City of Boston Credit Union API integration (OpenBanking, RDC, ACH)

Deliverables checklist

• OpenAPI 3.1 / Swagger specification for every endpoint we expose
• Protocol & auth-flow report (token lifecycle, device binding, MFA prompts)
• Runnable Python and Node.js reference clients with request signing
• Postman collection plus pytest / Jest test harness
• Compliance addendum: NCUA Part 748, CFPB 1033, GLBA Safeguards Rule mapping

Engagement options

• Source code delivery from $300 — runnable code and docs, paid only on acceptance.
• Pay-per-call hosted API — call our managed endpoints; no upfront cost, billed per request, with usage caps.
• Hybrid — start with hosted endpoints to validate, then take ownership of the source once the integration proves out.

1. Multi-institution PFM dashboard

A Boston-area fintech aggregates CBCU share balances and transactions alongside the member's brokerage and credit-card accounts. We expose GET /accounts and GET /accounts/{id}/transactions, refresh balances on a 15-minute cadence and stream new transactions through a webhook, mirroring the OpenBanking pattern used by CFPB Section 1033.

2. Small-business accounting reconciliation

A QuickBooks plug-in pulls CBCU business-checking transactions nightly, matches them to invoices using merchant strings, and posts the unreconciled balance back to the GL. RDC submissions captured through the CBCU app are paired with their corresponding deposit batches by image hash so that bookkeepers can close the month without manual entry.

3. Mortgage and auto-loan refinancing

A lender consumes CBCU loan-balance and statement data to pre-fill refinancing offers. The integration calls GET /loans, parses statement PDFs into a normalized JSON schema, and feeds the result into a credit-decision engine — replacing screen scrapes with explicit, member-consented data flows.

4. Internal treasury & payroll automation

A municipal employer that uses CBCU as its primary payroll-deposit destination automates net-pay verification: after each payroll run, an internal job calls the share-balance and transaction endpoints to confirm the ACH credit posted, then triggers a notification through the existing HRIS.

5. Compliance & audit reporting

An audit team needs read-only access to 24 months of statements and transactions for a sample of member accounts. We provision a scoped, time-boxed token, expose GET /statements and GET /transactions?type=ACH, and ship signed JSON evidence packets that satisfy NCUA examination requests without exposing PINs or full PANs.

Member authorization (token exchange)

POST /api/v1/cbcu/auth/token
Content-Type: application/json

{
  "member_id": "M-78231",
  "device_fingerprint": "ios|18.4|FaceID",
  "factor": {
    "type": "biometric",
    "assertion": "<WebAuthn assertion or app-issued nonce>"
  }
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "scopes": ["balances:read", "transactions:read", "rdc:write"]
}

Transaction history (Section 1033 shape)

GET /api/v1/cbcu/accounts/ACC-441/transactions
  ?from=2026-01-01&to=2026-04-30&limit=200
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "account_id": "ACC-441",
  "currency": "USD",
  "transactions": [
    {
      "id": "tx_9f2a",
      "posted_at": "2026-04-21T14:08:00Z",
      "amount": -42.18,
      "merchant": "MBTA Charlie",
      "category": "transit",
      "status": "posted",
      "fees": 0.00
    }
  ],
  "next_cursor": "eyJwYWdlIjoyfQ=="
}

Remote Deposit Capture submission

POST /api/v1/cbcu/rdc/deposits
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: multipart/form-data

front_image: <jpeg, <= 4 MB>
back_image:  <jpeg, <= 4 MB>
amount:      125.00
account_id:  ACC-441

202 Accepted
{
  "deposit_id": "dep_2c91",
  "status": "received",
  "expected_hold_release": "2026-05-04",
  "image_hash": "sha256:6f4a..."
}

# Webhook callback (status changes)
POST https://your.app/webhooks/cbcu
{
  "deposit_id": "dep_2c91",
  "status": "posted",
  "available_amount": 125.00
}

Regulatory alignment

CBCU is a US federally insured credit union, regulated by the National Credit Union Administration (NCUA). Our integrations follow NCUA Part 748 information-security guidance, the Gramm-Leach-Bliley Act Safeguards Rule, and the data-minimization principles introduced in the CFPB's October 2024 Personal Financial Data Rights final rule (Section 1033). We also track the August 2025 reconsideration proceedings so that integrations remain compatible if the rule's effective dates shift.

Operational safeguards

• TLS 1.3 in transit, AES-256 at rest, HSM-backed key storage
• Account numbers masked to last four digits in logs and webhook payloads
• Member consent records persisted for the life of the access grant plus 24 months
• Scoped tokens with revocation; no long-lived shared service credentials
• Audit-ready event logs covering authentication, RDC submission and ACH transfers

About us

OpenFinance Lab is an independent technical studio focused on mobile-app protocol analysis and OpenBanking-style API integration. The team brings hands-on experience from US and European banks, payment processors and aggregator vendors. We have shipped credit-union and community-bank integrations on Android and iOS, and we know how NCUA examinations, CFPB rulemaking and state privacy laws shape what a clean integration should look like.

• Credit unions, community banks and digital-first neobanks
• Payments, mobile RDC, ACH, Bill Pay and account aggregation
• Custom Python / Node.js / Go SDKs and request-signing libraries
• End-to-end pipeline: protocol analysis → build → validation → compliance review
• Source code delivery from $300 — runnable code and documentation, paid only on acceptance
• Pay-per-call hosted API — no upfront cost, billed per request

Contact

Tell us which CBCU surfaces you need exposed (balances, transactions, RDC, transfers, statements) and on what timeline. We will respond with a fixed-fee quote and a sample of the resulting API contract.

Contact page

Engagement workflow

1. Scope confirmation: which surfaces (balances, transactions, RDC, ACH, Bill Pay, statements).
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a member sandbox (3–8 business days).
4. Documentation, sample clients and test cases (1–2 business days).
5. First delivery typically 5–15 business days; aggregator handshakes may extend timelines.

FAQ

Is City of Boston Credit Union an open API?

Which CBCU data can be exposed via API?

How long does a CBCU integration take?

How do you stay compliant with NCUA and CFPB rules?