[GNC-dev] New OFX Requirements For USAA FSB

Sat Feb 6 23:45:11 EST 2021

I got this working in my software with some help for the info on this list.
Here is a write-up:

USAA's changes to their OFX interface
-------------------------------------

On 2020-01-26, USAA's previous OFX interface (
https://service2.usaa.com/ofx/OFXServlet) stopped working. It seems like
they switched to a new interface through a tech provider to replace their
previous login method (with your website credentials) to an app-specific ID
and password. This is a good move for security, but it was done without
notice, it seems, to anyone but Quicken.

>From some internet searches, I found some people on the right track to
fixing this on the GNU Cash development mailing list:

https://lists.gnucash.org/pipermail/gnucash-devel/2021-January/045664.html

They were able to determine that USAA was:
 - using a new OFX endpoint:
https://df3cx-services.1fsapi.com/casm/usaa/access.ofx
 - using a new OFX Org ID: USAA Federal Savings Bank
 - using a new OFX FID: 67811

Additionally, someone on the USAA forums was about to extract and post the
link to generate an App ID and PIN:

source:
https://communities.usaa.com/t5/Finances/USAA-Creates-Quicken-Monopoly/td-p/243850/highlight/false
Authorization link: https://df3cx-services.1fsapi.com/casm/usaa/enroll

However, with a lot of trial and error I still wasn't able to hit this new
endpoint successfully. So I decided to give the devil his due and
temporarily got a Quicken subscription and setup an SSL man-in-the-middle.

The new OFX interface is *very* finicky, so you basically have to input
everything exactly the way it expects it. Here is an example of an account
listing query that works:

echo -en
"OFXHEADER:100\r\nDATA:OFXSGML\r\nVERSION:103\r\nSECURITY:NONE\r\nENCODING:USASCII\r\nCHARSET:NONE\r\nCOMPRESSION:NONE\r\nOLDFILEUID:NONE\r\nNEWFILEUID:NONE\r\n\r\n<OFX>\r\n<SIGNONMSGSRQV1>\r\n<SONRQ>\r\n<DTCLIENT>20210207031942\r\n<USERID>XXXXX\r\n<USERPASS>NNNNN\r\n<LANGUAGE>ENG\r\n<FI>\r\n<ORG>USAA
Federal Savings
Bank\r\n<FID>67811\r\n</FI>\r\n<APPID>QMOFX\r\n<APPVER>2300\r\n<CLIENTUID>1955A543-B071-455E-A31E-73CC7C493D68\r\n</SONRQ>\r\n</SIGNONMSGSRQV1>\r\n<SIGNUPMSGSRQV1>\r\n<ACCTINFOTRNRQ>\r\n<TRNUID>e39add7d-2085-4504-b9ee-be37927de39c\r\n<ACCTINFORQ>\r\n<DTACCTUP>19900101\r\n</ACCTINFORQ>\r\n</ACCTINFOTRNRQ>\r\n</SIGNUPMSGSRQV1>\r\n</OFX>\r\n"
| curl -isS -X POST -H "Content-Type: application/x-ofx" -A InetClntApp/3.0
--data-binary @- https://df3cx-services.1fsapi.com/casm/usaa/access.ofx

Note you have to change the XXXXX and NNNNN to the App ID and PIN you get
from the link above.

Some things I've found through trial and error:
 - The OFX elements must be separated with "\r\n". This is dumb, but true.
No spaces. No simple "\n". Exactly "\r\n".
 - The APPID "QMOFX" and APPVER "QMOFX" work. Others I tried did not.
 - The CLIENTUID "1955A543-B071-455E-A31E-73CC7C493D68" works for me. It
must be uppercase. This might be particular to your account. If so, you can
find it looking at the OFX logs from Quicken.
 - TRNUID must be present, but an UUID will do.
 - DTACCTUP: The value "19900101" works. The value "19700101" does not. The
value "19900101000000" does not.
 - You need the "Content-Type: application/x-ofx" header
 - You need the User-Agent "InetClntApp/3.0". This is what Quicken for Mac
sends.

It also seems their gateway will under some conditions put your IP on a ban
list. If you are testing, you may want to spin up an AWS instance or
something. When you get on it, you'll start seeing an empty HTML page
response, like:

<html>
<head>
<META NAME="robots" CONTENT="noindex,nofollow">
<script
src="/_Incapsula_Resource?SWJIYLWA=5074a744e2e3d891814e9a2dace20bd4,719d34d31c8e3a6e6fffd425f7e032f3">
</script>
<body>
</body></html>

Valid queries will work from different source IPs when this happens.

Thanks to Bob White on the GNU Cash list and RDD! on the USAA Forums for
the breadcrumbs. No thanks to USAA for swapping out their functional
interface with absolutely no notice or documentation and pretending like
Quicken users are the only customers of any importance. Please just don't
break our software again... at least for awhile.

- Scott McRae