Gemba Open Banking API (0.1)

All requests to the Gemba Open Banking API require an Authorization header containing a valid bearer access token. Example:

Authorization: Bearer ${access_token}

The access token is valid for 10 minutes. Once expired, a new token must be generated to continue using the API.

MCP is opt-in and is not available to API clients by default. Request this feature via Gemba developer support at [email protected].

The Gemba MCP server exposes this API to MCP-compatible AI clients over streamable HTTP.

The examples below use production. For sandbox, swap the host (and, for the JWT backup, use a sandbox API key).

Authentication

OAuth is the default. Point the client at the MCP endpoint with no Authorization header. On first connect the client opens a browser; sign in with your Gemba account. A present bearer token skips OAuth discovery.

A short-lived JWT from an API key is a backup for non-interactive clients (below).

Claude Code

CLI, desktop app, or VS Code extension:

claude mcp add --transport http gemba https://api.ge.mba/mcp

Or configure .mcp.json in the project root, or ~/.claude.json for user scope:

{
  "mcpServers": {
    "gemba": {
      "type": "http",
      "url": "https://api.ge.mba/mcp"
    }
  }
}

"type": "http" pins streamable HTTP. Do not add an Authorization header unless you are using the JWT backup.

Cursor

{
  "mcpServers": {
    "gemba": {
      "url": "https://api.ge.mba/mcp"
    }
  }
}

Claude Desktop

claude_desktop_config.json launches stdio servers only, so a remote HTTP server is reached through mcp-remote:

{
  "mcpServers": {
    "gemba": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.ge.mba/mcp",
        "--transport",
        "http-only"
      ]
    }
  }
}

--transport http-only prevents fallback to SSE. On first connection the client opens a browser to sign in.

Backup: short-lived JWT

If the client cannot complete browser OAuth (CI or other non-interactive setups), exchange an API key for the same short-lived bearer token used for REST calls — see Authentication. The token is valid for 10 minutes; there is no refresh. After it expires, issue a new token and update the client.

GEMBA_MCP_TOKEN=$(curl -fsS -X POST https://api.ge.mba/0.1/auth/access-token \
  -H "x-api-key: gm_prod_xxx" | jq -er .access_token) &&
  claude mcp add --transport http gemba https://api.ge.mba/mcp \
    --header "Authorization: Bearer $GEMBA_MCP_TOKEN"

Claude Code .mcp.json expands ${GEMBA_MCP_TOKEN} from the environment of the process that launches claude. Export it from the access-token endpoint in the same shell before starting Claude Code. The token expires after 10 minutes with no refresh — issue a new one and restart Claude when it does. ${env:VAR} is VS Code mcp.json syntax and is passed through literally:

GEMBA_MCP_TOKEN=$(curl -fsS -X POST https://api.ge.mba/0.1/auth/access-token \
  -H "x-api-key: gm_prod_xxx" | jq -er .access_token) &&
  [ -n "$GEMBA_MCP_TOKEN" ] &&
  export GEMBA_MCP_TOKEN &&
  claude

{
  "mcpServers": {
    "gemba": {
      "type": "http",
      "url": "https://api.ge.mba/mcp",
      "headers": {
        "Authorization": "Bearer ${GEMBA_MCP_TOKEN}"
      }
    }
  }
}

Claude Desktop via mcp-remote with a token. Do not put a space after Authorization: — mcp-remote splits --header on the first space, so the token value is supplied through the environment variable:

{
  "mcpServers": {
    "gemba": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.ge.mba/mcp",
        "--transport",
        "http-only",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer eyJhbGciOiJSUzI1NiIs..."
      }
    }
  }
}

Returns the banking clients linked to the authenticated user. Use these endpoints when a user can belong to more than one client (for example a person with access to several companies). Call GET /clients to list those clients, then use a returned clientId on subsequent account, payment, and FX requests. This is not an API for creating or managing white-label / partner clients.

Endpoints related to managing user accounts, such as retrieving account details, balances, and performing account-based operations.

This tag covers endpoints for processing various types of payments, including internal, international, UK-based transfers, and bulk batches. Single-transfer resources expose a status field. Terminal outcomes rejected and canceled include reason (enum) and message (string). Status onhold means the payment is temporarily awaiting further processing and does not include reason or message. Bulk endpoints use different payloads: create returns { bulkPaymentId }, status returns { status, count } (no per-row transfer objects). There is no bulk webhook; child transfers use standard transfer.outgoing.changed events.