# arionbanki.is — Arion Banki

Debit/savings transactions, VISA credit card transactions, mortgage details
and unpaid bills from [netbanki.arionbanki.is](https://netbanki.arionbanki.is).

## Auth — the interesting part

Arion's session cookies (`FedAuth`, `.N5SESSION`, `.SOSAUTH`) are session-only
and device-bound. The sanctioned path goes through **agent-browser**, the same
floor as every other pack — the human logs in once in a headed agent-browser
window, and the ops run *inside* that session:

```bash
# 1. Human logs into netbanki.arionbanki.is in a headed agent-browser window
#    (Auðkennisapp / OTP as the bank requires) — no AI in the auth loop
ab-plus login arionbanki.is

# 2. Ops run inside the session via eval — the session IS the credential.
#    No cookie files are ever exported, scraped, or replayed.
ab-plus run arionbanki.is/transactions --input '{"account":"0323-26-022009"}'
```

Bank sessions die after ~15 min of inactivity — expect to re-login often.
(agent-browser also supports `--profile Default` / `--auto-connect` to reuse
your real browser's login, still through agent-browser.)

⛔ **Do not automate the form login.** Automated logins were flagged as fraud
(2026-08-14). This is a "rails vs in-the-loop" case: the *fetch* is automated,
the *login* is always a human in the browser window (or Auðkennisapp).

## Ops

| Op | Risk | Endpoint (run in-session) |
|---|---|---|
| `transactions` | read-only | POST `/nb5/Accounts/Transactions/TransactionList` (DataTables) |
| `visa-transactions` | read-only | POST `/nb5/CreditCards/GetTransactions` |
| `mortgages` | read-only | POST `/nb5/Loans/GetLoanDetails` + `GetLoanPayments` |
| `bills` | read-only | unpaid bills |

## Parsing gotchas

- Amounts come as HTML like `<span class="pos">4.600 kr.</span>` — Icelandic
  thousands separator is `.`; `class="neg"` = negative.
- No unique ID on debit rows — dedup by `{date}_{ref}_{amount}`; Arion reports
  the same transaction on booking date and value date (keep the later).
- Internal transfers get adjacent `arion_txn_id`s (delta 1–3) — the strongest
  transfer-matching signal.