List Accounts
Returns the accounts the member holds, resolved from the connected core banking system. Each entry carries an accountUuid to send back as the account_uuid query param on List Disputable Transactions and the Eligibility Check — echo it verbatim rather than reconstructing it. Use description as the display label in an account picker, and account_type to filter to one or more account types (repeat the query param, e.g. account_type=ACCOUNT_TYPE_DEBIT&account_type=ACCOUNT_TYPE_CREDIT); omit it to receive every type. Accounts the member only partly owns are included with holderType describing the ownership; no other account holder's details are ever returned. This is the only endpoint whose customer_uuid also accepts the member's tax id instead of a Casap-issued identifier: encrypt it with the org's Casap-issued public key using RSA-OAEP with SHA-256 as both the OAEP and MGF1 digest — many OAEP tools default MGF1 to SHA-1, which silently produces ciphertext this API can't decrypt, surfacing as a generic "not a recognized customer identifier" error with no hint at the digest mismatch. Base64-encode the ciphertext, then percent-encode the result before placing it in the query string — raw base64's +, /, and = are otherwise misread as query-string syntax. Every other endpoint's customer_uuid only accepts the canonical identifier this endpoint resolves to (or one Casap already issued); it is passed through as-is there, never decrypted.
Query parameters
customer_uuid is the only field that resolves both forms of the partner-supplied member identifier: one Casap already issued (returned as-is), or the member's tax id encrypted with the org's Casap-issued public key and base64-encoded. Encryption must use RSA-OAEP with SHA-256 as both the OAEP and MGF1 digest — many OAEP tools default MGF1 to SHA-1, which silently produces ciphertext this API can't decrypt; the failure surfaces as a generic "not a recognized customer identifier" error with no hint at the digest mismatch. Because this value travels in the query string, base64-encode it and then percent-encode the result — raw base64's +, /, and = are otherwise misread as query-string syntax. Every other RPC's customer_uuid only accepts the canonical identifier this endpoint resolves to (or one Casap already issued); it is passed through as-is there, never decrypted.
account_type narrows the result to one or more of the listed account types (e.g. debit only, or debit and credit explicitly). Leave empty to receive every type.
Response
A successful response.