Barclays US API integration services (OpenBanking / Section 1033)

Deliverables checklist

• OpenAPI 3.1 specification for each surfaced endpoint
• Protocol and auth-flow report (OAuth, token chain, device-binding)
• Runnable Python and Node.js client for statements, balances, FICO and rewards
• Postman collection plus an automated regression test pack
• Compliance brief covering Section 1033, GLBA Safeguards, PCI DSS scope
• Operational runbook for token rotation, throttling and incident response

How we run the engagement

Each Barclays US engagement starts with a short data discovery session: which co-brand products are in scope, whether the FICO score view is needed, and how rewards should be normalized. We then map the in-app calls against the public Barclays API Exchange surfaces and select either a first-party flow or an authorized aggregator pathway. The final delivery is a hardened client your team can run on Day 1 — not a research notebook.

1. Travel-tech rewards reconciliation

Many Barclays US cards are co-branded with airlines and hospitality brands (AAdvantage Aviator, JetBlue Plus, Hawaiian Airlines, Wyndham, Carnival, Princess). A travel-rewards aggregator typically needs a normalized feed of accrual and redemption events across these programs.

Data & APIs: rewards ledger endpoint, statement endpoint for verifying bonus categories, transaction MCC for spend-category bonus calculation. OpenFinance mapping: consumer-authorized data access under CFPB Section 1033, with consent records persisted for each refresh.

2. SMB expense management & reconciliation

Small business operators carrying Barclays co-brand cards push transactions into QuickBooks, Xero or Ramp-style platforms. The integration needs posted vs pending state, merchant cleanup and statement-period anchoring so journal entries line up with the printed statement.

Data & APIs: transaction stream with pagination, statement PDF retrieval, FX rate field for foreign purchases. OpenFinance mapping: OpenBanking AISP-style consent UX adapted for the US, plus a webhook for new-transaction notifications.

3. Credit-monitoring & underwriting feedback

Personal finance apps and lenders want a recurring snapshot of a borrower's FICO score and revolving utilization. The Barclays US app surfaces the free FICO score plus the credit limit and current balance — enough to drive utilization-based alerts.

Data & APIs: FICO score endpoint, balance + limit endpoint, statement endpoint for paid-on-time history. OpenFinance mapping: data minimization is enforced — only score, limit, balance and refresh timestamp leave the boundary.

4. Deposit aggregation for treasury tooling

Customers holding Barclays Online Savings accounts or CDs alongside other US banks often need a single treasury view. The integration captures APY, balance, accrued interest and CD maturity to power yield-laddering and cashflow tools.

Data & APIs: savings account info, CD schedule, external transfer history. OpenFinance mapping: aligned with the consumer's right to port deposit data, with audit logs retained per GLBA Safeguards Rule expectations.

5. Fraud & card-control automation

Card-issuer ops teams and fintech challengers want a clean event stream for card locks, unlocks, replacements and shipping milestones. The Barclays US Card Control surfaces are perfect candidates for webhookification.

Data & APIs: card-state events, replacement request endpoint, shipping status. OpenFinance mapping: events are signed and idempotent, so downstream fraud platforms (e.g. SIEM, case-management) can reason about them safely.

Login & token refresh

POST /api/v1/barclays-us/auth/login
Content-Type: application/json

{
  "username": "user@example.com",
  "password": "<encrypted>",
  "device": {"id": "ios-9c2a", "biometric": true},
  "challenge": "otp:739204"
}

200 OK
{
  "access_token": "<JWT>",
  "refresh_token": "<opaque>",
  "expires_in": 1800,
  "scopes": ["accounts.read","cards.read","fico.read"]
}

Statement & transaction export

POST /api/v1/barclays-us/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "cc_4147xxxx",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "include":   ["pending","posted","fees"]
}

200 OK
{
  "billing_cycle": "2026-03",
  "minimum_due": 47.00,
  "currency": "USD",
  "transactions": [
    {"posted":"2026-03-04","mcc":"3000","merchant":"American Airlines",
     "amount":-318.40,"fx":null,"state":"posted"}
  ]
}

FICO score & webhook

GET /api/v1/barclays-us/fico
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "score": 762,
  "model": "FICO 8 Bankcard",
  "refresh_date": "2026-05-02",
  "trend_30d": +6
}

# Outbound webhook (signed with HMAC-SHA256)
POST https://customer.example.com/hooks/barclays-us
X-OFL-Signature: t=1714680000,v1=...
{
  "event": "card.locked",
  "account_id": "cc_4147xxxx",
  "occurred_at": "2026-05-02T19:14:11Z"
}

Compliance & privacy

Barclays US sits inside a fast-moving US regulatory perimeter. We design every integration around the CFPB Personal Financial Data Rights (Section 1033) framework — even while the rule is under active reconsideration in 2025–2026 — plus the GLBA Safeguards Rule for customer information protection and PCI DSS for any pathway that touches PAN data.

We prefer documented public APIs (the Barclays API Exchange, Plaid for aggregation) over scraping, retain consent receipts for every refresh, and ship data-minimization defaults so a FICO-only consumer never sees their statement PDFs leave the boundary. For UK or EU dual-region products, we align card-rails endpoints with PSD2 SCA expectations as well.

Data flow / architecture

The pipeline is intentionally boring: Barclays US app / official API → OpenFinance Lab ingestion gateway → encrypted storage (KMS-managed keys) → normalized API + signed webhooks → customer system. Each hop emits structured audit logs, a per-tenant rate limiter, and a kill switch that revokes downstream tokens within seconds of a consent withdrawal.

• Step 1 — Authorized data fetch from the Barclays US surface
• Step 2 — Schema normalization + PII tokenization at ingest
• Step 3 — Encrypted storage with field-level access policies
• Step 4 — Outbound REST / webhook delivery to customer systems

Chase Mobile

Holds card, deposit and Ultimate Rewards data for tens of millions of US households. Cross-issuer transaction exports across Barclays US and Chase Mobile are common in expense-management products.

Capital One Mobile

Spans credit cards, checking and auto loans. Following the Capital One / Discover merger, integrators are watching for a unified data surface — until then a multi-app exporter is the norm.

Discover Mobile

Cashback ledger and Cashback Match data is highly structured. Pairing Discover Cashback with Barclays US miles is a frequent travel-vs-cash optimization scenario.

American Express

Membership Rewards and transaction MCC tagging are a benchmark for premium card data. Integrators frequently sync Amex and Barclaycard co-brand transactions into a single travel dashboard.

Bank of America Mobile Banking

Holds checking, savings, BankAmericard and Merrill brokerage data. Common alongside Barclays Online Savings in deposit-aggregation workflows.

Citi Mobile

Carries ThankYou Points, AAdvantage Citi card data and FICO score widgets — directly analogous to Barclaycard's AAdvantage Aviator surface for travel-rewards aggregation.

Wells Fargo Mobile

Wide deposit and card footprint. Frequently paired with Barclays US in PFM apps that target US households consolidating multi-bank balances.

U.S. Bank Mobile

Co-brand portfolio includes airline and hotel cards similar to Barclays US. Reward-ecosystem dashboards typically support both as a baseline.

PNC Mobile Banking

Strong in deposits and small-business checking. Multi-bank treasury tooling often combines PNC, Barclays Online Savings and one large national bank.

Plaid (Barclaycard connector)

Acts as an authorized aggregator path into Barclaycard accounts. Useful when first-party developer access is not available and you need a documented consumer-consent flow.

About OpenFinance Lab

OpenFinance Lab is an independent technical studio focused on fintech protocol analysis and authorized API integration. Our engineers have shipped production stacks for card issuers, payment gateways and PFM products across the US, UK, EU and Asia, so we know the gap between a public developer portal and the actual call shapes a mobile app emits.

• Credit cards, deposit banking, lending, rewards and brokerage
• Section 1033, GLBA, PCI DSS and PSD2 dual-region scoping
• Custom Python / Node.js / Go SDKs and replay-driven test harnesses
• Source-code delivery from $300 — runnable client plus full documentation, paid after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing, no upfront commitment

Contact

To request a quote or share your target requirements (which Barclays US surfaces you need, regions, expected call volume), open our contact page.

Contact page

Engagement workflow

1. Scope confirmation — pick the Barclays US surfaces in scope (transactions, FICO, rewards, savings, card events).
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Implementation and internal replay-based validation (3–8 business days).
4. Documentation, sample data and test cases (1–2 business days).
5. Typical first delivery: 7–14 business days; sandbox approvals or co-brand specifics may extend timelines.

FAQ

What Barclays US data can I integrate via API?

How long does a Barclays US API integration take to deliver?

Is the integration compliant with US data sharing rules?