Gemba Open Banking API (0.1)

All requests to the Gemba Open Banking API require an Authorization header containing a valid bearer access token. Example:

Authorization: Bearer ${access_token}

The access token is valid for 10 minutes. Once expired, a new token must be generated to continue using the API.

The Gemba MCP server exposes this API to MCP-compatible AI clients over streamable HTTP.

The examples below use production. For sandbox, swap the host in both the endpoint and the token request, and use a sandbox API key.

Authentication is the same bearer access token used for REST calls — see Authentication. The token is short-lived, so a client configured with one has to be given a fresh token once it expires; there is no long-lived MCP credential yet.

Claude Code

For the CLI, desktop app, or VS Code extension, configure .mcp.json in the project root, or ~/.claude.json for user scope:

{
  "mcpServers": {
    "gemba": {
      "type": "http",
      "url": "https://api.ge.mba/mcp",
      "headers": {
        "Authorization": "Bearer ${GEMBA_MCP_TOKEN}"
      }
    }
  }
}

"type": "http" pins streamable HTTP and prevents SSE/OAuth negotiation. A present Authorization header prevents 401-triggered OAuth discovery. Use ${VAR} expansion here — ${env:VAR} is VS Code mcp.json syntax, which Claude Code passes through literally.

The server can be registered from the command line instead:

GEMBA_MCP_TOKEN=$(curl -fsS -X POST https://api.ge.mba/0.1/auth/access-token \
  -H "x-api-key: gm_prod_xxx" | jq -er .access_token) &&
  claude mcp add --transport http gemba https://api.ge.mba/mcp \
    --header "Authorization: Bearer $GEMBA_MCP_TOKEN"

Claude Desktop

claude_desktop_config.json launches stdio servers only, so a remote HTTP server is reached through mcp-remote:

{
  "mcpServers": {
    "gemba": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.ge.mba/mcp",
        "--transport",
        "http-only",
        "--header",
        "Authorization:${AUTH_HEADER}"
      ],
      "env": {
        "AUTH_HEADER": "Bearer eyJhbGciOiJSUzI1NiIs..."
      }
    }
  }
}

Do not put a space after Authorization:. mcp-remote splits --header on the first space, so the token value is supplied through the environment variable instead. --transport http-only prevents fallback to SSE.

Returns the banking clients linked to the authenticated user. Use these endpoints when a user can belong to more than one client (for example a person with access to several companies). Call GET /clients to list those clients, then use a returned clientId on subsequent account, payment, and FX requests. This is not an API for creating or managing white-label / partner clients.

Endpoints related to managing user accounts, such as retrieving account details, balances, and performing account-based operations.

This tag covers endpoints for processing various types of payments, including internal, international, UK-based transfers, and bulk batches. Single-transfer resources expose a status field. Terminal outcomes rejected and canceled include reason (enum) and message (string). Status onhold means the payment is temporarily awaiting further processing and does not include reason or message. Bulk endpoints use different payloads: create returns { bulkPaymentId }, status returns { status, count } (no per-row transfer objects). There is no bulk webhook; child transfers use standard transfer.outgoing.changed events.