Maroon Financial API integration (FDX / OpenBanking)

Deliverables checklist

• OpenAPI 3.1 specification covering authentication, account, transaction, transfer, bill-pay, deposit, and loan-payment surfaces
• Protocol map: discovered endpoints, headers, signing scheme, token lifetimes, and rate limits
• Runnable reference clients (Python 3.11 + Node.js 20) with retry, idempotency, and structured logging
• Postman / Insomnia collections aligned to the spec
• Member-consent template and audit-log schema for CFPB 1033 readiness
• Test plan: sandbox setup, golden-path tests, error-case tests, and rate-limit drills

Engagement models

• Source-code delivery from $300. You receive the runnable API source and the documentation; payment is on satisfaction after the package runs in your environment.
• Pay-per-call hosted API. We host the endpoints and you pay for the calls you actually make — useful when one team needs MFCU data for a short proof-of-concept before committing to in-house code.
• Hybrid. Source code for low-volume background sync, hosted endpoints for the few flows that need ops-grade availability.

1. Accounting sync for small business members

Many MFCU members run a sole-proprietor practice or a UChicago-affiliated lab budget. The integration pulls posted transactions on a daily cadence, normalizes payee strings, and posts them through a QuickBooks Online webhook, with a manual review queue for anything the categorizer marks as low-confidence. Mapped FDX entities: Account, Transaction, Statement.

2. Personal financial management (PFM) feed

A campus-focused PFM tool ingests balances, transactions, and loan amortization data to render a unified net-worth view. Where Plaid or MX coverage of a small credit union is delayed or missing fields, the direct integration backfills Transaction.merchantCategoryCode, Loan.nextPaymentDate, and Account.availableBalance with single-call freshness.

3. Treasury reconciliation for student organizations

Recognized student organizations move money through MFCU sub-accounts. The treasurer's reconciliation tool reads transfer events, member-to-member payments, and bill-pay confirmations to close monthly books in minutes rather than hours; check images attach automatically for any item over a configurable threshold.

4. Loan-payment automation and reminders

A small-loan servicing UI uses the loan-payment endpoint to schedule payments from share-draft accounts, polls the payment status, and surfaces escrow movement and next-due dates. Failed payments emit a webhook the partner can route into a member outreach workflow.

5. Compliance evidence for member-permissioned aggregation

Where a fintech app aggregates MFCU data on behalf of a member, the integration records consent metadata (scope, granted_at, expires_at, revoked_at) into an append-only audit log. This produces a clean evidence trail consistent with the CFPB Section 1033 final rule's data-rights expectations.

Authentication — token exchange

POST /api/v1/maroon-financial/auth/login
Content-Type: application/json

{
  "username": "member_handle",
  "password": "<encrypted>",
  "device_id": "uuid-of-pinned-device",
  "consent_ref": "consent_2026_05_02_a1b2"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_8f...",
  "expires_in": 900,
  "mfa_required": false,
  "session": {
    "id": "sess_01HW...",
    "issued_at": "2026-05-02T14:01:09Z"
  }
}

Statement query — transactions

GET /api/v1/maroon-financial/accounts/{account_id}/transactions
  ?from=2026-04-01&to=2026-04-30&status=posted&page_size=100
Authorization: Bearer <ACCESS_TOKEN>
X-Idempotency-Key: stmt-2026-04-{account_id}

200 OK
{
  "account_id": "acct_share_draft_42",
  "currency": "USD",
  "transactions": [
    {
      "id": "tx_01HW...",
      "posted_at": "2026-04-12T19:33:00Z",
      "amount": -42.17,
      "description": "HYDE PARK PRODUCE",
      "category": "GROCERIES",
      "running_balance": 1284.55,
      "check_image_ref": null
    }
  ],
  "next_cursor": "eyJwYWdlIjoy"
}

Webhook — remote deposit status

POST https://your-app.example/hooks/mfcu
Content-Type: application/json
X-MFCU-Signature: t=1746194469,v1=4d2a...

{
  "event": "deposit.status_changed",
  "deposit_id": "dep_01HW...",
  "previous_status": "received",
  "current_status": "available",
  "amount": 250.00,
  "available_at": "2026-05-03T13:00:00Z",
  "consent_ref": "consent_2026_05_02_a1b2"
}

Regulatory alignment

U.S. credit-union data sharing sits under several overlapping frameworks. The CFPB's Personal Financial Data Rights Rule under Section 1033 establishes a member's right to authorize a third party to retrieve covered data; the largest data providers must comply by April 1, 2026, with smaller institutions phasing in through 2030. Even where MFCU's asset size places it outside the immediate compliance perimeter, designing the integration to FDX v6.x patterns now avoids a rebuild later. NCUA member-authentication guidance and NIST 800-63B identity-assurance levels inform the auth design.

Privacy & data minimization

We work only under documented authorized access or explicit member consent. Every API call is paired with a consent_ref, every payload carries a scope tag (e.g. balances:read, transactions:read, transfers:write), and retention windows default to the shortest period required by the use case. We exclude PAN, full SSN, and security questions from any persisted log unless the customer's compliance team explicitly requests otherwise in writing.

About OpenFinance Lab

We are an independent technical studio focused on app interface integration and authorized API integration. Our engineers come from banking, payments, mobile reverse-engineering, and cloud platforms, and we ship end-to-end financial APIs under defined security and compliance constraints. The team works in English with overseas clients, and operates a clean separation between research, build, and validation phases so each deliverable is auditable.

• Banking, credit-union, and payments app integrations across the U.S. and Europe
• Custom Python, Node.js, and Go SDKs with test harnesses
• Protocol analysis → OpenAPI 3.1 spec → reference client → sandbox validation pipeline
• Source-code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — access a managed endpoint and pay only per call, no upfront cost

Contact

For quotes, NDAs, or to submit your target app and requirements, please use our contact page. Tell us which data scopes you need (balances, transactions, transfers, deposits, loans), the volume you expect, and any aggregator you already use.

Open contact page

Engagement workflow

1. Scope confirmation — data scopes, volumes, downstream system, and authorization model.
2. Protocol analysis & API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a sandbox member account (3–8 business days).
4. Documentation, samples, and test cases (1–2 business days).
5. Typical first delivery: 5–15 business days; multi-account or audit-heavy stacks may run longer.

FAQ

What do you need from me to start a Maroon Financial integration?

How long does delivery take for a credit union mobile-banking integration?

How do you handle CFPB Section 1033 and member privacy?

Can the integration coexist with Plaid, MX or Finicity?