TN Military FCU API integration (OpenBanking / OpenData)

Authentication & session

OAuth-style token issuance that wraps the credit union's member login and MFA step (one-time code, security questions, biometric re-auth). Includes refresh handling, device binding and session revocation, so a personal finance dashboard or accounting integration stays connected for weeks without re-prompting members.

Statement export & reconciliation

Pull transaction history per account with paging, date range and type filters. Output as JSON, CSV or OFX/QFX so an external general ledger, NetSuite reconciliation rule or QuickBooks classification job can match deposits and ACH debits without manual export.

Funds movement

Initiate internal share-to-share transfers, ACH push/pull to linked external accounts, scheduled transfers and bill pay payee management. Each call returns an item ID that can be polled or pushed via webhook for posted/returned/cancelled status — useful for treasury and family-office tooling.

Mobile check deposit (RDC) bridge

Submit front/back check images and amount to the RDC endpoint, with response codes for accepted, on hold, duplicate and failed. Lets a back-office app accept member-side captures without re-implementing the in-app capture UX.

Card controls & alerts

Programmatically lock/unlock debit cards, set transaction-type rules (e.g. block international, block ATM, set spend limits) and stream eAlert subscriptions — large transactions, low balance, deposit posted — as webhooks into Splunk, Slack or a custom fraud queue.

Loan & credit card snapshot

The 2024 app refresh added Loan and Credit Card snapshots showing balances, due dates and quick links to card controls. Our integration exposes those same fields — outstanding balance, next payment date, minimum due, payoff amount — so a household-finance dashboard or veteran benefit portal can surface them in one view.

1. Veteran-services finance dashboard

A nonprofit assisting service members consolidates checking balance, loan payoff and recent transactions from TN Military FCU alongside other military-friendly institutions to advise on PCS-move budgeting. The integration pulls balance and transaction history under member consent every 30 minutes and writes a normalized event stream into a Postgres warehouse for analyst notebooks.

2. Small-business reconciliation for veteran-owned firms

A bookkeeping provider serving veteran-owned LLCs maps the credit union's posted transactions into chart-of-accounts buckets via the QFX/OFX export. Bill pay payees flow into a vendor master, and ACH debit returns are exposed as webhook events so the bookkeeper sees same-day reversals without polling.

3. Family financial oversight

A spouse-managed household app pulls balance, scheduled transfers and large-transaction eAlerts from the principal member's account (with that member's explicit, revocable consent). The family app surfaces a single weekly cash-flow chart and triggers a push notification when the loan minimum-due date approaches.

4. Fraud and identity monitoring

A monitoring service streams card-not-present alerts and atypical-merchant events from the credit union eAlert webhook into a SIEM rule. Suspicious transactions trigger an automated card-lock call back through the integration, achieving a containment loop without a member having to open the app first.

5. Section 1033 portability flow

Under the CFPB's Personal Financial Data Rights rule, an authorized third party requests a structured export of a member's transactions and account history when the member opts to portability-port to another provider. The integration delivers a 24-month JSON export and an audit log of the consent, request and delivery events.

Member authentication (OAuth-style)

POST /api/v1/tnmilfcu/auth/login
Content-Type: application/json

{
  "member_number": "*****1234",
  "password": "<cipher>",
  "device_id": "pf-dash-01",
  "mfa": { "method": "otp", "code": "482910" }
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 3600,
  "scopes": ["balances","transactions","transfers","rdc"]
}

Transaction history query

POST /api/v1/tnmilfcu/transactions
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "S0001",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "include_pending": true,
  "page": 1,
  "page_size": 100
}

200 OK
{
  "items": [
    {"id":"T882...","posted_at":"2026-04-29","amount":-42.18,
     "type":"DEBIT_CARD","desc":"COMMISSARY KNOXVILLE TN"},
    {"id":"T881...","posted_at":"2026-04-28","amount": 2400.00,
     "type":"ACH_CREDIT","desc":"DFAS-CLEVELAND DIRECT DEP"}
  ],
  "page":1,"total":124
}

eAlert webhook (card & balance events)

POST https://your-app.example.com/hooks/tnmilfcu
X-Signature: sha256=...

{
  "event":"card.transaction.high_value",
  "member_id":"M-93f...",
  "card_last4":"7741",
  "amount": 612.40,
  "merchant":"GAS STATION ATHENS TN",
  "occurred_at":"2026-05-07T22:14:08Z",
  "suggested_action":"lock_card"
}

Compliance & privacy

Credit-union member data is regulated under several overlapping U.S. frameworks. Our integrations are scoped to those obligations rather than improvised on top of them.

• CFPB Section 1033 (Personal Financial Data Rights). The final rule was effective January 17, 2025, with staggered compliance windows running April 2026 through April 2030; an August 2025 Advance Notice of Proposed Rulemaking is reconsidering parts of the rule. Smaller institutions may be exempt — we confirm scope before scoping work.
• GLBA & Regulation P. Non-public personal information is handled under data-minimization rules with clear notice to members.
• NCUA third-party guidance. Logging, encryption, breach notification and vendor-risk controls follow NCUA's expectations for credit-union third-party access.
• State law. Tennessee Information Protection Act and breach-notice obligations are observed for in-state members.

Data flow / architecture

A typical pipeline looks like this:

1. Member device (TN Military FCU app or our integration SDK) authenticates with MFA.
2. Auth gateway issues a short-lived access token bound to the member's consented scopes.
3. Integration API calls the credit union's authorized member endpoints, normalizes fields and emits events.
4. Storage / stream (Postgres, S3, Kafka) persists transactions and webhook events with a complete audit trail.
5. Consumer — your dashboard, ERP or fraud platform — reads through a stable, versioned REST/GraphQL surface.

About OpenFinance Lab

We are an independent technical studio focused on mobile-banking protocol analysis and OpenData / OpenFinance / OpenBanking API delivery. Our engineers come from core-banking platforms, payment processors, mobile-app reverse engineering and cloud security; we have shipped credit-union and bank integrations across the U.S., Europe and Asia.

• Mobile-banking protocol analysis under member or institutional authorization
• OpenAPI / Swagger specifications, runnable Python or Node.js source, and SDK packaging
• End-to-end pipeline: scope → analysis → build → validation → compliance handover
• Source code delivery from $300 — receive runnable API source and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — call our hosted endpoints and pay per request, with no upfront fee

Contact

To request a quote, share a sandbox or describe your TN Military FCU integration requirements, open our contact page:

Contact page

We respond to scoping requests within one business day. NDAs are signed before any member-data sample is shared.

Engagement workflow

1. Scope confirmation — list the data surfaces (login, balances, transactions, transfers, RDC, alerts) and target consumers.
2. Authorized protocol analysis and API design (typically 2–5 business days).
3. Build, internal validation against test member accounts (3–8 business days).
4. Documentation, code samples and Postman collection (1–2 business days).
5. Compliance handover — Section 1033 alignment, GLBA notice templates, audit-log schema.
6. First delivery typically lands in 5–15 business days; institutional approvals may extend timelines.

FAQ

What do you need from me to start?

How long does delivery take?

How do you handle compliance?