Generations Credit Union API integration services

Deliverables checklist

• OpenAPI 3.1 specification covering authentication, accounts, transactions, transfers, statements and branches.
• Protocol & auth-flow report describing the request chain (token handshake, biometric step-up, cookie/header invariants).
• Runnable Python and Node.js reference clients with a CLI harness for login + statement pulls.
• Automated integration tests (pytest / Jest) plus a mocked sandbox for CI.
• Compliance memo: CFPB Section 1033 readiness checklist, FDX field mapping, and a GLBA data-handling note.

API example 1 — Member login & token issue

POST /api/v1/gencu/auth/login
Content-Type: application/json

{
  "member_number": "1234567",
  "password": "<encrypted>",
  "device_id": "ios-9F2A...",
  "mfa_factor": "biometric"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "v1.MfRsh...",
  "expires_in": 1800,
  "consent_id": "cns_01HZX9..."
}

API example 2 — Statement export

POST /api/v1/gencu/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "acct_0001",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "format":    "json",
  "include_pending": true
}

200 OK
{
  "currency": "USD",
  "opening_balance": "2143.07",
  "closing_balance": "1987.42",
  "transactions": [
    {"id":"tx_0001","posted_at":"2026-04-03","amount":"-42.18","merchant":"H-E-B #001","category":"Groceries"},
    {"id":"tx_0002","posted_at":"2026-04-05","amount":"1500.00","merchant":"PAYROLL","category":"Income"}
  ],
  "next_cursor": null
}

API example 3 — Webhook: posted transaction event

POST https://your-host.example.com/hooks/gencu
X-Gencu-Signature: t=1715300000,v1=4d7b...

{
  "event": "transaction.posted",
  "consent_id": "cns_01HZX9...",
  "account_id": "acct_0001",
  "transaction": {
    "id": "tx_0042",
    "amount": "-128.55",
    "posted_at": "2026-05-09T14:22:00Z",
    "merchant": "VALERO #017",
    "balance_after": "1858.87"
  }
}

Verify signature, then ack within 5s:
204 No Content

1. Accounting & bookkeeping sync

A small-business member running QuickBooks or Xero needs daily transaction feeds from their Generations Credit Union checking account. The integration polls /statement with a rolling 24-hour window, normalizes merchant text, and pushes entries into the bookkeeping API. This maps cleanly to the FDX Transactions resource and satisfies most CFPB 1033 "data access" scenarios.

2. Personal-finance dashboard

A PFM aggregator (similar in role to Plaid or Finicity) issues a consent prompt, exchanges it for a long-lived refresh_token, and ingests balances and posted transactions every 4 hours. The app icon, account nickname and last-4 digits feed the user-facing connection card.

3. Mortgage / auto-loan underwriting

A lender requests 60 days of statement data with the member's one-time consent. The integration returns structured JSON plus the original PDF (preserved for the credit file), allowing the underwriter to verify income (PAYROLL credits), recurring liabilities and average balance — without scraping screenshots.

4. Treasury & multi-FI cash position

A non-profit or small business that holds funds at Generations plus a national bank uses the unified API to roll up balances every morning. The integration emits a single CSV file ready for the controller's spreadsheet, with FX columns left blank for USD-only Generations accounts.

5. Member-service automation

An internal CU tool listens to transaction.posted webhooks and, for any debit greater than $500, opens a confirmation prompt in the member's secure-message thread. This pattern uses the same auth scope as the mobile app but routes through the API gateway, so it can be audit-logged centrally.

Compliance & privacy

Every integration is built under documented member authorization and aligned with US financial-data regulations. The relevant frameworks are:

• CFPB Section 1033 — the Personal Financial Data Rights rule finalized in 2024, which requires depository institutions (including credit unions) to make consumer data available to authorized third parties. See the official CFPB rule page.
• FDX 6.x — the Financial Data Exchange API specification used as the de-facto open-banking schema in the US; our field mappings follow it.
• Gramm-Leach-Bliley Act — privacy and Safeguards Rule obligations, including encryption at rest, in-transit TLS 1.2+, and access logging.
• NCUA guidance — credit-union-specific cybersecurity expectations and the NCUA's third-party due-diligence framework.
• State data laws — when applicable (e.g. Texas BC&C, California CPRA), with documented retention windows and consumer rights flows.

Data flow / architecture

A typical deployment uses four nodes:

1. Client app or backend requests a consent and exchanges credentials for an access token.
2. Integration gateway (our deliverable) translates calls into the Generations Credit Union protocol, handles refresh and retry, and signs outbound webhooks.
3. Storage — encrypted Postgres for token + consent state, S3-compatible object store for statement PDFs, with row-level encryption keys per member.
4. Consumer side — your dashboard, accounting tool, ERP, or risk model receives JSON, CSV or webhook events.

The pipeline is stateless at the API layer; only consent records and refresh tokens are persisted. Member PII never lands in logs.

About us

OpenFinance Lab is an independent technical-services studio focused on app protocol analysis and authorized API integration for finance, e-commerce, travel and social apps. Our team has shipped production integrations against US banks, credit unions, neobanks, and PFM aggregators, and we are comfortable working under NDA with credit-union compliance and vendor-risk teams.

• Hands-on experience with FDX, CFPB 1033 readiness, and GLBA-aligned data handling.
• Python / Node.js / Go SDKs, plus example Postman collections.
• Full pipeline: protocol analysis → API design → build → validation → compliance memo.
• Source-code delivery from $300 — you receive runnable code and documentation; you pay only after delivery on satisfaction.
• Pay-per-call hosted API — no upfront fee; you pay only for what you actually call.

Contact

Send us the target app (already provided — Generations Credit Union, package org.generationscu.generationscu), the exact data scope you need, and any consent/sandbox material you already hold. We will reply with a fixed quote and timeline.

Open the contact page

Engagement workflow

1. Scope confirmation — which screens / data domains (login, balances, statements, transfers, Smart Deposit, branches).
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a sandbox account (3–8 business days).
4. Documentation, Postman collection, automated test pack (1–2 business days).
5. Hand-off + a 14-day support window for fix-ups; first delivery typically 5–15 business days end-to-end.

FAQ

What do you need from me to integrate Generations Credit Union?

How long does delivery take for a credit union integration?

How do you stay compliant with US financial data rules?