in Chrome, Firefox, Edge, and Safari. Internet Explorer 11 is supported, but some features may not display correctly.

Can I register to access production APIs through develop.hsbc?

No, at present develop.hsbc provides documentation, which will guide you through the steps involved in accessing our production APIs, but the process of registering your app to consume our production APIs must be initiated by calling the relevant registration APIs directly.

The pre-requisites and technical steps involved differ by market and/or type of API so please refer to our implementation documentation to help you get on board as quickly as possible.

How can I get additional assistance or provide feedback?

Use the Contact Us form under the Help menu to share feedback or request assistance.

Is there a glossary of terms and abbreviations?

Yes, you can view the glossary here.

Technical documentation

How do I start using your APIs?

Review the implementation documentation for market-specific and API-specific prerequisites.

Why can’t I view the technical documentation?

To view technical documentation for most APIs, you must be a registered user and logged in to the portal. Simply complete the registration form to get started.

Corporate APIs: Access to corporate APIs requires an additional approval step. You can request access during registration or at any time after by clicking the “Request Access” button. Once your request is approved, you’ll receive a confirmation email.

Email Requirements: Please note, some non-company domain email addresses (such as Gmail, AOL, Yahoo) may not be approved for corporate API access. We recommend registering with your official company email address to ensure a smooth approval process.

If you have any questions or need assistance, our support team is here to help.

How can I obtain the file format guide to facilitate file development prior to using the File Validator for validation

Please reach out to your HSBC relationship or service contact or alternatively please send us a message using the Contact us form found under the Help menu. Please include the market(s) and the payment type(s) for which you require the file format guides.

Testing facilities

Do all your APIs have a sandbox?

Most HSBC APIs provide sandbox or managed testing environments to help you develop and test your integrations.

How to Get Started:

1. Log in to the portal.
2. Click on DevHub in the main menu.
3. Select Create Project to begin the process. You’ll be guided step-by-step to generate your sandbox credentials.

This approach ensures you have the right credentials for the APIs you need, making your testing experience seamless and efficient.

If you need further assistance, our support team is ready to help!

In Step 1, you can choose from groups of APIs. Each group contains APIs that share common properties, such as registration or authentication requirements. Within each group, click View APIs to see a full list of all APIs supported by the credentials you’re about to create.

Is the data in the sandbox real customer data?

No, all the data in our sandboxes is test data and does not contain any real HSBC customer or legal entity data. The sandbox data is designed to provide a representative sample of what can be expected in production to provide a valid test input for your apps.

How do I access the Open Banking Sandbox?

To start testing in the Open Banking Sandbox, follow these steps:

1. Log in to the portal and go to DevHub.
2. Create a new project—the guided process will help you generate the required HSBC-issued test certificates and your software statement.
3. Register your app in the sandbox using these credentials. Note: The Open Banking Sandbox only supports test certificates generated on develop.hsbc.

Full instructions are available in the Sandbox Access Guide for your chosen API.

Once you’ve completed Dynamic Client Registration (DCR), you’ll be able to:

- View your generated certificates

- See your registered apps and their associated Client IDs

- You can then use these credentials to call the sandbox APIs and begin testing.

If you need further assistance, please refer to the Sandbox Access Guide or contact our support team.

In the Sandbox, can I call the endpoints directly using Postman?

Yes, you can call sandbox APIs directly with Postman. Please note:

The Open Banking Sandbox only supports test certificates generated on develop.hsbc. You’ll need to complete the steps in the sandbox to generate these certificates. Once your test certificates are ready, you can use them to call endpoints such as /register (to register your app) and fulfilment endpoints directly.

If you need help, check the Sandbox Access Guide or reach out to our support team.

Good news:
After creating your sandbox project (for Treasury and Open Banking APIs), you can download a Postman collection and environment file. These files come pre-populated with your sandbox credentials—so you can start testing right away, with minimal setup.

In the Open Banking Sandbox, are the consent authorisation journeys the same as those provided in production?

The consent authorisation journeys in the OB Sandbox replicate the function of our production journeys from a TPP’s perspective in that they support scenarios where the account(s) the consent relates to is provided by the TPP or selected by the customer and an authorisation code is provided following successful authentication. However, the look and feel of the screens and the steps involved from a customer’s perspective have been standardised across all brands (and payment types for PIS journeys) for the purposes of simplification.

Are the test certificates generated by the site valid as per the ETSI standard specification?

The test certificates generated are valid X.509 certificates, meaning they’re a valid substitute for connecting to the OB Sandbox or the MCI Test Facilities. However, production certificates issued by a Qualified Trust Service Provider or the OBIE may be slightly different in structure. The test certificates generated on this site cannot be used for any purpose other than using the testing facilities provided by HSBC.

Using the File Validator tool

From the File Validator report, how do I determine that the file has no errors?

If there are no errors, the File Validator report header will contain three green ticks;
• File validation report – Validation completed successfully
• File level – Accepted
• Instruction level – Accepted (or Accepted with value date rolled over)

Is there any validation that is not covered under the File Validator tool?

File Validator will only help you test the syntax and file schema of the payments files. It does not help validate the data accuracy, the following type of validations will not be covered by the File Validator on this site;
• validations against your production profile; eg. debit account numbers, ACH ID/code, duplicate check on file reference/file name/transaction ID, etc.
• validations based on your production HSBCnet for file uploaded or authorization on HSBCnet; eg. HSBC beneficiary validation, entitlement, etc.
• validations during payment processing; eg. account balance check, beneficiary account and bank details, payment advising, WHT certificate issuance, etc.

Can the File Validator be used to validate all file formats and payment types across all markets?

Currently the File Validator generates a comprehensive validation report for the combination of markets, payment types and markets as indicated on the capability matrix. Click here for details.

For combination of other file formats, payments types and markets, the validation report may not contain ‘Invalid field name’, ‘Invalid value’ and ‘Reference/Additional comment’ under the validation details section of the report.

HSBC will continue to enhance the File Validator tool to generate comprehensive validation report for additional combination of file formats, payments types and markets.

On the File Validator tool validation report, why do certain Validation details appear as ‘N/A’?

If all three fields; ‘Invalid field name’, ‘Invalid value’ and ‘Reference/Additional comment’ appear as ‘N/A’, then most likely the tool has not been enhanced to generate the comprehensive validation report for the combination of file formats, payments type and market which was tested.

Also refer to FAQ - Can the File Validator be used to validate all file formats and payment types across all markets?

The File Validator report includes errors such as ‘Unable to Identify Country Code or Payment Type’, when there is no field on the file for the debit account location. How do I rectify this?

Select the Debit account location and File format before reuploading an amended file. If this does not still rectify the error, please contact us with the details.

Is there a step by step guide for using the File Validator Tool?

Yes, click here for the user guide

Production

I'm experiencing issues with Open Banking APIs in Production

If you are experiencing problems with our Open Banking APIs in the United Kingdom, you can access AIS, PIS or funds confirmation services using our Modified Customer Interface (MCI), subject to having the correct permissions. Further details on how to get access to the MCI can be found here.

After a successful validation of the payment file using the File Validator can I send the live payment files to the bank for processing?

Even though file has passed validation, please ensure the following before submitting the live payment files for processing:
1. Receive confirmation from HSBC that all relevant set-up has been completed for the intended services, accounts and payment types.
2. Perform end-to-end penny test (small payment amount) with satisfaction, on the live environment