Bristol County Savings Bank API integration (FDX / OpenBanking)

Deliverables checklist

• OpenAPI / Swagger specification for every supported endpoint
• Protocol report covering OAuth, session refresh, OTP, and biometric device-trust steps
• Runnable source for login, account list, statement, transfer, and RDC status (Python and Node.js)
• Postman collection plus pytest / Jest test suites
• Compliance pack: data-minimization notes, retention guidance, and a CFPB 1033 / FDX field-mapping table

What we do not do

• No bypass of OTP, biometric, or device-binding controls
• No scraping of customer-only screens without written authorization from the account holder
• No silent collection — every call is logged with a consent reference and TTL
• No resale or warehousing of personal data outside the customer's environment

1. Small-business reconciliation

A local roofing company in Fall River uses BCSB checking and a payroll service in Stripe. We pull /accounts and /accounts/{id}/transactions daily, normalise the descriptions, and post matched entries to QuickBooks Online. Maps to FDX Transactions resource and CFPB 1033 covered-account data.

2. Personal-finance aggregator parity

A household using Monarch Money or Lunch Money wants the same fidelity Plaid offers for Eastern Bank or Rockland Trust. We deliver a connector that returns FDX-shaped Account, Statement, and InvestmentAccount objects so the app can render BCSB beside larger banks without a second-class experience.

3. Mortgage servicing dashboard

A wealth advisor pulls mortgage and auto-loan balances each night to refresh a household net-worth view. We expose /loans/{id} with principal, next payment, and payoff snapshot, and add a webhook on payment posting so the dashboard updates without polling.

4. Mobile-deposit ops queue

A bookkeeping firm processes invoices via the iMobile photo-deposit flow on behalf of clients. We surface /deposits events (submitted, processing, posted, rejected) so the firm's queue tool can flag exceptions before the customer notices.

5. Compliance & audit export

A municipal client (BCSB serves Massachusetts and Rhode Island municipal solutions) needs end-of-month statements in OFX and PDF for auditor sign-off. We schedule statement generation, sign each PDF, and drop both into a SOC-2 storage bucket with retention metadata.

1. OAuth login & device trust

POST /api/v1/bcsb/auth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<AUTH_CODE>
&code_verifier=<PKCE_VERIFIER>
&device_assertion=<BIO_NONCE_JWS>

200 OK
{
  "access_token": "eyJ...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "scope": "accounts.read transactions.read deposits.write"
}

2. Statement query (FDX-shaped)

POST /api/v1/bcsb/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "accountId": "acct_91f3...",
  "fromDate": "2026-04-01",
  "toDate":   "2026-04-30",
  "page": { "size": 100 }
}

200 OK
{
  "transactions": [
    {
      "transactionId": "tx_8a...",
      "postedTimestamp": "2026-04-12T14:02:11Z",
      "amount": -42.18,
      "currency": "USD",
      "description": "MOBILE TRANSFER OUT",
      "status": "POSTED",
      "category": "TRANSFER"
    }
  ],
  "page": { "next": "cursor_..." }
}

3. Mobile deposit webhook

POST <your-callback>
X-BCSB-Signature: v1=hmac-sha256(...)

{
  "event": "deposit.posted",
  "depositId": "dep_77b...",
  "accountId": "acct_91f3...",
  "amount": 1200.00,
  "currency": "USD",
  "submittedAt": "2026-04-29T09:14:02Z",
  "postedAt":    "2026-04-29T13:01:55Z",
  "imageUrls": ["s3://..."],
  "consentRef": "cnsnt_a92..."
}

Regulatory anchors

Designs align with the CFPB recognition of FDX as an open-banking standard-setting body in January 2026, the Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act, and the Gramm-Leach-Bliley Act safeguards required of every FDIC-insured US bank. Where a state-level statute applies (for example the Massachusetts 201 CMR 17 data-security regulation), we annotate the deliverable with the relevant control mapping.

Operational controls

• Customer-permissioned access only; consent stored with TTL and revocation hooks
• Per-call audit log with consent reference, scope, and outcome
• Data-minimization defaults: scopes ship narrow, broaden only on request
• FDX v6.4 field naming so a 1033-compliant facade is a wrap, not a rewrite
• NDA available; SOC-2 friendly logging hooks included in the sample stack

About our studio

OpenFinance Lab is an independent technical-services studio specializing in App interface integration and authorized API integration. Our engineers come from US community banks, payment processors, mobile-protocol research, and cloud security, and we have shipped end-to-end integrations against FDX, OFX, and Plaid-aggregator backbones. We work to NDAs, document every consent boundary, and prefer documented, customer-permissioned channels over scraping wherever a path exists.

• Engagement model 1: Source code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction.
• Engagement model 2: Pay-per-call hosted API — call our managed endpoints and pay per successful response; ideal when you want zero upfront cost.
• Coverage across financial, e-commerce, travel, and social verticals on both Android and iOS.
• Deliverables include OpenAPI specs, protocol notes, runnable Python / Node.js / Go samples, and a compliance pack.

Contact

Send the target app, the data points you need, and any sandbox or authorized account access you can lawfully provide. We reply with scope, timeline, and a fixed quote.

Open the contact page

Engagement workflow

1. Scope confirmation: which iMobile features (accounts, transactions, mobile deposit, transfers, bill pay) are in scope, and what consent path is available.
2. Protocol analysis and FDX-aligned API design (2–5 business days).
3. Build and internal validation against a sandbox or authorized live account (3–8 business days).
4. Documentation, Postman collection, and pytest / Jest test suites (1–2 business days).
5. First delivery in 5–15 business days; complex flows that include OTP, RDC images, or municipal exports may extend the timeline.

FAQ

What do you need to start a Bristol County Savings Bank integration?

How long does a first delivery take?

How is compliance handled for a US community bank?

Can the integration coexist with Plaid or other aggregators?