# arionbanki.is — Arion Banki

Debit/savings transactions, VISA credit card transactions, mortgage details
and unpaid bills from [netbanki.arionbanki.is](https://netbanki.arionbanki.is).

## Auth — the interesting part

Arion uses **session-only cookies** (`FedAuth`, `.N5SESSION`, `.SOSAUTH`) that
are *not* in `cookies.sqlite` — they live in Firefox's session-restore file
(`sessionstore-backups/recovery.jsonlz4`, mozLz40-compressed).

```bash
# 1. Human logs into netbanki.arionbanki.is in Firefox (once per ~15 min)
# 2. Recipe extracts the Cookie header from the live Firefox session
ab-plus run arionbanki.is/transactions --input '{"account":"0323-26-022009"}'
```

⛔ **Do not automate the form login.** Automated logins were flagged as fraud
(2026-08-14). This is a "rails vs in-the-loop" case: the *replay* is
automated, the *login* is always a human in a real browser (or Auðkennisapp).

## Ops

| Op | Risk | Endpoint |
|---|---|---|
| `transactions` | read-only | POST `/nb5/Accounts/Transactions/TransactionList` (DataTables) |
| `visa-transactions` | read-only | POST `/nb5/CreditCards/GetTransactions` |
| `mortgages` | read-only | POST `/nb5/Loans/GetLoanDetails` + `GetLoanPayments` |
| `bills` | read-only | unpaid bills |

## Parsing gotchas

- Amounts come as HTML like `<span class="pos">4.600 kr.</span>` — Icelandic
  thousands separator is `.`; `class="neg"` = negative.
- No unique ID on debit rows — dedup by `{date}_{ref}_{amount}`; Arion reports
  the same transaction on booking date and value date (keep the later).
- Internal transfers get adjacent `arion_txn_id`s (delta 1–3) — the strongest
  transfer-matching signal.