RWCU Mobile API integration (RiverWorks Credit Union)

Deliverables checklist

• OpenAPI 3.1 specification for every endpoint we expose
• Protocol analysis report covering the login chain, MFA challenge handling and token refresh
• Runnable source for balance, statement and Bill Pay endpoints (Python requests, Node.js axios, Go net/http)
• Postman collection plus pytest / vitest suites that hit a sandbox member
• Compliance brief mapped to CFPB Section 1033 covered data fields and the FDX data model
• Webhook contract for posted transactions, scheduled Bill Pay and transfer settlement

Engagement options

We work in two modes. Source-code delivery from $300 hands you a self-hosted module; you receive runnable code, the protocol report, and the test harness, and only pay after you have run it against your own RWCU sandbox. Pay-per-call routes traffic through our hosted gateway; you settle monthly on metered usage with no upfront commitment, which suits early-stage fintech teams that have not yet sized demand. Both options come with the same documentation set so you can move between them later without rewriting clients.

1. Bookkeeping sync for SMB members

A small business that banks at RiverWorks wants its checking activity to appear inside QuickBooks Online without manual CSV imports. We connect once via the consent flow, then poll GET /accounts/{id}/transactions nightly, normalise to FDX transaction objects and push them to the QuickBooks "Bank Feeds" endpoint. The integration also handles posted-vs-pending state changes so reconciled rows are not duplicated.

2. PFM dashboard with categorised spend

A consumer-finance partner builds a Personal Financial Management view that mixes RWCU balances with brokerage and credit-card data. We expose a GET /pfm/snapshot endpoint that joins account balances, 90-day transactions, and the Manage My Money budget categories, returning a single payload the partner can render. CFPB §1033 covered fields (balance, transaction information, terms, upcoming bill information) are tagged so the partner can prove provenance to auditors.

3. Rent-collection automation for landlords

A property-management SaaS lets landlords trigger ACH pulls from member accounts on the 1st of every month. We wrap the Transfers (Bank-to-Bank) flow with an idempotent POST /transfers/external endpoint, surface MFA challenges back to the calling partner, and emit a webhook on transfer.settled. The same pipeline handles refunds via a reverse transfer flagged with the original idempotency key.

4. Bill Pay programmatic scheduling

A subscription-billing platform schedules member rent and utility payments via the RWCU Bill Pay rails rather than card-on-file. Our POST /billpay/schedules endpoint accepts payee, amount, cadence and lead-time, then mirrors the in-app "Schedule or delete a bill payment" flow and writes back the canonical schedule ID for cancellation later.

5. Branch / ATM lookup for member-services chatbots

A member-experience team adds an AI agent that answers "where is the closest open branch?" Our GET /locations endpoint takes a ZIP code or lat/lon, returns ranked branches with hours and services, and is rate-limited per session so chatbot bursts do not overwhelm the source data.

Authorization (consent-based, FDX-aligned)

POST /api/v1/rwcu/auth/connect
Content-Type: application/json
Authorization: Bearer <PARTNER_KEY>

{
  "member_user_id": "<USER_ID>",
  "redirect_uri": "https://partner.example/callback",
  "scopes": ["accounts:read", "transactions:read",
             "billpay:write", "transfers:write"],
  "consent_ttl_days": 90
}

// Response
{
  "consent_id": "csn_01HZ...",
  "authorize_url": "https://auth.openfinance-lab.com/u/...",
  "expires_at": "2026-08-02T00:00:00Z"
}

Statement / transaction query

GET /api/v1/rwcu/accounts/{account_id}/transactions
Authorization: Bearer <ACCESS_TOKEN>
Query: ?from=2026-02-01&to=2026-04-30&type=all&page=1

// Response (FDX-shaped)
{
  "items": [
    {
      "transaction_id": "txn_8a2c...",
      "posted_at": "2026-04-28",
      "amount": -42.17,
      "currency": "USD",
      "description": "BILLPAY ELECTRIC CO",
      "check_number": null,
      "category": "Utilities",
      "running_balance": 1873.04
    }
  ],
  "next_cursor": "eyJwYWdl..."
}

Bill Pay scheduling + webhook

POST /api/v1/rwcu/billpay/schedules
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: 8e5a-4f...

{
  "payee_id": "pye_rent_landlord_42",
  "amount": 1450.00,
  "currency": "USD",
  "frequency": "monthly",
  "first_run": "2026-06-01"
}

// Webhook → POST partner.example/hooks
{
  "event": "billpay.schedule.created",
  "schedule_id": "bps_01HZ...",
  "occurred_at": "2026-05-02T11:14:09Z"
}

Regulatory alignment

For a US credit union app the controlling frameworks are the CFPB Personal Financial Data Rights rule under Section 1033 (finalized in October 2024 and currently under reconsideration), the GLBA Safeguards Rule, and NCUA member-data protections. RWCU is already exposed through Plaid's FDX-aligned Core Exchange per the public coverage page on Fintable, which means a properly scoped, consent-based integration is a documented public path rather than scraping.

How we treat member data

Every export is preceded by a member-signed consent record with a defined scope and TTL. We minimise data — for example we never request SSN when the use case only needs balance and transaction objects — and we surface revocation hooks so a member can disconnect from inside the partner app. Transport is TLS 1.2+, secrets live in a managed KMS, and audit logs are append-only with hash-chained verification.

Eastman Credit Union Mobile

One of the highest-rated US credit-union apps. Members who hold accounts at both Eastman and RWCU benefit from a unified transaction export so the bookkeeping side never has to reconcile two CSV downloads.

Delta Community Credit Union Mobile

Georgia's largest credit union; the data shape (accounts + transactions + Bill Pay) is essentially the same surface as RWCU, which makes a single integration template practical.

Redstone Federal Credit Union

Used heavily in the southeast; partners that build PFM tools often want both Redstone and smaller community CUs like RWCU under one OAuth-style consent layer.

ESL Federal Credit Union

Strong upstate New York footprint; relevant when a partner wants to roll up northeast credit-union members alongside Massachusetts-based RWCU members.

Wright-Patt Credit Union

Large Ohio credit union frequently mentioned in best-app rankings; holds the same NACHA / FDX-shaped fields a bookkeeping integration needs.

Alliant Credit Union

National, digital-first credit union; commonly paired with community CUs in cross-account dashboards.

Coastal Credit Union (Coastal24)

North Carolina-based digital banking platform; relevant for partners building a multi-state credit-union aggregator.

AmeriCU Credit Union

Upstate-NY credit union, similar member size and feature set to RWCU, with the same Bill Pay and transfers surface.

Wescom Financial

California-based, NCUA-insured, with a top-rated mobile and online banking surface; useful comparator for west-coast partners.

Municipal Credit Union (NYMCU)

NYC-area institutional credit union; including it in a unified consent layer helps partners that work with public-sector members.

About OpenFinance Lab

We are an independent technical-services studio focused on mobile-app protocol analysis and OpenData / OpenFinance API delivery. The team brings hands-on experience from card networks, payment gateways, core-banking integrators and consumer-finance startups, with deep familiarity with the FDX data model, Plaid Core Exchange and CFPB §1033 covered-data definitions.

• Retail banking, credit unions, payments, consumer lending, insurtech
• FDX 5.x conformance, OAuth-style consent flows and MFA challenge handling
• Custom Python, Node.js and Go SDKs with full test harnesses
• End-to-end pipeline: protocol analysis → build → validation → compliance brief
• Source-code delivery from $300 — runnable API source plus full documentation; pay after delivery on satisfaction
• Pay-per-call API billing — call our hosted endpoints and pay per request, no upfront fee

Contact

Send us the target app, the data you need, and any sandbox or member-consent context you already have. We reply with a scoped quote and a delivery plan within one business day.

Open the contact page

Engagement workflow

1. Scope confirmation: which screens (Accounts, Recent Activity, Bill Pay, Transfers) and which fields you actually need.
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build and internal validation against an RWCU sandbox or test member (3–8 business days).
4. Documentation, sample clients, and pytest / vitest test suites (1–2 business days).
5. Typical first delivery: 5–15 business days; longer when CFPB §1033 reconsideration changes the consent surface.

FAQ

What do you need from a member to start an RWCU Mobile integration?

How long does a first RWCU Mobile API delivery take?

How is compliance handled for a US credit union app like RWCU?