Heartland-GAB Mobile Banking API integration (FDX / OpenBanking US)

Deliverables checklist

• OpenAPI 3.1 specification mapped to the Financial Data Exchange (FDX) v6 schema
• Protocol analysis report covering OAuth-style session establishment, device-binding tokens and TLS pinning behavior
• Runnable reference source for login, balance, statement, RDC and locator calls in Python and Node.js
• Replayable integration test harness with sandbox fixtures and rate-limit simulator
• Compliance bundle: data-minimization checklist, Section 1033 consent template, retention defaults and audit-log schema

API example: 90-day statement query

POST /api/v1/heartland-gab/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>
X-FDX-Consent-Id: cnsnt_2026_05_02_abc123

{
  "accountId": "acct_xxxx7421",
  "fromDate": "2026-02-01",
  "toDate":   "2026-05-01",
  "type":     "deposit",
  "page":     { "limit": 100 }
}

200 OK
{
  "transactions": [
    {
      "transactionId": "txn_19f3...",
      "postedTimestamp": "2026-04-22T14:08:00Z",
      "amount": -85.31,
      "currency": "USD",
      "description": "ACH DEBIT - AEP OHIO",
      "category": "utilities",
      "runningBalance": 4231.04,
      "status": "POSTED"
    }
  ],
  "page": { "nextCursor": "eyJvZmZzZXQiOjEwMH0=" }
}

Typical integration scenarios

1. SMB accounting sync. A landscaping company in Columbus pushes Heartland-GAB checking activity nightly into QuickBooks Online via the FDX /transactions endpoint, eliminating manual CSV uploads and keeping reconciliation current within 24 hours.
2. Loan-origination cash-flow analysis. A non-bank consumer lender pulls 90 days of statement data through a Section 1033 consumer-authorized export to compute disposable income; data lands in the lender's underwriting model with FDX category codes preserved.
3. Treasury dashboards for multi-bank SMBs. Owners holding both a German American Business account and a Heartland-GAB checking account see a unified balance and 13-week cash-flow forecast through one merchant dashboard, fed by the same aggregator credentials.
4. Mobile-deposit reconciliation. A property-management firm reconciles tenant rent checks captured via in-app RDC: deposit-status webhooks fire when a hold is released, triggering ledger entries automatically.
5. Branch & ITM locator embed. A retail partner embeds the locator feed into a checkout receipt, helping in-person customers find the nearest of the combined 94 community-branch network across IN, KY and OH.

Compliance & privacy

Our Heartland-GAB Mobile Banking integrations follow the CFPB Personal Financial Data Rights rule (Section 1033) finalized on October 22, 2024, alongside the Financial Data Exchange (FDX) API specification recognized by the CFPB as a standard-setting body. Note that as of October 29, 2025 the rule's compliance dates are stayed pending CFPB reconsideration and litigation in Forcht Bank, N.A. et al. v. CFPB, so we treat the FDX path and aggregator-mediated access as the operational baseline today.

State-level requirements such as the Ohio Personal Privacy Act considerations, GLBA Safeguards Rule controls, and FFIEC mobile-banking guidance are layered on top, with bank-grade encryption at rest and in transit, principle-of-least-privilege scopes per consent, and full audit logs retained for at least 25 months.

Module catalogue

• Authorized session bootstrap and refresh
• Multi-account balance aggregation
• Statement and transaction export (FDX v6 schema)
• Mobile deposit metadata and webhook bridge
• Bill pay and Send Money historical retrieval
• Locator and product-marketing data feed
• Consent management and revocation endpoints

Authorized session bootstrap (Node.js)

// Wraps the customer authorization handshake and emits an FDX consent token
import { HeartlandGabClient } from "@openfinance-lab/heartland-gab";

const client = new HeartlandGabClient({
  appBuild: "com.heartlandbankohio3499a.production",
  device:   { id: process.env.DEVICE_ID, model: "Pixel 8" },
  channel:  "fdx-v6"
});

const consent = await client.authorize({
  username: process.env.HB_USER,
  password: process.env.HB_PASS,
  scopes:   ["account.read", "transaction.read", "statement.read"],
  ttlDays:  90
});

console.log(consent.consentId, consent.expiresAt);

Webhook for mobile-deposit status (Python)

from flask import Flask, request, abort
from openfinance_lab.heartland_gab import verify_signature

app = Flask(__name__)

@app.post("/webhooks/heartland-gab/rdc")
def rdc_event():
    if not verify_signature(request.headers, request.data):
        abort(401)
    evt = request.get_json()
    # evt = {"depositId": "...", "status": "AVAILABLE",
    #        "amount": 1250.00, "accountId": "acct_xxxx7421",
    #        "holdReleasedAt": "2026-05-02T10:00:00Z"}
    post_to_ledger(evt)
    return ("", 204)

Error envelope

{
  "error": {
    "code": "CONSENT_REVOKED",
    "message": "Customer revoked sharing for this account.",
    "fdxCode": "consent.revoked",
    "retryable": false,
    "remediation": "Trigger a fresh authorize() flow."
  },
  "requestId": "req_2026_05_02_8f1d"
}

About OpenFinance Lab

We are an independent technical studio focused on App interface integration and authorized API integration for fintech, banking and consumer apps. Our engineers come from US and EU banks, payment processors, and protocol-analysis teams, and we ship production-grade connectors under strict compliance constraints.

• US community-bank and credit-union data integrations
• FDX v6 normalization and aggregator failover routing
• Section 1033 consent management and revocation pipelines
• Custom Python, Node.js and Go SDKs with replayable test fixtures
• End-to-end pipeline: protocol analysis → build → validation → compliance review
• Source-code delivery from $300 — receive runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted endpoints and pay only per call, no upfront cost

Contact

For quotes or to submit your target app and requirements, open our contact page:

Contact page

Engagement workflow

1. Scope confirmation: which Heartland-GAB surfaces (login, balances, statements, RDC, P2P) you need and which downstream system consumes them.
2. Protocol analysis and FDX mapping (2–5 business days).
3. Build, internal validation against fixture sandboxes, and aggregator failover wiring (3–8 business days).
4. Documentation, sample integrations, and replayable test cases (1–2 business days).
5. Typical first delivery: 5–15 business days; multi-account or webhook deliveries can extend the schedule.

FAQ

Does Heartland-GAB Mobile Banking offer a public developer API?

What data can be exported from a Heartland-GAB account?

How long does an integration take to deliver?

Is the integration compliant with US open-banking rules?