Wise

What your agents can doCopy Anchor Link

Helios indexes Wise's current 2026Q4 and legacy Platform API specifications. Agents can search those APIs to inspect transfers, manage recipients, retrieve exchange rates and reconcile balances, subject to your account's permissions. Choose the API version when connecting. Current operations use /2026Q4; legacy operations keep their documented /v1, /v2 or /v3 paths.

Both authentication methods require an Environment: production or sandbox. Sandbox does not move real money. Sensitive card operations use twcard.wise.com in production and twcard.wise-sandbox.com in sandbox, without the quarterly prefix.

AuthenticationCopy Anchor Link

Personal API tokenCopy Anchor Link

This is the default method. Create a token in Wise's Connect and manage apps settings, then enter the API token and Environment in Helios. Helios checks it by reading the current user.

Personal tokens remain valid until revoked. Permissions and regional restrictions apply. Wise documents personal-token transfer funding and statement access for accounts in the US, Canada, Australia, New Zealand, Singapore and Malaysia. See personal API tokens.

Partner OAuthCopy Anchor Link

Wise approval is required. This method uses the authorization-code flow for user access, not embedded client-credentials access or regulated Open Banking TPP authentication. This method has not yet been tested with Wise partner credentials.

1. Obtain your Client ID and Client secret from Wise Developer Hub.
2. Register the Helios Wise OAuth callback URL, ending in /integrations/wise/oauth_callback, with Wise for your Helios deployment.
3. Follow Wise's mTLS setup. Enter the PEM Client certificate, matching Client private key, and Wise CA certificate for the selected environment.
4. Authorize the application in Wise. Helios stores the returned access and refresh tokens and uses the environment's mTLS API host.

Wise assigns Platform permissions during partner onboarding. The public Platform documentation does not enumerate selectable scopes, so Helios sends no scope parameter. Confirm the application's full permission set with Wise. See OAuth setup and user access tokens.

Helios refreshes expired access tokens when Wise rejects them and performs a weekly refresh. Renew the mTLS certificate before expiry; Wise documents a 12-month certificate lifetime.

TriggersCopy Anchor Link

Helios lists every profile the token can access and attempts one subscription per event on each profile. Disconnecting removes subscriptions at this connection's webhook URL across those profiles.

Many Wise events support only application subscriptions. These user connections use profile subscriptions; they do not create application subscriptions. Events are marked unavailable only when no remaining profile subscription delivers them, with Wise's reason. If one profile succeeds and another refuses, the event remains available with coverage limited to the successful profiles.

Pattern filters accept *; an empty filter matches all values. Currency filters marked case insensitive accept either letter case.

Helios verifies the raw body with Wise's RSA key for the selected environment and requires its subscription ID to belong to this connection. Helios acknowledges verified test notifications without starting workflows. Signed older deliveries remain valid because Wise retries for up to two weeks. Delivery is best effort, events may arrive out of order, and manual replays may have new IDs. Workflows that move money should also check the underlying resource state before acting. See event handling.

The changelog-only transfers#transfer-suspension event is excluded until Wise publishes its payload and subscription contract. balances#credit is a legacy event; use balance.updated with a credit transaction filter for new workflows.

Strong customer authenticationCopy Anchor Link

Wise may require strong customer authentication (SCA) for these actions. The requirement applies to profiles registered outside the US, Canada, Australia, New Zealand, Singapore and Malaysia.

• Funding a transfer.
• Funding a batch from balance or by direct debit.
• Retrieving balance statements.
• Reporting a 3DS challenge result.
• Retrieving sensitive card details or a card PIN.

Wise rejects these calls with 403 and returns a one-time token in the x-2fa-approval header. With a personal API token, the retry must include that token signed by a private key whose public key is uploaded to Wise. Helios does not store a signing key, so these calls fail on personal-token connections where Wise requires SCA. Helios does not complete SCA challenges for partner OAuth connections either. The agent receives the x-2fa-approval and x-2fa-approval-result response headers so it can report the requirement. See SCA and 2FA and SCA for personal tokens.

Errors and limitsCopy Anchor Link

Setup fails if Wise cannot list profiles or subscriptions. A subscription-limit refusal can leave an older schema version active because replacing it requires creating another subscription first; Wise does not publish a numeric ceiling or an update endpoint.

Helios starts no workflow for a transfers#active-cases, profiles#overdraft-limit-threshold, allocations#state-changed or settlement#funds-received event whose data matches one from the last 14 days, because these events carry no timestamp.

Wise applies rate limits by account and endpoint. Helios uses the shared retry handling for rate limits and eligible transient failures. Permission errors require changes in Wise, OAuth reauthorization or certificate renewal as appropriate. Wise's webhook errors describe subscription refusals.