ComfirstCU API integration & OpenBanking services

Deliverables checklist

• OpenAPI 3.1 specification covering login, accounts, transactions, transfers, RDC and Bill Pay
• Protocol & auth flow report: TLS pinning, OAuth handshake, token refresh, biometric step-up
• Runnable Python and Node.js reference clients with sample fixtures
• Pytest / Jest test harness, mocked sandbox + record/replay traces
• Compliance brief: CFPB 1033 mapping, FDX 6.4 field crosswalk, retention notes
• Optional Postman collection and a Banno / Jack Henry-shaped JSON adapter

API example: ComfirstCU statement query

// Pull a member's transactions in FDX-shaped JSON
POST /api/v1/comfirstcu/transactions
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "accountId": "share-1234",
  "fromDate": "2026-04-01",
  "toDate":   "2026-04-30",
  "types":    ["DEBIT_CARD","ACH","BILL_PAY","RDC"],
  "page":     { "limit": 100, "cursor": null }
}

200 OK
{
  "accountId": "share-1234",
  "currency":  "USD",
  "transactions": [
    {
      "transactionId": "tx_9f2…",
      "postedDate":    "2026-04-12",
      "amount":        -42.18,
      "description":   "PUBLIX #0142 JACKSONVILLE FL",
      "category":      "GROCERY",
      "channel":       "DEBIT_CARD",
      "runningBalance": 1284.55
    }
  ],
  "page": { "nextCursor": "eyJvZmZzZXQ…" }
}

API example: mobile check deposit (RDC) ingest

// Submit front + back check images for clearing
POST /api/v1/comfirstcu/rdc/deposit
Content-Type: multipart/form-data
Authorization: Bearer <ACCESS_TOKEN>

- account_id:   share-1234
- amount:       250.00
- front_image:  <jpeg>
- back_image:   <jpeg>
- micr:         "T031309123T 9876543C 0123"

201 Created
{
  "depositId":         "dep_5e1…",
  "status":            "PENDING_REVIEW",
  "holdReleaseDate":   "2026-05-12",
  "availabilityCents": 25000,
  "duplicateRisk":     "low"
}

API example: posted-transaction webhook

// Webhook delivered when a transaction settles
POST <your-callback-url>
X-Signature: t=1746,v1=9c3a…
Content-Type: application/json

{
  "event":  "transaction.posted",
  "memberId": "mbr_77a…",
  "accountId": "share-1234",
  "transaction": {
    "transactionId": "tx_9f2…",
    "amount": -42.18,
    "channel": "DEBIT_CARD"
  }
}

// HMAC verification (Node.js)
const sig = crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(rawBody).digest("hex");
if (sig !== headers["x-signature"].split(",v1=")[1]) reject();

1. Personal-finance dashboard (PFM)

A budgeting startup wants to surface a member's ComfirstCU checking balance and last 90 days of transactions next to their other US bank feeds. We map the /transactions endpoint to FDX TransactionList, normalize categories against an MCC dictionary, and ship daily incremental sync via the transaction.posted webhook so the dashboard never re-pulls history.

2. SMB bookkeeping & reconciliation

A small-business member runs payroll out of Community First Credit Union and reconciles to QuickBooks. We expose a Bill Pay payee API plus a posted-transaction stream; reconciliation matches each AP entry to its corresponding ACH posting, eliminating manual statement uploads and removing the "missing receipts" review queue.

3. Lending & underwriting

A consumer-lending partner needs three months of bank statements and a mobile check deposit history to verify income. The integration combines /statements (PDF + JSON) with /rdc/deposit records, signs the package with our webhook key, and forwards it to the partner's underwriting pipeline — FDX field names map cleanly to the lender's Akoya-shaped contract.

4. Compliance & audit logging

Internal audit needs a tamper-evident copy of every consent the member gives. Our consent ledger records OAuth scope grants, FAPI x-fapi-interaction-id values, IP, device, and the FDX ConsentReceipt — enough to satisfy a Section 1033 audit and to revoke access on a single API call.

5. ATM / branch locator embed

A travel app wants to surface surcharge-free Co-Op ATMs near the user. The /locations feed returns geo, opening hours and surcharge-free flag; we ship a simple GeoJSON adapter so the partner's existing Mapbox integration renders pins without a redeploy.

Compliance & privacy

Every flow is built around the CFPB’s Section 1033 Personal Financial Data Rights rule finalized on 22 October 2024, plus the FDX API v6.4 specification released in Spring 2025 (24 new RFCs, the CSDF Security Model and a Consent API Behavioral Specification). We implement OAuth 2.0 with FAPI 1.0 baseline, capture explicit member consent for each scope, log every data pull, and never store raw member credentials. The integration also respects the Gramm-Leach-Bliley Act safeguards rule and applicable NCUA member-data guidance for US credit unions.

Because Community First Credit Union sits below the $850M asset threshold described in the final rule, it is currently exempt from the mandatory 1033 timeline — but member-permissioned data sharing remains explicitly protected, and any production integration we ship is forward-compatible with the FDX-based developer interface that larger US institutions are required to expose from April 2026 onward.

Auth & security baseline

• OAuth 2.0 authorization code + PKCE; FAPI 1.0 baseline message signing
• Mutual TLS for server-to-server endpoints
• Rotating webhook HMAC secret, replay-window enforcement
• Scoped tokens: account.read, tx.read, rdc.write, billpay.write
• Consent receipts retained for 7 years per audit guidance
• Optional FAPI 2.0 profile for partners aligning with the Mastercard FDX dev hub

About OpenFinance Lab

We are an independent studio focused on US fintech and credit-union API integration. The team includes former Jack Henry, Banno and core-banking engineers, mobile reverse-engineering specialists, and compliance reviewers who have shipped against FDX, Plaid, MX and Akoya pipelines.

• Credit union, community bank and neobank API delivery
• Mobile protocol analysis (Android & iOS) with security review
• FDX 6.4 / CFPB 1033 readiness mapping for institutions and partners
• Custom Python / Node.js / Go SDKs and Postman collections
• End-to-end pipeline: protocol study → build → validation → compliance brief
• Source code delivery from $300 — runnable code and documentation, paid after delivery upon acceptance
• Pay-per-call hosted API — no upfront cost, usage-based pricing, ideal for proofs of concept

Contact

To request a quote, share your target ComfirstCU integration scope, or ask about hosted endpoints, open the contact page below. Include the data scope you need, your current aggregator (if any), and your expected daily call volume so we can scope the engagement model.

Open contact page

Engagement workflow

1. Scope confirmation — data fields, call volume, aggregator coverage, compliance posture (1–2 business days).
2. Protocol & auth analysis — OAuth, TLS pinning, biometric step-up, device-binding signals (2–5 business days).
3. Build & internal validation — reference Python / Node.js client, fixtures, sandbox traces (3–8 business days).
4. Documentation, OpenAPI, FDX crosswalk and test cases (1–2 business days).
5. Acceptance review & handover — you only pay after the deliverables run on your side.

FAQ

What do you need from me to start a ComfirstCU integration?

How long does delivery take?

How do you handle compliance with CFPB Section 1033 and FDX?

Do you support both Android and iOS ComfirstCU clients?