Paul You could also make a simplified API around the bunq api so you can call that with the Get Contents of URL building block* and run that simplified API on a (little) server.
That way you can implement the security probably a bit better, and only expose a couple of things to your Siri shortcut. Of course be sure to secure those calls as well.
