Central Penn Bank & Trust-NNB API integration (FDX / OpenBanking)

Deliverables checklist

• OpenAPI 3.1 specification mapped to FDX v6.4 resource names
• Protocol report (auth handshake, token lifetime, header fingerprinting, MFA path)
• Runnable Python and Node.js source for login, balance, statement and RDC endpoints
• Postman collection plus pytest / vitest harness with sandbox fixtures
• Compliance brief covering CFPB Section 1033, GLBA Safeguards and FFIEC handbook references
• Operations runbook: rotation, error taxonomy, retry / idempotency keys

Feature module: Account & balance API

Mirror the in-app "Fast Balances" view server-side. Returns current and available balances for checking, savings, mortgage and auto-loan accounts in a single roll-up so accounting tools can post a daily snapshot.

Feature module: Statement & transaction history

Date-range pageable feed with merchant, memo, post date, amount and running balance. Used by reconciliation engines, audit trails and budgeting tools that need line-level detail rather than monthly PDFs.

Feature module: Mobile deposit (RDC) bridge

Upload front and back check images and receive a deposit reference plus processing status. Designed to drop into back-office tools so a teller-less branch can ingest checks alongside the consumer flow.

Feature module: Transfers, bill pay and Zelle

Initiate internal A2A transfers, list scheduled bill pay items, and read Zelle send/receive events. Useful for treasury workflows that need a unified ledger across in-house transfers and Early Warning Services rails.

Feature module: Credit Sense signal export

Surface Credit Sense (Fiserv) credit-score deltas and alert events to internal CRM or marketing automation, so a relationship manager can act when a customer's score drops or a new tradeline appears.

1. Local CPA firm month-end close

A Northumberland or Sunbury accounting practice pulls the previous month's transactions for shared business clients each first business day. Our statement endpoint returns paged JSON keyed on postedDate; the firm pipes it into QuickBooks Online via their existing import. This replaces brittle CSV downloads from the consumer app and keeps the audit trail explicit.

2. Mortgage refi pre-qualification

A regional refi originator reads twelve months of checking activity, current mortgage balance and Credit Sense score under explicit consumer consent. The service returns a single incomeStability roll-up and a redacted statement export, supporting Section 1033-style data portability without forcing the borrower to fax PDFs.

3. Small business cash flow dashboard

A Greater Susquehanna Valley small business operates one NNB checking and one savings account. We expose a webhook on every posted transaction so a self-hosted dashboard can update working-capital figures in near real time, and a daily Zelle reconciliation job categorizes inbound P2P payments as revenue.

4. Mobile deposit ingestion for back office

An insurance agency receives premium checks from policyholders. Instead of a clerk shuttling envelopes to a branch, the agency posts check images via our RDC bridge, receives a processing reference, and reconciles deposits against AR — all without writing a custom Jack Henry or Fiserv connector.

5. Bill pay calendar embedded in a budgeting tool

A consumer-facing PFM app reads the customer's NNB bill pay schedule and recurring payments and overlays them on a unified calendar that includes credit cards held elsewhere. The bill pay endpoint is read-only, so the bank's payment rails stay authoritative.

1. OAuth-style account consent (FDX-aligned)

POST /api/v1/nnb/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=<CONSUMER_CONSENT_CODE>
&client_id=<PARTNER_ID>
&redirect_uri=https://partner.example/cb
&code_verifier=<PKCE_VERIFIER>

200 OK
{
  "access_token": "eyJraWQiOi...",
  "token_type":   "Bearer",
  "expires_in":   3600,
  "refresh_token":"rt_8e8c...",
  "scope":        "accounts:read transactions:read deposits:write"
}

2. FDX-style transaction list

GET /api/v1/nnb/accounts/{accountId}/transactions
   ?fromDate=2026-04-01&toDate=2026-04-30&page=1&limit=200
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "page": 1,
  "totalPages": 3,
  "transactions": [
    {
      "transactionId": "tx_01HXY...",
      "postedTimestamp": "2026-04-29T14:02:11Z",
      "amount":  { "value": -42.18, "currency": "USD" },
      "description": "GIANT FOOD #234 SUNBURY PA",
      "category": "GROCERY",
      "runningBalance": { "value": 1284.55, "currency": "USD" },
      "status": "POSTED"
    }
  ]
}

3. Mobile RDC submission & webhook

POST /api/v1/nnb/deposits
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: multipart/form-data

front=@check_front.jpg
back=@check_back.jpg
amount=350.00
accountId=acct_chk_001

202 Accepted
{ "depositId":"dep_92ab", "status":"PROCESSING" }

# Webhook fired on settlement
POST https://partner.example/hooks/deposit
{
  "event":   "deposit.settled",
  "depositId":"dep_92ab",
  "amount":  { "value": 350.00, "currency":"USD" },
  "settledAt":"2026-04-30T18:00:00Z",
  "signature":"sha256=..."
}

Regulatory frame

US community-bank integrations sit under the CFPB Section 1033 Personal Financial Data Rights rule, the Gramm-Leach-Bliley Act safeguards, and FFIEC IT examination guidance. The Financial Data Exchange (FDX) was formally recognized by the CFPB as a Standards Setting Body in January 2025, and FDX-aligned APIs now power 130 million+ consumer connections in the US and Canada.

What this means for NNB

Depository institutions at or below the SBA size standard are currently exempt from Section 1033 subparts B and C, so a community bank like Northumberland National Bank is not forced to publish a public API. Voluntary FDX-aligned integrations remain best practice and are typically required by partner aggregators (Plaid, MX, Finicity, Akoya) before they will whitelist the institution.

Our delivery posture

We work strictly under explicit account-holder authorization or documented public APIs, capture consent records with timestamp and scope, apply data minimization on every endpoint, and ship a compliance brief that maps each route to GLBA, Section 1033 and FFIEC handbook references. NDAs are signed when the engagement requires sandbox credentials.

PNC Mobile

PNC's mobile app placed second in the J.D. Power 2025 Banking Mobile App Satisfaction Study and exposes balances, statements and Zelle activity that overlap with the NNB feature set. Combined exports help users that hold a Virtual Wallet account plus an NNB checking account.

Truist Mobile

Truist's app covers consumer checking, savings, mortgage and auto loans — a similar product mix to NNB, just at national scale. Users with both relationships often need consolidated transaction exports for tax season.

Wells Fargo Mobile

Wells Fargo Mobile carries a deep transaction history feed and Zelle-native payments. It is a common counterparty for NNB customers and a typical aggregator target for cross-bank reconciliation.

Bank of America Mobile Banking

Bank of America topped the same J.D. Power study and offers Erica-driven insights. Households mixing a national BoA relationship with a local NNB community-bank account use OpenBanking exports to keep budgeting tools in sync.

Chase Mobile

Chase Mobile exposes a mature transaction and bill pay surface and is one of the most-aggregated apps via FDX-aligned partners. Cross-bank workflows that include Chase typically benefit from the same statement schema we ship for NNB.

Capital One Mobile

Capital One ranked first in the J.D. Power 2025 Online Banking Satisfaction Study. Its credit-card and 360 checking data are commonly merged with community-bank checking exports for personal cash-flow dashboards.

Chime

Chime is a digital-first platform with no branches and is frequently a secondary account for NNB customers who want early direct deposit. Combining Chime and NNB transaction streams is a common Plaid / Akoya use case.

Ally Mobile

Ally is a digital-only bank with high-yield savings. Ally + community-bank households often want a single dashboard pulling savings yields from Ally and operating cash from NNB.

M&T Mobile Banking

M&T is a major regional bank in the Northeast US with a customer footprint that overlaps Pennsylvania. Joint M&T / NNB exports are typical inputs for local CPA firms.

Citizens Bank Mobile

Citizens covers New England and the Mid-Atlantic and is another regional counterpart to NNB. Mortgage-refi originators frequently consume both feeds when underwriting Pennsylvania borrowers.

About OpenFinance Lab

We are an independent technical studio focused on mobile fintech protocol analysis and OpenData / OpenFinance / OpenBanking API integration. Our engineers come from US and international banking, payments and core-platform backgrounds, and we have shipped integrations against Jack Henry, Fiserv, FIS-style cores as well as direct-to-app reverse-engineered surfaces for community-bank, neobank and payments apps.

• Community-bank, regional-bank and neobank app integrations
• FDX v6.4 alignment, OAuth and PKCE consent flows, webhook signing
• Custom Python / Node.js / Go SDKs and end-to-end test harnesses
• Source code delivery from $300 — runnable code plus documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — hit our hosted endpoints with no upfront cost; pay only for the calls you make

Contact

For quotes, scope reviews or to submit your target app and requirements, open our contact page:

Contact page

Engagement workflow

1. Scope confirmation: which scopes (accounts, transactions, deposits, Zelle) and which downstream system the data feeds.
2. Protocol analysis and API design — typically 2 to 5 business days.
3. Build and internal sandbox validation — typically 3 to 8 business days.
4. Documentation, samples, Postman collection and test cases — 1 to 2 business days.
5. First delivery in 5 to 15 business days; aggregator whitelisting may extend timelines.

FAQ

Do I need bank-side authorization to integrate Central Penn Bank & Trust-NNB data?

How long does delivery take?

Which compliance frameworks apply?

Can I just hit a hosted API instead of running source code?