Fabric partner APIs
Fabric · Nucleus BankOS moduleAPIs your partners build on, governed by the bank.
The Fabric partner APIs are the interfaces a fintech or corporate partner uses to onboard end users, open accounts, issue cards and move money in a sponsor bank’s program. Every call is scoped to one program, idempotent and recorded.
At a glance
- Style
- REST over HTTPS, JSON, versioned under /v1
- Authentication
- Program-scoped keys, least-privilege scopes
- Writes
- Idempotency key required on every write
- Events
- Signed webhooks, delivered at least once
- Connectivity
- Private, through the bank’s network
- Testing
- Sandbox with seeded personas and simulators
Specifications
What partners integrate
Field-level reference lives on the developer portal; access is granted through the sponsor bank.
| Programs and products | Read the program’s configuration, entitlements and deployable products |
|---|---|
| Onboarding | Start applications, submit applicant data and documents, read outstanding requirements |
| End users and accounts | Create end users, open accounts, read balances and sub-ledger entries |
| Accounts and transactions | Balances, holds, transaction search, statements and tax documents |
| Payments | ACH credits and debits, RTP and FedNow instant credits, book transfers |
| Cards | Issue and activate, spend controls, real-time authorization, disputes, wallet provisioning |
| Webhooks | Endpoints and event filters, delivery log, secret rotation, redelivery |
| Audit | Write partner access, security and error events to the bank’s audit trail |
| Scopes | domain:resource:action, additive; a key holds exactly what the bank granted |
|---|---|
| Idempotency | The same key replays the stored result; a different payload is a conflict |
| Pagination | Cursor-based, stable under concurrent writes |
| Errors | JSON with a stable code and a human message |
| Rate limits | HTTP 429 with Retry-After |
| Webhook signing | HMAC-SHA256 over timestamp and body; timestamp checked to reject replays |
| Delivery | Retries with backoff from one minute to 24 hours; dead-letter after 10 attempts |
Questions
What people ask
How does a partner get access to the Fabric APIs?
Through its sponsor bank. The bank creates the program, grants the scopes and issues sandbox and production keys; the API reference is on the adapfin developer portal for approved partners.
Is there a public API endpoint?
No. Partners reach the core over BroadStreet, adapfin’s private connectivity layer, through the bank’s own network, and every call is server-to-server from the partner’s backend.
Can a partner mark a customer as verified?
No. Partners submit applicant data and documents; identity verification and the decision are made by the platform or the bank’s designated vendors, and no scope can set a verification result.
How do Fabric webhooks work?
The partner registers an HTTPS endpoint and an event filter, and receives a signing secret once. Each event is signed, delivered at least once and retried with backoff, so the partner verifies the signature and de-duplicates on the event id.
How is the sandbox different from production?
Sandbox has its own keys and data and simulated rails, so no real money moves. Endpoints, errors and webhooks behave as in production, and simulators force returns, declines and manual-review outcomes.
Related
Keep reading
Module
Fabric
Banking-as-a-service on Nucleus BankOS.
For sponsor banks
Sponsor-bank controls
Who sets what, how partners are supervised, and the record examiners read.
For partners
Embedded deposits
White-label accounts, sub-ledgers and FBO structures on the bank’s core.
Core
Nucleus BankOS
The core the APIs run against.
Give your partners a contract they can build on.
A working session on your partner integrations, your controls and your launch sequence.