Thank you guys!
Following your discussion I too was able to download my Citi transactions, both through ofxget, and through GnuCash.
The trick seems to have been 1) choosing a fixed client uid 2) navigating to Profile->More Settings->Manage Desktop Apps and adding access 3) within the 10 minute window sending a signon only request, without transaction information request. Something like this:
OFXHEADER:100
DATA:OFXSGML
VERSION:103
SECURITY:NONE
ENCODING:USASCII
CHARSET:NONE
COMPRESSION:NONE
OLDFILEUID:5bbe7147-1084-4a90-bf47-98b69af842c1
NEWFILEUID:5bbe7147-1084-4a90-bf47-98b69af842c1
<OFX>
<SIGNONMSGSRQV1>
<SONRQ>
<DTCLIENT>20190919051115.851[0:GMT]
<USERID>Username
<USERPASS>Password
<CLIENTUID>b238dd8f-84d0-44b6-9327-3f79b8e704a0</CLIENTUID>
<LANGUAGE>ENG<FI><ORG>Citigroup<FID>24909</FI>
<APPID>QWIN<APPVER>2500
</SONRQ>
</SIGNONMSGSRQV1>
</OFX>
Citi replied with:
<OFX>
<SIGNONMSGSRSV1>
<SONRS>
<STATUS>
<CODE>0
<SEVERITY>INFO
<MESSAGE>0
</STATUS>
<DTSERVER>20190919050848.000
<LANGUAGE>ENG
<FI>
<ORG>Citigroup
<FID>24909
</FI>
</SONRS>
</SIGNONMSGSRSV1>
</OFX>
Then, I sent another request, this time including the tag:
<CREDITCARDMSGSRQV1>
<CCSTMTTRNRQ>
<TRNUID>40c5a401-5976-4bd4-bf25-ff8ed56f3c99</TRNUID>
<CCSTMTRQ>
<CCACCTFROM>
<ACCTID>my credit card number</ACCTID>
</CCACCTFROM>
<INCTRAN>
<INCLUDE>Y</INCLUDE>
</INCTRAN>
</CCSTMTRQ>
</CCSTMTTRNRQ>
</CREDITCARDMSGSRQV1>