{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"024923c1-41a1-4264-a28c-cdc7ad727769","name":"Scion BaaS API (v2.1)","description":"## Welcome to the Scion API\n\nThe **Scion BaaS API (SFAPI)** is fully RESTful API set. Our API uses standard HTTP response codes, authentication, and verbs, and delivers JSON responses for all calls.\n\n_Scion is the fintech extension of Medici Bank, an API designed to build on the bank’s core strengths while enabling new digital innovation. In this documentation, references to_ _**MB**_ _are shorthand for Medici Bank._\n\nThe **SFAPI** allows clients to:\n\n- Create & Manage Customers\n    \n- Create & Manage Customer Accounts and Balances\n    \n- View Customer Account Transactions\n    \n- Instantaneously Transfer Between Client-owned Accounts\n    \n- Get Realtime Notifications on all Customer or Account Activity\n    \n\nLet's get started...\n\n---\n\n# Getting Started\n\n## Sign Up for a Client API Account\n\nIn order to use our API, you will need to sign up for a Scion Client API Account. Please contact us for more information.\n\n## Using Your API Keys\n\nOnce you have your API keys, you can begin testing immediately. All keys are initially created in our Staging `STAG` environment. After you have finished testing and are satisfied with your integration, you can request keys for our Production `PROD` environment.\n\n## API Endpoints\n\n| Environment | Link |\n| --- | --- |\n| STAG | [https://staging.api.scionfi.io](https://staging.api.medicibank.io) |\n| PROD | [https://api.scionfi.io](https://api.medicibank.io) |\n\nNext, we will take a look at how to authenticate your API calls...\n\n### Requesting Sandbox Access\n\nAccess to our sandbox is for potential partners and clients. If you would like to have access to our API, please contact our Operations department [<b>operations@scionfi.com</b>](https://mailto:operations@medicibank.us)\n\n---\n\n# Authentication\n\nThe **MBAPI** uses three main forms of credential verification for secure authentication.\n\n1. API Keys\n    \n2. HMAC Signatures\n    \n\n## API Keys\n\nWhen you sign up for an account, you will be granted your own unique set of API credentials. The two main credentials you will need is the **API Key** `MBAPI-KEY` and the **API Secret** `MBAPI-SECRET`.\n\nYour **API Key** (`MBAPI-KEY`) is public and should be passed along within your API call headers. Your **API Secret** (`MBAPI-SECRET`) is private and should not be passed along (or exposed) in any public setting. Failure to do so can allow for a hacker to create API requests on your behalf. Your account will be suspended if a breach or unexpected activity is detected on your account.\n\n## HMAC Signature\n\nIn order to secure each request, we enforce that each call be sent as a **Hash-based Message Authentication Code** or **HMAC Signature**. For more on how to construct the HMAC signature, go to **Making Requests** section.\n\n```\nAuthorization: Bearer MBAPI-AUTHTOKEN\n\n ```\n\nNext, we will look at the API Methods we allow...\n\n---\n\n# HTTP Verbs\n\nAll requests are regulated to the following **API Methods**. Any method used outside of these will be rejected by the API with a `403 Forbidden` status code.\n\n<table><tbody><tr><td><div><b>Method</b></div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div><b>Usage</b></div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>GET</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Requests that retrieve information concerning a data representation.</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>POST</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Requests that create a new data representation. Information can be passed back based on the type of request.</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>PUT</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Requests that update partial information of a current data representation.</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>DELETE</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Requests that remove (or archive) a data representation.</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr></tbody></table>\n\nNext, we will take a look at all the statuses the API will respond with, including successful and unsuccessful (error) responses...\n\n---\n\n# HTTP Responses\n\nBelow is a full list of possible status codes. In the case of an error code, we will respond with additional information if more details about an error is provided.\n\n## 2xx - Successful\n\nThese are codes that mean that your API request was correct and without errors. Some calls are **Idempotent**. For more information on what means, visit the\n\n<a href=\"/introduction/standardDataStructures\">Standard Data Structures</a>\n\nsection.\n\n<table><tbody><tr><td><div>Code</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Reason</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Description</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>2xx</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Successful</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Your request was right!\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>200</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>OK</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The call was successful\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>201</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Created</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The resource was created\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>202</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Accepted</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The resource was updated successfully\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>204</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>No Content</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The resource was deleted successfully\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr></tbody></table>\n\n## 4xx - Client-Side Errors\n\n<table><tbody><tr><td><div>Code</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Reason</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Description</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>4xx</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Client Error</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Your request is wrong!\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>400</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Bad Request</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Your syntax is incorrect\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>401</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Unauthorized</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"You have wrong API credentials\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>403</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Forbidden</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Your credentials don't have the permissions to allow this request\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>404</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Not Found</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The resources/endpoint is invalid\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>405</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Method Not Allowed</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Content-type method is not allowed\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>429</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Too Many Requests</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Rate limit reached for this request\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr></tbody></table>\n\n## 5xx - Server-Side Errors\n\n<table><tbody><tr><td><div>Code</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Reason</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Description</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>5xx</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Server Error</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"We are wrong!\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>500</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Internal Server Error</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Server error on our side\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>502</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Bad Gateway</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"Invalid response from the server\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>503</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Service Unavailable</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"An internal service is unavailable\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>504</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Gateway Time-out</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>\"The request took too long to process on the server\"</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr></tbody></table>\n\n---\n\n# Making Requests\n\nTo secure all requests, we require all requests to include a specific set of HEADERS.\n\n## HEADERS\n\n<table><tbody><tr><td><div>MBAPI-KEY</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>Your unique PUBLIC API key</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>MBAPI-TIMESTAMP</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>The user generated timestamp for the request. Must be number of seconds since Unix Epoch</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>MBAPI-SIGNATURE</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>The user generated message signature. The <code>MBAPI-SIGNATURE</code> header is generated by creating a SHA512 HMAC message digest with base64 encoding, using your <code>MBAPI-SECRET</code> as the secret key. See below for an example of how to construct the HMAC signed request</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr><tr><td><div>MBAPI-NONCE</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td><td><div>A unique string that identifies this request and prevents the replaying of a past request. Please see below on how to construct this nonce</div><div contenteditable=\"false\"><div><div><div></div></div></div><div></div></div></td></tr></tbody></table>\n\n**Please note: For POST requests, you should JSON.stringify the body to avoid a mismatch in formatting for the signed request.**\n\n## HMAC\n\n> In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key. \n  \n\nIn regular terms, HMAC is the process of using a key, in this case, your **MBAPI-SECRET**, and encrypting a concatenated string version of your entire API request. By encrypting the entire request, we can not only hide the contents of that request, but we can also ensure that all information can only be decrypted by those who have key permissions to do so.\n\nSigning your API request is straightforward.  \nBelow is an example of how to do so:  \nNode.js Example\n\n``` javascript\nvar hash = crypto.createHmac(‘sha512’, {Your MBAPI SECRET}); // your MBAPI-SECRET e.g. “dONgcyGwBVupn/U2y8AdONGWkjfGomJqiKXk2BYaK4sd”\nhash.update(\"Your MBAPI Key\"); // your MBAPI-KEY e.g. \"1234567-ABCD-234RT-98yuT-8YHTjkUtf8klJF9m\"\nhash.update(\"API Request Method\"); // e.g. GET\nhash.update(\"API Path/URL\"); // encoded API request URL e.g. \"https://api.mb.io/dev/transfers\"\nhash.update(\"Unix Timestamp\"); // e.g. \"1574184580246\"\nhash.update(\"JSON.stringify(API Request Body)\"); // your request body\nvar hmacSignedRequest = hash.digest('base64');\n\n ```\n\n## MBAPI-NONCE\n\nA **Nonce** is a number or string, that can be used only once. The reason for using a nonce in API requests, is to ensure that once a request has been sent, regardless of whether that request is successful, it still cannot be used (or resent) again. This guards against _Replay Attacks_ and some _Man-in-the-Middle Attacks_.\n\nThere are a number of ways to create a nonce. However, we ask that you create this nonce in a specific way. The **MBAPI-NONCE** should be constructed using your `MBAPI-KEY` + `MBAPI-TIMESTAMP` + `A random 32-character string`. Then taking that string and creating a `base64_encoded` hash. _Very similar to the process of creating your HMAC signed request_.\n\nBelow is an example of how to do so:  \nNode.js Example\n\n``` javascript\nvar hash = crypto.createHash(‘sha512’);\nhash.update(\"Your MBAPI-KEY\");\nhash.update(\"Your MBAPI-TIMESTAMP\");\nhash.update(\"Your Random 32 Character String\");\nvar MBAPI-NONCE = hash.digest('base64');\n\n ```\n\n> **HTTPS Only!** \n  \n\n---\n\n# Standard Data Structures\n\nBelow are a list of standards that we enforce for our data structures.\n\n## Content-Type\n\n``` javascript\nContent-type: application/json\n\n ```\n\nAny content request (even if valid) that is not `application/json` will return a `400 Bad Request` HTTP status code with `errorMessage: \"Invalid request headers\"`\n\n## Timestamps\n\nAll timestamps are returned in ISO 8601 format:\n\n```\nYYYY-MM-DDTHH:MM:SSZ\n\n ```\n\n## Idempotent Requests\n\nAn _Idempotent Request_ is a request that may change the state of the resource once, but will not continue to change if that identical request is sent again.\n\nFor example, a `PUT` request will update some (or all) of the information on a resource, based on what is being asked to be changed. But once the resource has been changed, sending in another request, that is identical to the first request, will not result in anything changing. Because no new information was changed.\n\nThis is the same for `DELETE` requests. Once a resource is deleted, it can not be re-deleted.\n\n## Standard Response Structure\n\n#### An Array of Data\n\nResponse 200 (application/json)\n\n``` json\n{\n    \"total\":2,\n    \"data\": [\n        {\"field\":\"value1\"},\n        {\"field\":\"value2\"}\n    ],\n    \"url\":\"the URL used in the API call\",\n    \"status\":\"The HTTP Status Code\",\n    \"timestamp\":\"the timestamp of the API call\",\n    \"links\": {\n        \"first\":\"link to the first available paginated resource\",\n        \"next\":\"link to next available paginated resource\",\n        \"prev\":\"link to previously available paginated resource\",\n        \"last\":\"link to the last available paginated resource\"\n        }\n}\n\n ```\n\n#### Single Data Object\n\nResponse 200 (application/json)\n\n``` json\n{\n    \"data\": {\n        \"field\":\"value\" \n    },\n    \"url\":\"the URL used in the API call\",\n    \"status\":\"The HTTP Status Code\",\n    \"timestamp\":\"the timestamp of the API call\"\n}\n\n ```\n\n#### Example Error Response\n\nResponse 404 (application/json)\n\n``` json\n{\n    \"error\": {\n        \"status\": \"Bad Request\",\n        \"reason\": \"Missing Requirements\",\n        \"description\": \"The following parameters are missing: ['name']\"\n    }\n}\n\n ```\n\n_Please note: the \"links\" and \"total\" fields are not used when errors are returned_\n\n### Shortcut Response\n\nSome of our responses are \"shortcut\" responses and will only return a short data set. For example, the `Get Account Balance` route only returns the Balance and the Available Balance\n\n## Sorting and Filtering\n\nEvery API result that produces a collection of data can be manually sorted and/or filtered. By default, collections of data are sorted by the `createdAt` timetsamp `DESC`. This means the newest record in that data collection is first on the list (and the oldest is last).\n\n#### Sorting\n\nYou can dictate sorting by passing the `sort=` parameter in any route and detailing the field (or fields) by which you'd like to sort.\n\n```\n/example?sort=['name':'ASC']\n\n ```\n\n#### Filtering\n\n##### Limit\n\nTo manually change number of records returned in a single API call, use the `limit=` parameter. By default, value of `limit` is set to `50`. If you do not provide `limit` parameter or do not modify its default value then `50` records are returned.  \nFor example, to return _60_ records per page, you would do the following:\n\n```\n/example/?limit=60\n\n ```\n\n`limit` parameter works with `page` parameter. Also refer **PAGE** section for more details.\n\n##### Page\n\nEvery API result that produces a collection of data is automatically paginated. The default number of records _per page_ is 50. This `page` and `limit` parameters works with each other. Value of `limit` parameter determines the number of records contained in one page.  \nBy default, if no `page` and `limit` parameters are specified then `page=1` and `limit=50` is considered and so record from 1 to 50 are returned in first page.\n\nFor example, if you want to retrieve 51 to 100 records then specify `page=2`\n\n```\n/example/?page=2 (would return results from 51 to 100, provided records are available)\n\n ```\n\n---\n\n# Prerequisites\n\nYou must have below available with you before making any of MBAPI call.\n\n#### MB API Keys\n\n- Valid pair of `MBAPI-KEY` and `MBAPI-SECRET` issued to you.\n    \n\n_Please contact Scion to get your MBAPI-KEY and MBAPI-SECRET pair_\n\nYou are now ready to start using our API. We look forward to seeing what great financial applications you will be able to create with us and we appreciate your business.\n\n---\n\n# Webhooks\n\n#### Webhooks are a way for the API to notify your application of events in real time. When an event occurs, the API sends an HTTP POST request to your configured webhook URL with event details. This document outlines the supported webhooks, their payloads, and integration guidelines.EndFragment\n\n## **Integration Guidelines**\n\n- **Webhook Setup:**\n    \n    - Register your webhook endpoint but submitting this to us.\n        \n    - Use HTTPS endpoints for secure communication.\n        \n- **Request Authentication:**\n    \n    - The API includes an `Authorization` header with every webhook request. Validate this header to ensure the request’s authenticity.\n        \n- **Response Handling:**\n    \n    - Respond with a 200 HTTP status code within 10 seconds.\n        \n    - Any non-200 response will trigger a retry mechanism.\n        \n\n**Webhook Secret Rotation:**\n\n### Rotate secrets periodically for enhanced security.**\n\nCustomers**\n\n- **Customer Created**\n    \n    - **Description:** Triggered when a new customer profile is created.\n        \n    - **Event Code:** `customer.created`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"customer.created\",\n  \"data\": {\n    \"customer_id\": \"67890\",\n    \"name\": \"John Doe\",\n    \"email\": \"john.doe@example.com\",\n    \"timestamp\": \"2024-12-19T10:00:00Z\"\n  }\n}\n\n ```\n\n- **Customer Update**\n    \n    - **Description:** Triggered when a the customer info is updated.\n        \n    - **Event Code:** `customer.updated`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"eventnt\": \"customer.updated\",\n  \"data\": {\n    \"customer_id\": \"67890\",\n    \"name\": \"John Doe\",\n    \"email\": \"john.doe@newdomain.com\",\n    \"timestamp\": \"2024-12-19T11:00:00Z\"\n  }\n}\n\n ```\n\n### **Businesses**\n\n- **Business Created**\n    \n    - **Description:** Triggered when a new business is created.\n        \n    - **Event Code:** `business.created`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"eventnt\": \"business.created\",\n  \"data\": {\n    \"business_id\": \"67890\",\n    \"name\": \"ACME Business\",\n    \"email\": \"john.doe@newdomain.com\",\n    \"timestamp\": \"2024-12-19T11:00:00Z\"\n  }\n}\n\n ```\n\n- **Business Updated**\n    \n    - **Description:** Triggered when the business info is updated.\n        \n    - **Event Code:** `business.created`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"eventnt\": \"business.updated\",\n  \"data\": {\n    \"business_id\": \"67890\",\n    \"name\": \"ACME Business\",\n    \"email\": \"john.doe@newdomain.com\",\n    \"timestamp\": \"2024-12-19T11:00:00Z\"\n  }\n}\n\n ```\n\n### **Accounts**\n\n- **Account Created**\n    \n    - **Description:** Triggered when a new account is created for a customer.\n        \n    - **Event Code:** `account.created`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"account.created\",\n  \"data\": {\n    \"account_id\": \"13579\",\n    \"customer_id\": \"67890\",\n    \"type\": \"savings\",\n    \"balance\": 0.00,\n    \"currency\": \"USD\",\n    \"timestamp\": \"2024-12-19T09:00:00Z\"\n  }\n}\n\n ```\n\n- **Account Updated**\n    \n    - **Description:** Triggered when an account’s details are updated.\n        \n    - **Event Code:** `account.updated`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"account.updated\",\n  \"data\": {\n    \"account_id\": \"13579\",\n    \"balance\": 500.00,\n    \"currency\": \"USD\",\n    \"timestamp\": \"2024-12-19T12:30:00Z\"\n  }\n}\n\n ```\n\n- **Account Closed:**\n    \n    - **Description:** Triggered when an account is closed.\n        \n    - **Event Code:** `account.closed`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"account.closed\",\n  \"data\": {\n    \"account_id\": \"13579\",\n    \"customer_id\": \"67890\",\n    \"timestamp\": \"2024-12-19T16:00:00Z\"\n  }\n}\n\n ```\n\n### **Transactions**\n\n- **Transaction Created**\n    \n    - **Description:** Triggered when a new transaction is initiated.\n        \n    - **Event Code:** `transaction.created`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"transaction.created\",\n  \"data\": {\n    \"transaction_id\": \"24680\",\n    \"amount\": 250.00,\n    \"currency\": \"USD\",\n    \"status\": \"pending\",\n    \"timestamp\": \"2024-12-19T14:30:00Z\"\n  }\n}\n\n ```\n\n- **Transaction Settled**\n    \n    - **Description:** Triggered when a transaction is settled.\n        \n    - **Event Code:** `transaction.settled`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"transaction.settled\",\n  \"data\": {\n    \"transaction_id\": \"24680\",\n    \"amount\": 250.00,\n    \"currency\": \"USD\",\n    \"status\": \"settled\",\n    \"timestamp\": \"2024-12-19T15:30:00Z\"\n  }\n}\n\n ```\n\n- **Reversed**\n    \n    - **Description:** Triggered when a transaction is reversed.\n        \n    - **Event Code:** `transaction.reversed`\n        \n    - **Payload Example:**\n        \n\n``` json\n{\n  \"event\": \"transaction.reversed\",\n  \"data\": {\n    \"transaction_id\": \"24680\",\n    \"amount\": 250.00,\n    \"currency\": \"USD\",\n    \"status\": \"reversed\",\n    \"timestamp\": \"2024-12-19T16:30:00Z\"\n  }\n}\n\n ```\n\n# Nomenclature\n\nTo ensure clarity, our naming convention and meanings are as follows:\n\n- **Clients** are business entities that have contracted with Scion for its Banking as a Service offering.\n    \n- **Programs** are distinct offerings offered by Clients to their own prospects and customers. For example, a wallet program or a prepaid card program or a credit card program. Clients and Programs are established outside the API. Programs are operated via the API.\n    \n- **Customers** represents individuals who have User Profiles with a Client’s Program. These Customers can be Applicants, Owners of Accounts, Owners of Entities, Users of Accounts, or some combination thereof (for example, a business owner would be a Customer but not necessarily a User of the Account whereas an employee might be a Customer that is authorized as a User of the Account but is not necessarily an Owner of the entity.\n    \n- **Accounts** are bank accounts that are always attached to a Customer.\n    \n- **Entities** are organizations, such as a business, that are always attached to one or more Customers and, upon Bank approval, can have one or more Accounts. Customers do not have Entity accounts; Customers may have Entities and Entities may have Accounts.\n    \n- **Send Money** effects external transfers, including Customer or Business payments (eg via wire or ACH) to their own account elsewhere, and payments to others, either at other banks or other Programs.\n    \n- **Transfers** are book-entry, or ledger, transfers either between a Customer’s own Accounts or between the Accounts of separate Customers within the same Program and do not use the Wire or ACH payment networks. Note that while money transfers across Programs sponsored by Scion might be executed as book transfers by the Bank, they are invoked via the Send Money calls.\n    \n- **Transactions** are any type of debit or credit that has already occurred and ledgered on the system.\n    \n\n# API Reference","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":false,"owner":"706490","team":3400048,"collectionId":"024923c1-41a1-4264-a28c-cdc7ad727769","publishedId":"UVXgMxfD","public":true,"publicUrl":"https://documenter-api.postman.tech/view/706490/UVXgMxfD","privateUrl":"https://go.postman.co/documentation/706490-024923c1-41a1-4264-a28c-cdc7ad727769","customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"documentationLayout":"classic-double-column","customisation":{"metaTags":[{"name":"description","value":""},{"name":"title","value":""}],"appearance":{"default":"light","themes":[{"name":"dark","logo":null,"colors":{"top-bar":"212121","right-sidebar":"303030","highlight":"FF6C37"}},{"name":"light","logo":null,"colors":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"}}]}},"version":"8.11.4","publishDate":"2026-06-02T21:30:57.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"","description":""},"logos":{"logoLight":null,"logoDark":null}},"statusCode":200},"environments":[],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/e4e4c966c3d3282b1d9017fc6c101177602a74ed50879be6d92488ea0d515096","favicon":"https://res.cloudinary.com/postman/image/upload/v1648154597/team/vgu5cf6inttgjgyi8cuk.ico"},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"}],"canonicalUrl":"https://documenter.gw.postman.com/view/metadata/UVXgMxfD"}