EVFCU API integration & OpenBanking data services

Member authentication & session mirroring

We replicate the EVFCU mobile login flow (username/password, device registration, out-of-band MFA) inside a consented server-side session. The result is a stable access token your backend can reuse for balance and history reads without sending the member back through the app for each poll. Useful when a cashflow-based underwriter or PFM needs daily pulls behind a single member consent record.

Transaction history API

Exposes posted and pending items for share draft (checking), regular share (savings), money market, and loan accounts with fields including post_date, effective_date, amount, running_balance, type_code, description, check_number, and check_image_url. Driven by a date-window cursor so reconciliation jobs idempotently resume.

Balance & statement snapshot

Returns current, available, and hold balances per share, plus month-end statement pointers so accounting integrations can match a GL export to an authoritative EVFCU statement PDF. Designed to feed QuickBooks Online, Xero, Wave, or an internal ERP via periodic sync.

Transfer & ACH orchestration

Wraps member-initiated internal transfers, A2A external ACH, and loan payments behind an idempotent API that tracks request ids and returns the confirmation identifier the EVFCU core assigns. Caller supplies the member consent token; our layer enforces per-session velocity limits.

Remote deposit capture (RDC)

Image upload endpoint that mirrors the EVFCU mobile check deposit flow: front/back capture, MICR parse, duplicate detection against prior deposits, and hold-status callback when the credit union posts the funds. Useful for SMB tools that want in-app deposit without rebuilding image handling.

Locator & co-op shared branching dataset

Normalizes the in-app ATM/branch locator and CO-OP shared-branch network results into a GeoJSON/JSON feed. Lets a third-party app surface surcharge-free ATM coverage without screen-scraping the mobile UI for every query.

1. Cashflow-based lending for EVFCU members

A fintech lender serving the Iron Range needs 90 days of transaction history to underwrite a small personal or auto loan refinance. With member consent, we deliver a /transactions pull scoped to the last 90 days, FDX-style category mapping, and a second endpoint that returns running balance minimums. The lender scores cashflow in minutes, and the loan offer is presented back inside its own app. No screen-scrape fragility and every read is written to a consent audit log.

2. SMB bookkeeping sync for credit-union business members

Small businesses banking at EVFCU want QuickBooks, Xero, or Wave reconciliation. We schedule a nightly statement pull (all business shares), emit FDX-shaped transaction feeds, and reconcile posted items against the month-end statement pointer so the accountant can trust the book against the credit union's record of truth.

3. Personal financial management & net-worth tracking

PFM apps (Monarch, Copilot, Origin) aggregate accounts across many institutions. We plug EVFCU into the PFM via an FDX-aligned adapter covering accounts, transactions, and holdings. When the CFPB's Section 1033 compliance window reaches smaller depository institutions, the same adapter can switch from consented app-surface reads to the standard FDX endpoint with minimal downstream change.

4. Fraud & dispute evidence packs

A chargeback or dispute service needs the transaction record plus the front/back check image plus member-agreement metadata. Our check-image API returns signed, time-limited URLs along with MICR-parsed payer, routing, and amount fields so the dispute package can be assembled automatically instead of emailed around.

5. Unified treasury view across credit unions

A nonprofit treasurer runs accounts at EVFCU plus a larger institution. We normalize the EVFCU transaction feed to the same schema we deliver for other credit unions in this landscape (Alliant, Delta Community, BECU), so the treasurer's board report pulls from one unified dataset rather than three screenshots.

1. Member authentication (OAuth-style)

POST /api/v1/evfcu/auth/login
Content-Type: application/json

{
  "member_number": "<REDACTED>",
  "credential": "<REDACTED>",
  "device_fingerprint": "ios-14a-...",
  "consent_scope": ["accounts:read","transactions:read","deposit:write"]
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "mfa_required": false,
  "consent_id": "cns_01HZ7..."
}

2. Transaction history query

GET /api/v1/evfcu/accounts/{account_id}/transactions
  ?from=2026-01-01&to=2026-03-31&cursor=eyJwYWdlIjoyfQ
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: cns_01HZ7...

200 OK
{
  "account_id": "shr_draft_001",
  "currency": "USD",
  "items": [
    {
      "id": "txn_8c2...",
      "post_date": "2026-03-11",
      "effective_date": "2026-03-10",
      "amount": -42.17,
      "running_balance": 1834.55,
      "type_code": "DEBIT_CARD",
      "description": "SQ *IRON RANGE CAFE",
      "check_number": null,
      "check_image_url": null
    }
  ],
  "next_cursor": "eyJwYWdlIjozfQ"
}

3. Remote deposit webhook

POST https://your.app/webhooks/evfcu/deposit
X-Signature: sha256=...

{
  "event": "deposit.posted",
  "consent_id": "cns_01HZ7...",
  "deposit_id": "dep_1f9...",
  "account_id": "shr_draft_001",
  "amount": 250.00,
  "micr": { "routing": "091905260", "account": "****1234", "check_no": "1021" },
  "hold_release_at": "2026-04-25T14:00:00Z",
  "status": "posted"
}

// Response: 2xx to acknowledge; we retry with backoff on 5xx.

CFPB Section 1033 alignment

The CFPB finalized the Personal Financial Data Rights rule under Section 1033 on October 22, 2024, with an effective date of January 17, 2025. Compliance is staged by asset size: the largest providers by April 1, 2026 and smaller depository institutions on later dates (through 2030). In 2025 the rule entered reconsideration, but the direction of travel — consented consumer access to account data — is set. Our EVFCU connectors are built so that consent records, scope, and fee-assessment metadata are captured from day one, so a later switch to a standardized FDX endpoint is a configuration change, not a rewrite.

FDX v6.3 & NCUA guidance

We map transaction and account fields to the Financial Data Exchange v6.3 schema (CFPB-recognized standard-setting body as of January 2025, 114M+ consumer accounts connected). NCUA Appendix A to Part 748 guidance on member information safeguarding frames our key management, logging, and incident-response posture. Data transmitted to your systems is encrypted in transit and at rest, and consent artifacts include timestamp, scope, revocation path, and IP trail.

Authorized access only

We deliver under documented member authorization or documented public endpoints. No scraping of unconsented data, no credential resale. We also support pass-through architectures where member credentials never leave the consuming app's enclave — our code runs inside the client's VPC.

Deliverables checklist

• OpenAPI / Swagger specification for the EVFCU connector
• Protocol & authorization flow report (session mirroring, MFA handling, device binding)
• Runnable source (Python / Node.js / Go) for login, statement, transfer, and RDC endpoints
• FDX v6.3 field-mapping document so downstream consumers can swap to a standardized feed later
• Consent & audit schema aligned with CFPB Section 1033 record-keeping expectations
• Automated test suite covering 90-day transaction pulls, MFA retries, and hold-release webhooks

Two engagement models

Source code delivery from $300 — we hand over runnable API source code and documentation; pay after delivery upon satisfaction. Best when you need to own the integration in-house or run it inside your own VPC.

Pay-per-call API billing — access our hosted endpoints and pay only per call, no upfront fee. Best when you want to ship quickly and validate volume before committing to an in-house build.

Step-by-step

1. Scope call: confirm target data (balances, transactions, RDC, transfers) and consent model.
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build & internal validation against a sandbox or authorized test member (3–8 business days).
4. Documentation, sample calls, Postman collection, and test cases (1–2 business days).
5. Handover: source code delivery or go-live on our hosted endpoints. Typical first delivery: 5–15 business days.

FAQ

What do you need from me?

How long does delivery take?

How is compliance handled?

Can you support multi-institution aggregation?