Tinker FCU Business API integration (FDX / OpenBanking)

Deliverables checklist

• OpenAPI 3.1 specification for every endpoint we expose
• Protocol & auth flow report (token chain, device fingerprint, MFA challenge handling)
• Runnable source for login, balance, statement, ACH and RDC endpoints (Python / Node.js)
• Automated regression tests against sandbox or shadow accounts
• Compliance guidance: CFPB 1033, NCUA examiner expectations, data retention
• Operational runbook: rate limits, retry/backoff, error classification

Engagement options

• Source code delivery from $300 — receive the runnable API source and full documentation; pay after delivery upon satisfaction.
• Pay-per-call hosted API — call our managed endpoints, settle monthly, no upfront fee; ideal for teams that prefer usage-based pricing.
• NDA and source escrow available for regulated buyers.
• Optional 30/60/90-day maintenance window for app-update tracking.

1. Daily QuickBooks reconciliation

An Oklahoma-based SMB wants its bookkeeper to skip manual CSV uploads. We pull posted_transactions nightly, normalize them to QBO records, and write them via the QuickBooks Online API. Drift between Tinker FCU statements and QuickBooks shrinks from days to hours.

2. Cash-position dashboard for a franchise group

A multi-location operator holds operating accounts at Tinker FCU and two other US credit unions. We aggregate balances and pending ACH on a 15-minute cron and feed a Looker/Metabase dashboard. The Tinker FCU feed reuses an FDX-aligned account & transaction schema so adding more institutions later is additive.

3. Mobile deposit confirmation webhook

A property-management firm posts rent checks via mobile deposit. We subscribe to RDC events, push a webhook to their AR system when a deposit clears the hold window, and auto-mark the corresponding invoice as paid. This eliminates the gap between "deposited" and "funds available".

4. Lending underwriting bundle

A working-capital lender needs 12 months of business banking activity for a loan decision. We export statements and categorized transactions through a CFPB Section 1033-style consent flow, package them as JSON plus signed PDFs, and ship them to the lender's underwriting queue.

5. Multi-user spend oversight

Tinker FCU Business supports customizable alerts for employees. We translate those alert events into a structured stream (employee ID, threshold, transaction reference) so a controller can review out-of-policy spend in a dedicated approval tool rather than email.

Session bootstrap (MFA-aware)

POST /api/v1/tinkerfcu/session
Content-Type: application/json

{
  "member_id": "biz_member_8421",
  "device_id": "dev_a1b2c3",
  "mfa_token": "123456",
  "scope": ["accounts:read", "transactions:read", "rdc:events"]
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "rt_..."
}

Transaction pull (FDX-aligned)

GET /api/v1/tinkerfcu/accounts/{account_id}/transactions
  ?fromDate=2026-04-01&toDate=2026-04-30&limit=100
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "accountId": "acct_8421_oper",
  "currency": "USD",
  "transactions": [
    {
      "transactionId": "tx_8821",
      "postedTimestamp": "2026-04-12T14:02:11Z",
      "amount": -842.55,
      "category": "ACH_DEBIT",
      "description": "OK GAS & ELECTRIC",
      "status": "POSTED"
    }
  ],
  "page": {"next": "cursor_xyz"}
}

Mobile deposit webhook

POST https://your-app.example.com/hooks/tfcu-rdc
X-OFL-Signature: sha256=...

{
  "event": "rdc.funds_available",
  "deposit_id": "rdc_5512",
  "account_id": "acct_8421_oper",
  "amount": 4250.00,
  "submitted_at": "2026-05-09T16:11:00Z",
  "available_at": "2026-05-11T13:00:00Z",
  "hold_reason": null
}

Error handling: HMAC verify, 2xx ack, idempotency key on
`deposit_id` to dedupe replays; 5xx triggers exponential backoff.

US regulatory frame

Every Tinker FCU Business integration we ship is built around CFPB Section 1033 — Personal Financial Data Rights, finalized in October 2024. We follow the Financial Data Exchange (FDX) technical specification, which the CFPB recognized as an official US open banking standard-setting body in January 2025 and which now connects more than 114 million consumer accounts.

For credit unions specifically, we also align with NCUA examiner guidance on third-party data sharing, screen-scraping deprecation, and the consent-management duties that come with being a covered data provider under 1033.

What that means operationally

• Explicit, revocable member consent recorded per data category
• Data-minimization defaults: only fields you scoped are returned
• Token-based auth (short-lived access, refresh on demand); no stored passwords
• Audit log of every access, retained on the gateway for at least 24 months
• Optional shielding for sensitive fields (account number masking, hashed IDs)

About us

OpenFinance Lab is an independent studio focused on fintech and open-data API integration. Our engineers have built clearing pipelines for banks, payment-gateway connectors, and aggregator-style data products. We understand the FDX specification, CFPB Section 1033, NCUA examiner expectations, and the Symitar/Jack Henry core that powers many US credit unions including Tinker FCU.

• Payments, digital banking, lending, and treasury automation
• Protocol analysis, gateway design, and security reviews
• Custom Python / Node.js / Go SDKs and test harnesses
• Full pipeline: research → build → validation → compliance handover
• Source code delivery from $300 — pay after delivery upon satisfaction
• Pay-per-call API billing — no upfront cost; usage-based pricing for predictable scale

Contact

To request a Tinker FCU Business integration quote, share your target data scope (balances only, full transactions, RDC events, ACH webhooks) and the system you want to populate (QuickBooks, NetSuite, Sage, a custom warehouse, or a lender dossier). We'll reply with a fixed-price or pay-per-call proposal.

Contact page

Engagement workflow

1. Scope confirmation: data categories, target sink, regulatory frame.
2. Protocol & auth analysis against the current Tinker FCU Business build (2–5 business days).
3. Build and internal validation against sandbox or shadow accounts (3–8 business days).
4. Documentation, OpenAPI spec, and test suite (1–2 business days).
5. Handover, optional 30-day update-tracking window for app releases.

FAQ

What do you need from me to start a Tinker FCU Business integration?

How long does the first delivery take?

How is compliance handled for US credit union data?

Do you support QuickBooks and Plaid pipelines?