Restricted employee data · v1.0.0
Request one employee’s bank account deliberately.
Bank accounts never ride along with employee lists, general employee detail, SCIM, dashboard, activity, or search. A focused subresource, dual scopes, and an explicit schema keep this payroll boundary understandable.
Privacy boundary
/v1/organizations/{organizationId}/employees/{employeeId}/bank-accountOnly this response contains the canonical full value. Outside this integration flow, use a masked presentation such as BE68 •••• •••• 7034. Never log the request body, full response, bearer header, or supplied IBAN.
Scopes
| Operation | Both scopes are required |
|---|---|
GET | employees:read + employees:read_financial |
PUT | employees:write + employees:write_financial |
Existing keys retain their previous scope set. Key validity, revocation, environment, organization ownership, employee membership, and both required scopes are revalidated at the database boundary.
Read one account
This synthetic TEST response passes the current validator and is not customer data:
{
"employeeId": "00000000-0000-4000-8000-000000000001",
"iban": "BE68539007547034",
"maskedIban": "BE68 •••• •••• 7034",
"validationState": "VALID",
"validationErrorCode": null,
"reviewRequired": false,
"updatedAt": "2026-07-31T12:00:00Z"
}Persist the response ETag for a concurrency-safe update.
Set or clear
PUT requires Idempotency-Key and If-Match. Lowercase and spaces are accepted; the database validates country length and MOD-97, then stores uppercase without spaces.
{"iban":"be68 5390 0754 7034"}Clear with {"iban":null}. Invalid values return 422 without echoing the value; stale revisions return 412. A write-only integration may use If-Match: * only for an intentional overwrite.
The successful PUT response contains only the employee ID, masked presentation, validation state, review flag, update time, and new ETag. It deliberately omits the full IBAN so idempotent retries do not duplicate that value in generic response storage. Use the separately authorized GET only when the complete value is genuinely required.