Does the bunq API need an API key?

Yes for the 21 operations checked: an anonymous request was refused, on 2026-09-15. Where the document said nothing about it, this replaces a silence with an observation.

ERR-2026-1719, ERR-2026-1724, ERR-2026-1778, ERR-2026-1790, ERR-2026-1841, ERR-2026-1926, ERR-2026-1995, ERR-2026-2010, ERR-2026-2085, ERR-2026-2096, ERR-2026-2098, ERR-2026-2113

Every record behind those answers

21 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 121 have been across the whole registry.

credentials are required (observed) (21)

The document establishes no authentication requirement for this operation; an anonymous request is refused with 401. The requirement is now observed rather than unknown.

`ERR-2026-1719`	List_all_CertificatePinned_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1724`	List_all_CardName_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1778`	READ_CertificatePinned_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1790`	List_all_BillingContractSubscription_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1841`	List_all_CallbackUrl_for_User_OauthClient	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1926`	List_all_AdditionalTransactionInformationCategory_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-1995`	List_all_Card_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2010`	List_all_Company_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2085`	READ_Attachment_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2096`	READ_Company_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2098`	List_all_BunqmeTab_for_User_MonetaryAccount	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2113`	READ_AttachmentPublic	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2162`	READ_Card_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2177`	READ_BunqmeFundraiserResult_for_User_MonetaryAccount	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2183`	READ_ChallengeRequest_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2206`	READ_Avatar	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2208`	READ_CallbackUrl_for_User_OauthClient	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2218`	READ_BunqmeTab_for_User_MonetaryAccount	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2230`	List_all_BunqmeFundraiserProfile_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2232`	READ_BunqmeFundraiserProfile_for_User	HTTP 403	checked 2026-09-15, 2 times
`ERR-2026-2238`	READ_BunqmeTabResultResponse_for_User_MonetaryAccount	HTTP 403	checked 2026-09-15, 2 times

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://public-api.sandbox.bunq.com/v1/user/errata-probe-not-a-real-identifier/certificate-pinned

If a record here is wrong

Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 121 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.

What this page does not tell you

This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.

What this is

A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.

The whole registry, machine-readable: errata.json. Index of subjects: index.html.

Built from registry errata-2026-09-10@b7cb54d3a847. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.