Great work Scott and others. I used the CLIENTID from the URL when registering using the Authorization link ( https://df3cx-services.1fsapi.com/casm/usaa/enroll). It seems the account Authorization is tied to this ClientID.
Cory On Sun, Feb 7, 2021 at 4:13 AM Scott McRae <smc...@parax.com> wrote: > I got this working in my software with some help for the info on this list. > Here is a write-up: > > USAA's changes to their OFX interface > ------------------------------------- > > On 2020-01-26, USAA's previous OFX interface ( > https://service2.usaa.com/ofx/OFXServlet) stopped working. It seems like > they switched to a new interface through a tech provider to replace their > previous login method (with your website credentials) to an app-specific ID > and password. This is a good move for security, but it was done without > notice, it seems, to anyone but Quicken. > > From some internet searches, I found some people on the right track to > fixing this on the GNU Cash development mailing list: > > https://lists.gnucash.org/pipermail/gnucash-devel/2021-January/045664.html > > They were able to determine that USAA was: > - using a new OFX endpoint: > https://df3cx-services.1fsapi.com/casm/usaa/access.ofx > - using a new OFX Org ID: USAA Federal Savings Bank > - using a new OFX FID: 67811 > > Additionally, someone on the USAA forums was about to extract and post the > link to generate an App ID and PIN: > > source: > > https://communities.usaa.com/t5/Finances/USAA-Creates-Quicken-Monopoly/td-p/243850/highlight/false > Authorization link: https://df3cx-services.1fsapi.com/casm/usaa/enroll > > However, with a lot of trial and error I still wasn't able to hit this new > endpoint successfully. So I decided to give the devil his due and > temporarily got a Quicken subscription and setup an SSL man-in-the-middle. > > The new OFX interface is *very* finicky, so you basically have to input > everything exactly the way it expects it. Here is an example of an account > listing query that works: > > echo -en > > "OFXHEADER:100\r\nDATA:OFXSGML\r\nVERSION:103\r\nSECURITY:NONE\r\nENCODING:USASCII\r\nCHARSET:NONE\r\nCOMPRESSION:NONE\r\nOLDFILEUID:NONE\r\nNEWFILEUID:NONE\r\n\r\n<OFX>\r\n<SIGNONMSGSRQV1>\r\n<SONRQ>\r\n<DTCLIENT>20210207031942\r\n<USERID>XXXXX\r\n<USERPASS>NNNNN\r\n<LANGUAGE>ENG\r\n<FI>\r\n<ORG>USAA > Federal Savings > > Bank\r\n<FID>67811\r\n</FI>\r\n<APPID>QMOFX\r\n<APPVER>2300\r\n<CLIENTUID>1955A543-B071-455E-A31E-73CC7C493D68\r\n</SONRQ>\r\n</SIGNONMSGSRQV1>\r\n<SIGNUPMSGSRQV1>\r\n<ACCTINFOTRNRQ>\r\n<TRNUID>e39add7d-2085-4504-b9ee-be37927de39c\r\n<ACCTINFORQ>\r\n<DTACCTUP>19900101\r\n</ACCTINFORQ>\r\n</ACCTINFOTRNRQ>\r\n</SIGNUPMSGSRQV1>\r\n</OFX>\r\n" > | curl -isS -X POST -H "Content-Type: application/x-ofx" -A InetClntApp/3.0 > --data-binary @- https://df3cx-services.1fsapi.com/casm/usaa/access.ofx > > Note you have to change the XXXXX and NNNNN to the App ID and PIN you get > from the link above. > > Some things I've found through trial and error: > - The OFX elements must be separated with "\r\n". This is dumb, but true. > No spaces. No simple "\n". Exactly "\r\n". > - The APPID "QMOFX" and APPVER "QMOFX" work. Others I tried did not. > - The CLIENTUID "1955A543-B071-455E-A31E-73CC7C493D68" works for me. It > must be uppercase. This might be particular to your account. If so, you can > find it looking at the OFX logs from Quicken. > - TRNUID must be present, but an UUID will do. > - DTACCTUP: The value "19900101" works. The value "19700101" does not. The > value "19900101000000" does not. > - You need the "Content-Type: application/x-ofx" header > - You need the User-Agent "InetClntApp/3.0". This is what Quicken for Mac > sends. > > It also seems their gateway will under some conditions put your IP on a ban > list. If you are testing, you may want to spin up an AWS instance or > something. When you get on it, you'll start seeing an empty HTML page > response, like: > > <html> > <head> > <META NAME="robots" CONTENT="noindex,nofollow"> > <script > > src="/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3"> > </script> > <body> > </body></html> > > Valid queries will work from different source IPs when this happens. > > > Thanks to Bob White on the GNU Cash list and RDD! on the USAA Forums for > the breadcrumbs. No thanks to USAA for swapping out their functional > interface with absolutely no notice or documentation and pretending like > Quicken users are the only customers of any importance. Please just don't > break our software again... at least for awhile. > > - Scott McRae > _______________________________________________ > gnucash-devel mailing list > gnucash-devel@gnucash.org > https://lists.gnucash.org/mailman/listinfo/gnucash-devel > -- Cory Fazzini _______________________________________________ gnucash-devel mailing list gnucash-devel@gnucash.org https://lists.gnucash.org/mailman/listinfo/gnucash-devel
