Aeroquip Credit Union API integration (FDX / OpenFinance)

Deliverables checklist

• OpenAPI 3.1 specification covering accounts, transactions, statements, transfers, and mobile RDC
• Protocol and auth flow report: OAuth 2.0 PKCE handshake, refresh-token rotation, device-binding cookies
• Runnable Python and Node.js source for login, balance, transaction history, and statement download
• Postman collection plus pytest / Jest test harnesses with recorded fixtures
• Compliance worksheet: Reg E, Reg CC, NCUA RDC examiner checklist, CFPB Section 1033 mapping

Two engagement models

Pick the model that matches how your team wants to operate the integration.

• Source-code delivery from $300 — you receive the runnable code, the OpenAPI doc, and the test fixtures. Pay after delivery upon satisfaction; you host it yourself.
• Pay-per-call hosted API — call our managed endpoints, pay only for what you use, and let us own the upgrade path when FDX or core-processor versions change.

1. Small-business accounting sync

An Aeroquip Credit Union member running an LLC needs daily bank-feed sync into QuickBooks Online. We pull /accounts and /transactions nightly, normalize MCC and merchant strings, and post entries via the QBO API. The flow uses FDX-style consent so the member can revoke access from a self-service portal.

2. Lending-decision data pull

A fintech lender requests 24 months of inflow/outflow plus 12 months of statement PDFs to underwrite a personal loan. The integration produces an FDX-shaped StatementSet response and signed-PDF originals, with consent tied to a single decision and auto-revoked after 90 days under CFPB 1033 guidance.

3. Mobile check deposit reconciliation

A property-management firm collects rent checks via the credit union's mobile RDC. We capture deposit IDs from the submission webhook, match them against the lease ledger by amount and tenant, and flag holds that exceed Reg CC's two-business-day default so the back office can escalate before NSF risk.

4. Card-control fraud dashboard

An aggregator surfaces card-control toggles and tokenization events across multiple credit unions. For Aeroquip CU, we expose freeze/unfreeze, ATM and POS limit reads, plus Apple Pay / Google Pay token lifecycle events so fraud-ops can quarantine a card in seconds without redirecting members to the original app.

5. Multi-institution net-worth view

A wealth-tech app blends Aeroquip Credit Union balances with brokerage and 401(k) feeds. The household view refreshes balances every six hours via /accounts while statements stream into a long-term S3 archive, all under a single OAuth consent that the member can audit at any time.

OAuth 2.0 PKCE token exchange

POST /oauth2/token HTTP/1.1
Host: api.aeroquipcu-bridge.local
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AC-9f3a...
&client_id=of-lab-demo
&code_verifier=q2tH...x9M
&redirect_uri=https://app.example.com/cb

200 OK
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "rt_8c1e...",
  "scope": "accounts:read transactions:read rdc:write"
}

FDX-shaped transactions read

GET /fdx/v6/accounts/2200017/transactions
  ?startTime=2026-04-01T00:00:00Z
  &endTime=2026-04-30T23:59:59Z
  &page=1&pageSize=200
Authorization: Bearer <ACCESS_TOKEN>
Accept: application/json

200 OK
{
  "transactions": [
    {
      "transactionId": "TX-2026-04-12-77",
      "postedTimestamp": "2026-04-12T14:02:11Z",
      "amount": -42.18,
      "currency": {"currencyCode": "USD"},
      "description": "KROGER #481 JACKSON MI",
      "status": "POSTED",
      "memo": "DEBIT CARD PURCHASE"
    }
  ],
  "page": {"nextOffset": null, "totalElements": 1}
}

Mobile check deposit submission webhook

POST /webhooks/rdc/status
X-OFLab-Signature: t=1715246400,v1=8a6e...
Content-Type: application/json

{
  "deposit_id": "RDC-2026-05-09-018",
  "account_id": "2200017",
  "amount": 1875.00,
  "status": "ACCEPTED_HELD",
  "hold_release_date": "2026-05-13",
  "image_hash_front": "sha256:8c1e...",
  "image_hash_back":  "sha256:f02a...",
  "submitted_at": "2026-05-09T15:41:09Z"
}

Signature verification uses the standard timestamp + HMAC-SHA256 pattern; replays older than five minutes are rejected.

Error handling and idempotency

Every write endpoint accepts an Idempotency-Key header so retries after network failures will not duplicate transfers or RDC submissions. Errors surface as RFC 7807 problem JSON with type, title, status, detail, and instance, plus an FDX fdxError code where the upstream maps cleanly. Rate limits use the RateLimit-* headers so clients can back off without parsing prose.

About OpenFinance Lab

We are an independent technical studio focused on mobile-app interface integration and authorized API integration for fintech, banking, and credit-union scenarios. The team has shipped FDX-aligned bridges for community banks, ACH and RDC pipelines for property-management platforms, and statement-export connectors for accounting vendors.

• Banking, payments, lending, and digital-wallet integrations
• Protocol analysis with full reverse-engineering reports for client-owned data
• Custom Python, Node.js, and Go SDKs plus replayable test fixtures
• End-to-end pipeline: scoping → protocol analysis → build → validation → compliance review
• Source-code delivery from $300 — pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing, no upfront fee

Contact

For quotes, sandbox access, or to submit your target app and requirements, open our contact page:

Contact page

Engagement workflow

1. Scope confirmation: target scenarios (e.g. accounting sync, lending decision, RDC reconciliation) and field-level data needs.
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build and internal validation (3–8 business days), including FDX schema conformance tests.
4. Documentation, sample code, Postman collection, and recorded test fixtures (1–2 business days).
5. First delivery typically 5–15 business days; core-processor sandbox approvals can extend timelines.

FAQ

Is the Aeroquip Credit Union integration officially supported by the credit union?

Which data fields can be exported from Aeroquip Credit Union?

How long does delivery take?

How do you handle US compliance such as Reg E and CFPB Section 1033?