tegwick
cb6e9a73f4
Point at live tenants/binky/qonto-api fields API_KEY/API_USER; playbook and CredentialRouting index updated after first BINKY-WP-0005 read-only pull.
124 lines
3.8 KiB
Markdown
124 lines
3.8 KiB
Markdown
# Binky Qonto bank API
|
|
|
|
Date: 2026-07-21
|
|
Catalog: `binky-qonto-api` (status `active`, `resolvable: true`, `risk: high`)
|
|
Owner: `railiance-platform` (CCR-2026-0008) · consumer need: `binky-control`
|
|
Workplan: BINKY-WP-0005 · Decision: DEC-2026-004 (approved)
|
|
|
|
API credentials for the company Qonto account so read-only balance and
|
|
transaction pulls can feed control-plane finance (`finance/CostRunRate.md`,
|
|
Finance Steward rhythm). Prefer self-hosted `qonto/qonto-mcp-server` or the
|
|
Qonto thirdparty REST API with the same credentials.
|
|
|
|
**Payments and transfers are Red lane forever** — never allow-list write/payment
|
|
tools in the harness. Qonto API keys are not scope-limited server-side; read-only
|
|
is enforced at the harness tool allow-list.
|
|
|
|
---
|
|
|
|
## Provider (Qonto — non-secret)
|
|
|
|
| Setting | Value |
|
|
| --- | --- |
|
|
| Dashboard | Qonto web app → `/settings/integrations` |
|
|
| Auth shape | login (`API_USER`) + secret (`API_KEY`) → `Authorization: login:key` |
|
|
| MCP env map | `API_KEY`→`QONTO_API_KEY`, `API_USER`→`QONTO_ORGANIZATION_ID` |
|
|
| MCP server | `qonto/qonto-mcp-server` (self-hosted; not the hosted OAuth connector) |
|
|
| API host | `https://thirdparty.qonto.com` |
|
|
|
|
Design: `binky-control/integrations/qonto-mcp.md`
|
|
|
|
## OpenBao pointers
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Mount | `tenants` |
|
|
| Path | `tenants/binky/qonto-api` |
|
|
| Fields | `API_KEY`, `API_USER` |
|
|
| Policy | `workload-kv-read-binky-qonto-api` |
|
|
| OIDC role | `binky-qonto-api-workload-kv-read` (`groups=net-kingdom-admins`) |
|
|
| Risk | `high` |
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
1. Login as caller:
|
|
|
|
```bash
|
|
bao login -method=oidc -path=netkingdom role=binky-qonto-api-workload-kv-read
|
|
```
|
|
|
|
2. Fetch via sanctioned transport (never paste into chat):
|
|
|
|
```bash
|
|
# lengths / presence only when debugging
|
|
warden access binky-qonto-api --all --no-policy --exec -- \
|
|
sh -c 'export QONTO_API_KEY="$API_KEY" QONTO_ORGANIZATION_ID="$API_USER";
|
|
# then: qonto-mcp-server or curl thirdparty with Authorization login:key
|
|
:'
|
|
```
|
|
|
|
Dual-field inject via bao (files mode 0600):
|
|
|
|
```bash
|
|
umask 077
|
|
bao kv get -field=API_KEY tenants/binky/qonto-api > /tmp/qonto.key
|
|
bao kv get -field=API_USER tenants/binky/qonto-api > /tmp/qonto.user
|
|
chmod 600 /tmp/qonto.key /tmp/qonto.user
|
|
export QONTO_API_KEY="$(cat /tmp/qonto.key)"
|
|
export QONTO_ORGANIZATION_ID="$(cat /tmp/qonto.user)"
|
|
shred -u /tmp/qonto.key /tmp/qonto.user
|
|
```
|
|
|
|
3. Run **read-only** tools only (organization, accounts, transactions,
|
|
statements metadata). Do **not** invoke card, invoicing, request, or transfer
|
|
tools.
|
|
|
|
4. Store **metadata-only** evidence under `binky-control/finance/` (update
|
|
`CostRunRate.md` TBC rows; no bulk statement dumps in git).
|
|
|
|
Agents (`WARDEN_AGENT_ID` set): raw value stream refused (exit 7). Use `--out` /
|
|
`--exec` / `--wrap` / `--fingerprint`.
|
|
|
|
---
|
|
|
|
## Verify (capabilities-safe)
|
|
|
|
```bash
|
|
LANE=$(bao token create -policy=workload-kv-read-binky-qonto-api -ttl=2m -field=token)
|
|
bao token capabilities "$LANE" tenants/data/binky/qonto-api # read
|
|
bao token revoke "$LANE"
|
|
|
|
DEFAULT=$(bao token create -policy=default -ttl=2m -field=token) # deny of create is also pass
|
|
bao token capabilities "$DEFAULT" tenants/data/binky/qonto-api # deny
|
|
bao token revoke "$DEFAULT"
|
|
```
|
|
|
|
Never use `bao kv get` for deny tests.
|
|
|
|
---
|
|
|
|
## Founder provision (Red lane)
|
|
|
|
```bash
|
|
# In Qonto dashboard: /settings/integrations → create API key, note login/org slug
|
|
umask 077
|
|
bao kv put tenants/binky/qonto-api \
|
|
API_KEY=@/tmp/qonto.key \
|
|
API_USER=@/tmp/qonto.user
|
|
shred -u /tmp/qonto.key /tmp/qonto.user
|
|
```
|
|
|
|
## Rotation
|
|
|
|
```bash
|
|
warden rotate-guide binky-qonto-api
|
|
```
|
|
|
|
## See also
|
|
|
|
- `binky-control/integrations/qonto-mcp.md`
|
|
- `wiki/playbooks/tenant-secret-onboarding.md`
|
|
- CCR-2026-0008 in railiance-platform
|
|
- DEC-2026-004 / OH-2026-003 in binky-control
|