Open Banking & Statements API

Choose from a drop-in iFrame or a simple server-to-server API integration that spans both the regulated CDR pathway and the web crawler pathway. You keep the entire consumer experience; TaleFin handles consent, token exchange, retrieval, classification and reporting.

Integration highlights. The full endpoint reference, payloads and sandbox live in the developer wiki.

Low-Touch Integration

Drop in a hosted journey that connects a customer to their bank, retrieves and analyses their transactions, and produces a comprehensive report. You're identified by a vendor label we issue you, and you tag each application with your own vendor-specific ID so you can match results back to your records.

The simplest integration is one URL: build it from your vendor label and a unique customer identifier, then send the customer to it or embed it directly into your own website.

// a unique URL per application https://banks.talefin.com/i/{VENDOR_LABEL}/{VENDOR_SPECIFIC_ID} // …or embed it directly in your own page <iframe src="https://banks.talefin.com/i/{VENDOR_LABEL}/{VENDOR_SPECIFIC_ID}/" />

That's the whole front end. You can also deep-link to specific steps, prefill details, match the fonts and colours to your brand, and listen to events from a parent window. Full details are covered in the wiki.


Full-Featured API

If you prefer, you can implement purely server-to-server integration: you own the consumer-facing UI and communications, TaleFin does the data work. Start an application, attach institutions over CDR or the crawler, and TaleFin creates the Consumer Data Right consent requests, exchanges tokens, pulls accounts and transactions, classifies them, and produces a report. You get a consistent response shape whichever pathway a bank uses.

Authentication

Every request is signed with HMAC-SHA256 using the token identifier and secret we issue you. We provide signing helpers, so in practice it's one call before you send a request.

// sign the request with the helper we provide const signature = signRequest(method, path, body, secret); // then send it with these headers Date: Mon, 18 May 2026 09:32:00 GMT Content-Type: application/json Authorization: HMAC <TOKEN_ID>:<signature>

Quickstart

The happy path is three calls plus a browser redirect. Start an application, create a consent, and redirect the consumer to the bank. Illustrative only:

// 1. start an application POST /api/v1/{vendor}/{your-app-ref}/profile { "is_cdr": true, "full_name": "Jane Doe", "email": "jane@example.com" } → { "application_id": 678 } // 2. create a consent - returns the URL you send the customer to POST /api/v1/{vendor}/{your-app-ref}/consents { "bank_id": 42, "consumer_email": "jane@example.com", "return_url": "https://your-app.example/cdr/return" } → { "consent_id": 12345, "consent_url": "https://bank.example/auth?..." } // 3. redirect the customer to consent_url. After they authorise, we pull the // data and 302 them back to your return_url?status=authorised. // 4. once institutions are attached: POST /api/v1/{vendor}/{your-app-ref}/finalise

Webhooks

Everything after the redirect is asynchronous, so you react to events rather than poll. Register a URL and you'll receive signed deliveries as each stage completes:

  • consent.authorised: the customer approved sharing; the data crawl is dispatched
  • crawl.completed: accounts and transactions retrieved for an institution
  • application.report_ready: the report and bundle are ready to download

Deliveries are at-least-once and carry a unique event_id.

Endpoints

  • POST /api/v1/{vendor}/{ref}/profile: start an application or attach an institution
  • POST /api/v1/{vendor}/{ref}/consents: create a CDR consent and get the consent URL
  • POST /api/v1/{vendor}/{ref}/finalise: run analysis and produce the report
  • GET /api/v1/applications/{id}/bundle: download the report bundle (PDF / CSV / JSON)

Full developer docs

Complete endpoint reference, payloads, webhook catalog and a working sandbox live in the TaleFin developer wiki. Access is provided to partners once we're working together.

wiki.talefin.com Request access