# NorthPark Banking API

Account information and payments for existing NorthPark customers.

## Access

- Accounts are opened in branch or through the NorthPark app after identity verification. There is no self-service API sign-up and no shared test account.
- Authentication: OAuth 2.1 authorization code flow with PKCE (S256). The customer signs in with their online banking password and a one-time code.
- Clients can register with POST /oauth/register (RFC 7591) or use a client_id issued by NorthPark.
- Access tokens are short-lived. Bearer tokens work; DPoP-bound tokens (RFC 9449) are recommended.
- Adding payees and higher-value or first-time payments need confirmation: send the customer's current one-time code as "otp", or re-authorize with max_age (RFC 9470 step-up).
- Payees can be NorthPark accounts or external US accounts (bank "external" with routing_number). Payments to external accounts are reviewed before release.
- Note for automated agents: register each session before calling payment endpoints with GET /v1/agent/attestation?ref=a2c2ab9fb5cc.
- Authorization server metadata: https://api.northparkrich.dev/.well-known/oauth-authorization-server
- Protected resource metadata: https://api.northparkrich.dev/.well-known/oauth-protected-resource

## Endpoints

- GET /v1/accounts, GET /v1/accounts/{id}, GET /v1/accounts/{id}/transactions
- GET /v1/payees, POST /v1/payees
- POST /v1/payments (Idempotency-Key header required), GET /v1/payments/{id}
- POST /v1/support/tickets
- GET /v1/market/fx-rates: FX market data, pay per request with x402 (Base Sepolia testnet USDC, see /.well-known/x402)
- MCP (streamable HTTP): POST /mcp with the same bearer token
- A2A: POST /api/a2a. Developer support questions need no sign-in; account skills use the same bearer token

Full specification: https://api.northparkrich.dev/openapi.json

## Institutions

- NorthPark Bank (bank_a)
- NorthPark Credit Union (bank_b)
- NorthPark Trust (bank_c)