openapi: 3.1.0
info:
  title: Account to Account Transfers
  description: |-
    Schedule and manage account to account transfers.

    When creating new simple transfers, the source and target accounts, amount, and transfer schedule are required and the transfer is scheduled to be processed on the scheduled date. Some financial institutions support immediate transfers between local accounts scheduled on the current day. Transfers to or from external accounts typically are processed after the financial institution's ACH cut-off time but require several business days.

    Transfers have a [`state`](#schema-transferState) property which indicates if the transfer is pending, pending approvals, scheduled (queued for processing), processing, or processed.

    Transfers support recurring schedules, such as repeating every week or every month. Recurring transfers can also be variable transfers; they recur without an amount. Occasional recurring transfers do not have a scheduled date. Both of these situations result in transfers in a `pending` state. They remain pending until a [`patchTransfer`](#op-patchTransfer) operation sets the amount and schedule. Once a `pending` transfer has an amount and schedule, it becomes `scheduled`.
  version: 0.18.0
  contact:
    name: Apiture
    url: https://developer.apiture.com/help/support/
    email: api@apiture.com
  termsOfService: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
  license:
    name: Apiture API License
    url: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
x-apiture-namespace: bankingTransfers
servers:
  - url: /banking
tags:
  - name: Transfers
    description: Banking Transfers
paths:
  /transfers:
    get:
      summary: Return a collection of transfers
      description: Return a [paginated](https://developer.apiture.com/docs/concepts/pagination) collection of transfers. The [nextPage_url](https://developer.apiture.com/docs/concepts/links) in the response is a pagination link.
      operationId: listTransfers
      x-apiture-api: bankingTransfers
      x-apiture-group: transfers
      tags:
        - Transfers
      parameters:
        - name: scheduledOn
          in: query
          description: 'Return only transactions whose `schedule.scheduledOn` date is in this date range. Excludes any transfers that do not have a `scheduledOn` date. Dates ranges use dates expressed in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. Example date ranges: <ul> <li> `2022-05-19` match only transfers scheduled on May 19, 2022.</li> <li> `[2022-05-01,2022-06-01)` in May, 2022: on or after May 1, but _before_ June 1</li> <li> `(2022-05-01,2022-06-01)` in May, 2022 (on or after May 1, but before June 1)</li> <li> `[2022-05-09,]` on or after May 9, 2022</li> <li> `(2022-05-09,)` after May 9, 2022</li> <li> `[,2022-05-09]` on or before May 9, 2022</li> <li> `(,2022-05-09)` before May 9, 2022</li> </ul>'
          schema:
            $ref: '#/components/schemas/dateRange'
        - name: debitsOn
          in: query
          description: Return only transactions whose `schedule.debitsOn` date (when the funds are debited from the source account) is in this date range. Excludes any transfers that do not have a `scheduledOn` date. Dates ranges use dates expressed in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. See the `scheduledOn` query parameter for examples.
          schema:
            $ref: '#/components/schemas/dateRange'
        - name: creditsOn
          in: query
          description: Return only transactions whose `schedule.creditsOn` (when the funds are credited to  the target account) is in this date range. Excludes any transfers that do not have a `scheduledOn` date. Dates ranges use dates expressed in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. See the `scheduledOn` query parameter for examples.
          schema:
            $ref: '#/components/schemas/dateRange'
        - name: historical
          in: query
          description: If `true`, list only historical (`state` is `processed`) transfers. If `false`, list only transfers that have not yet finished processing. If omitted, list all transfers.
          schema:
            type: boolean
        - $ref: '#/components/parameters/startQueryParam'
        - $ref: '#/components/parameters/limitQueryParam'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transfers'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          description: Unprocessable Entity. The request body and/or query parameters were well formed but otherwise invalid.
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - banking/read
      x-apiture-permission: listTransfers
    post:
      summary: Create a new transfer
      description: |-
        Create a new transfer within the transfers collection. If all the necessary properties are set, the transfer is queued for processing. If the request omits the `schedule.scheduledOn` date, the transfer remains pending/unscheduled until the user sets it via the [`patchTransfer`](#op-patchTransfer) operation.

        Note: This operation requires an identity challenge if the financial institution requires the user to prove their identity for some types of transfers. See the "Challenges API". See the various error types in the 403 response.
      operationId: createTransfer
      x-apiture-api: bankingTransfers
      x-apiture-group: transfers
      tags:
        - Transfers
      parameters:
        - $ref: '#/components/parameters/challengeHeaderParam'
      requestBody:
        required: true
        description: The data necessary to create a new transfer.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newTransfer'
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transfer'
          headers:
            Location:
              description: The URI of the new transfer.
              schema:
                type: string
                format: uri-reference
                maxLength: 400
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403WriteTransfer'
        '422':
          $ref: '#/components/responses/422Transfer'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - moneyMovement/write
      x-apiture-permission: createTransfer
  /transfers/{transferId}:
    parameters:
      - $ref: '#/components/parameters/transferIdPathParam'
    get:
      summary: Fetch a representation of this transfer
      description: Return the JSON representation of this transfer resource.
      operationId: getTransfer
      x-apiture-api: bankingTransfers
      x-apiture-group: transfers
      tags:
        - Transfers
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transfer'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404Transfer'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - banking/read
      x-apiture-permission: getTransfer
    patch:
      summary: Update this transfer
      description: |-
        Perform a partial update of this transfer as per [JSON Merge Patch](https://datatracker.ietf.org/doc/html/rfc7396) format and processing rules. Only fields in the request body are updated on the resource; fields which are omitted are not updated.

        Note: This operation requires an identity challenge if the financial institution requires the user to prove their identity for some types of transfers. See the "Challenges API". See the various error types in the 403 response.
      operationId: patchTransfer
      x-apiture-api: bankingTransfers
      x-apiture-group: transfers
      tags:
        - Transfers
      parameters:
        - $ref: '#/components/parameters/challengeHeaderParam'
      requestBody:
        required: true
        description: The fields to update within the transfer.
        content:
          application/merge-patch+json:
            schema:
              $ref: '#/components/schemas/transferPatch'
          application/json:
            schema:
              $ref: '#/components/schemas/transferPatch'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transfer'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403WriteTransfer'
        '404':
          $ref: '#/components/responses/404Transfer'
        '422':
          $ref: '#/components/responses/422Transfer'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - moneyMovement/write
      x-apiture-permission: patchTransfer
    delete:
      summary: Delete this transfer resource
      description: Delete this transfer resource and any resources that are owned by it. Only transfers that have not been processed may be deleted.
      operationId: deleteTransfer
      x-apiture-api: bankingTransfers
      x-apiture-group: transfers
      tags:
        - Transfers
      responses:
        '204':
          $ref: '#/components/responses/204'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '404':
          $ref: '#/components/responses/404Transfer'
        '409':
          description: |
            Conflict.

            This error response may have one of the following `type` values:
            * [`https://static.api.apiture.com/errors/cannotDeleteProcessedTransfers/v1.0.0`](https://static.api.apiture.com/errors/cannotDeleteProcessedTransfers/v1.0.0)<br>
              The delete operation is only allowed for transfers which have not begun processing.
              Remediation: Select a pending or scheduled transfer.
          x-apiture-errors:
            - cannotDeleteProcessedTransfers
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/problemResponse'
            application/json:
              schema:
                $ref: '#/components/schemas/problemResponse'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - accessToken:
            - moneyMovement/write
      x-apiture-permission: deleteTransfer
components:
  securitySchemes:
    apiKey:
      type: apiKey
      name: API-Key
      in: header
      description: API Key based client identification. See details at [Secure Access](https://developer.apiture.com/docs/secure-access).
      x-resolved-from: ../../common/openapi.yaml#/components/securitySchemes/apiKey
    accessToken:
      type: openIdConnect
      description: OpenId Connect (OIDC) authentication/authorization. The client uses the `authorization_endpoint` and `token_endpoint` to obtain an access token to pass in the `Authorization` header. Those endpoints are available via the OIDC Configuration URL. The actual URL may vary with each financial institution. See details at [Secure Access](https://dx.apiture.com/docs/api/concepts/api-keys/).
      openIdConnectUrl: https://auth.apiture.com/oidc/.well-known/openid-configuration
      x-resolved-from: ../../common/openapi.yaml#/components/securitySchemes/accessToken
  parameters:
    transferIdPathParam:
      name: transferId
      description: The unique identifier of this transfer. This is an opaque string.
      in: path
      schema:
        $ref: '#/components/schemas/resourceId'
      required: true
    startQueryParam:
      name: start
      in: query
      description: The location of the next item in the collection. This is an opaque cursor supplied by the API service. Omit this to start at the beginning of the collection. The client does not define this value; the API services automatically pass the `?start=` parameter on the `nextPage_url`.
      schema:
        type: string
        maxLength: 256
        pattern: ^[-a-zA-Z0-9.,-=_+:;@$]{0,256}$
        default: ''
      x-resolved-from: ../../common/openapi.yaml#/components/parameters/startQueryParam
    limitQueryParam:
      name: limit
      in: query
      description: The maximum number of items to return in this paged response.
      schema:
        type: integer
        format: int32
        minimum: 0
        maximum: 1000
        default: 100
      x-resolved-from: ../../common/openapi.yaml#/components/parameters/limitQueryParam
    challengeHeaderParam:
      name: Challenge
      description: This operation may require a completed challenge. If the first attempt calling this operation fails with a 403 `challengeRequired` error, the client should complete the challenge flow as described in the Challenges API, then retry the operation with this `Challenge` request header using the `challengeToken` returned at the end of that flow. If this is passed but the value is invalid, the operation fails with a 403 status code and the `invalidIdentityChallengeHeader` problem type.
      in: header
      schema:
        $ref: '#/components/schemas/challengeToken'
      x-resolved-from: ../../challenges/openapi.yaml#/components/parameters/challengeHeaderParam
  responses:
    '204':
      description: No Content. The operation succeeded but returned no response body.
      x-resolved-from: ../../common/openapi.yaml#/components/responses/204
    '400':
      description: |
        Bad Request. The request body, request headers, and/or query parameters are not well-formed.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/badRequest/v1.0.0`](https://static.api.apiture.com/errors/badRequest/v1.0.0)<br>
          The request body and/or parameters was not well-formed.
          Remediation: Correct any syntax or schema errors in the request body or parameters.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/badRequest'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/400
    '401':
      description: |
        Unauthorized. The operation requires authentication but no authentication or insufficient authentication was given.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/unauthorized/v1.0.0`](https://static.api.apiture.com/errors/unauthorized/v1.0.0)<br>
          The request lacks valid authentication credentials for the target resource or operation.
          Remediation: Authenticate the user and pass the required authorization with the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/unauthorized'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/401
    '403':
      description: |
        Forbidden. The authenticated caller is not authorized to perform the requested operation.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/forbidden/v1.0.0`](https://static.api.apiture.com/errors/forbidden/v1.0.0)<br>
          The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
          Remediation: Check the user's permissions and entitlements before attempting the operation.

        * [`https://static.api.apiture.com/errors/customerDisabled/v1.0.0`](https://static.api.apiture.com/errors/customerDisabled/v1.0.0)<br>
          The customer is disabled.
          Remediation: Have the customer contact the financial institution for support.

        * [`https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0`](https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0)<br>
          The financial institution requires the customer to have anti-malware software installed.
          Remediation: Direct the user to the software requirements guide to install the correct anti-malware software.

        * [`https://static.api.apiture.com/errors/modificationForbidden/v1.0.0`](https://static.api.apiture.com/errors/modificationForbidden/v1.0.0)<br>
          The customer is properly authenticated but not authorized to create, modify, or delete resources.
          Remediation: Avoid modification operation for customers with read-only authorization.

        * [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0)<br>
          The operation requires the customer to complete an identity challenge.
          Remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
        The `attributes` object in the error may have the properties defined by the [`requiredIdentityChallenge` schema](#schema-requiredIdentityChallenge).
        * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
          The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
          Remediation: Have the user end their login session and login again.

        * [`https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0`](https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0)<br>
          This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
          Remediation: Have the user register one or more challenge security code delivery factors.

        * [`https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0`](https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0)<br>
          The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
          Remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/forbidden'
        - $ref: '#/components/x-apiture-errors/customerDisabled'
        - $ref: '#/components/x-apiture-errors/antiMalwareRequired'
        - $ref: '#/components/x-apiture-errors/modificationForbidden'
        - $ref: '#/components/x-apiture-errors/challengeRequired'
        - $ref: '#/components/x-apiture-errors/challengeBlocked'
        - $ref: '#/components/x-apiture-errors/noIdentityChallengeFactors'
        - $ref: '#/components/x-apiture-errors/invalidIdentityChallengeHeader'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/403
    '429':
      description: |
        Too Many Requests. The client has sent too many requests in a given amount of time.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/tooManyRequests/v1.0.0`](https://static.api.apiture.com/errors/tooManyRequests/v1.0.0)<br>
          The client has sent too many requests in a given amount of time, exceeding rate limiting.
          Remediation: Slow down the rate of API calls.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/tooManyRequests'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/429
    403WriteTransfer:
      description: |
        Forbidden. The user's permissions do not allow the transfer. Either the user does not have `transferFrom` permission from the source account, or does not have `transferTo` permission to the target account, or the operation requires identity challenge. (See the "Challenges API".)

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/forbidden/v1.0.0`](https://static.api.apiture.com/errors/forbidden/v1.0.0)<br>
          The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
          Remediation: Check the user's permissions and entitlements before attempting the operation.

        * [`https://static.api.apiture.com/errors/cannotTransferFrom/v1.0.0`](https://static.api.apiture.com/errors/cannotTransferFrom/v1.0.0)<br>
          The customer does not have `transferFrom` entitlement on the source account.
          Remediation: Choose a source account that allows transfers from it.

        * [`https://static.api.apiture.com/errors/cannotTransferTo/v1.0.0`](https://static.api.apiture.com/errors/cannotTransferTo/v1.0.0)<br>
          The customer does not have `transferTo` entitlement on the target account.
          Remediation: Choose a target account that allows transfers to it.

        * [`https://static.api.apiture.com/errors/customerDisabled/v1.0.0`](https://static.api.apiture.com/errors/customerDisabled/v1.0.0)<br>
          The customer is disabled.
          Remediation: Have the customer contact the financial institution for support.

        * [`https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0`](https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0)<br>
          The financial institution requires the customer to have anti-malware software installed.
          Remediation: Direct the user to the software requirements guide to install the correct anti-malware software.

        * [`https://static.api.apiture.com/errors/modificationForbidden/v1.0.0`](https://static.api.apiture.com/errors/modificationForbidden/v1.0.0)<br>
          The customer is properly authenticated but not authorized to create, modify, or delete resources.
          Remediation: Avoid modification operation for customers with read-only authorization.

        * [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0)<br>
          The operation requires the customer to complete an identity challenge.
          Remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
        The `attributes` object in the error may have the properties defined by the [`requiredIdentityChallenge` schema](#schema-requiredIdentityChallenge).
        * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
          The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
          Remediation: Have the user end their login session and login again.

        * [`https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0`](https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0)<br>
          This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
          Remediation: Have the user register one or more challenge security code delivery factors.

        * [`https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0`](https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0)<br>
          The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
          Remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/forbidden'
        - cannotTransferFrom
        - cannotTransferTo
        - $ref: '#/components/x-apiture-errors/customerDisabled'
        - $ref: '#/components/x-apiture-errors/antiMalwareRequired'
        - $ref: '#/components/x-apiture-errors/modificationForbidden'
        - $ref: '#/components/x-apiture-errors/challengeRequired'
        - $ref: '#/components/x-apiture-errors/challengeBlocked'
        - $ref: '#/components/x-apiture-errors/noIdentityChallengeFactors'
        - $ref: '#/components/x-apiture-errors/invalidIdentityChallengeHeader'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
    404Transfer:
      description: Not Found. There is no such transfer resource at the specified `{transferId}`.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
    422Transfer:
      description: |
        Unprocessable Entity. The request body and/or query parameters were well formed but otherwise invalid.

        This error response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/invalidSourceAccountId/v1.0.0`](https://static.api.apiture.com/errors/invalidSourceAccountId/v1.0.0)<br>
          The named `sourceAccountId` does not exist or the user is not entitled to access the account.
          Remediation: Pass the `id` of an existing account the caller has access to.

        * [`https://static.api.apiture.com/errors/invalidTargetAccountId/v1.0.0`](https://static.api.apiture.com/errors/invalidTargetAccountId/v1.0.0)<br>
          The named `targetAccountId` does not exist or the user is not entitled to access the account.
          Remediation: Pass the `id` of an existing account the caller has access to.

        * [`https://static.api.apiture.com/errors/externalToExternalTransferNotAllowed/v1.0.0`](https://static.api.apiture.com/errors/externalToExternalTransferNotAllowed/v1.0.0)<br>
          Transfers from an external account to another external is not allowed.
          Remediation: At least one of the source or target accounts must be an internal account held at the financial institution.

        * [`https://static.api.apiture.com/errors/sameSourceAndTargetTransferAccounts/v1.0.0`](https://static.api.apiture.com/errors/sameSourceAndTargetTransferAccounts/v1.0.0)<br>
          The source and target account are the same.
          Remediation: Choose different source and target accounts.

        * [`https://static.api.apiture.com/errors/nonPositiveAmount/v1.0.0`](https://static.api.apiture.com/errors/nonPositiveAmount/v1.0.0)<br>
          The transfer amount may not be 0.00.
          Remediation: Set the transfer amount to a positive number.

        * [`https://static.api.apiture.com/errors/insufficientFundsForTransfer/v1.0.0`](https://static.api.apiture.com/errors/insufficientFundsForTransfer/v1.0.0)<br>
          The source account has insufficient funds.
          Remediation: Reduce the transfer amount to less than the available balance.

        * [`https://static.api.apiture.com/errors/invalidTransferSchedule/v1.0.0`](https://static.api.apiture.com/errors/invalidTransferSchedule/v1.0.0)<br>
          The transfer schedule is invalid.
          Remediation: Choose a date that is not in the past or past the cutoff time.
      x-apiture-errors:
        - invalidSourceAccountId
        - invalidTargetAccountId
        - externalToExternalTransferNotAllowed
        - sameSourceAndTargetTransferAccounts
        - nonPositiveAmount
        - insufficientFundsForTransfer
        - invalidTransferSchedule
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
    4XX:
      description: Client Request Problem. The client request had a problem not listed under another specific 400-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/4XX
    5XX:
      description: Server Problem. The server encountered a problem not listed under another specific 500-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/5XX
  schemas:
    transferSchedule:
      x-apiture-version: 2.1.0
      title: Transfer Schedule (v2.1.0)
      description: |-
        The scheduled date when the transfer should be completed, the recurrence, if any, and other derived dates based on the scheduled date.

        For recurring transfer schedules, `endsOn`, `count`, and `amountLimit` are mutually exclusive.
      type: object
      required:
        - frequency
      properties:
        scheduledOn:
          description: The date the the customer scheduled the transfer to occur in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format.
          type: string
          format: date
          minLength: 10
          maxLength: 10
        recurrenceType:
          $ref: '#/components/schemas/transferRecurrenceType'
        frequency:
          $ref: '#/components/schemas/transferFrequency'
        endsOn:
          description: The optional date when the recurring transfer schedule ends, in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) date format. Subsequent recurring transfers may be scheduled up to and including this date, but not after. This property is ignored if `frequency` is `once`.
          type: string
          format: date
          minLength: 10
          maxLength: 10
        count:
          description: For recurring schedules (`frequency` is not `once`), this is the total number of transfers to make, including the first transfer. This property is ignored if `frequency` is `once`.
          type: integer
          format: int32
          default: 1
          minimum: 1
          maximum: 10000
        amountLimit:
          description: For recurring schedules (`frequency` is not `once`), this is the total dollar amount limit including the first transfer. No transfers are scheduled if they would exceed this amount. This property is ignored if `frequency` is `once`.
          $ref: '#/components/schemas/monetaryValue'
          example: '1000.00'
      examples:
        - scheduledOn: '2026-06-28'
          frequency: once
        - scheduledOn: '2023-08-01'
          frequency: monthly
          recurrenceType: fixed
          count: 9
    transferItemSchedule:
      x-apiture-version: 1.1.0
      title: Transfer Item Schedule (v1.1.0)
      description: 'A transfer''s schedule: when the transfer is scheduled, its recurrence properties, and derived credit and debit dates.'
      allOf:
        - $ref: '#/components/schemas/transferSchedule'
        - type: object
          properties:
            debitsOn:
              description: The effective date the transfer is scheduled to debit the source account, in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. This is derived from the `scheduledOn` date, based on the financial institution's transfer rules.
              type: string
              format: date
              minLength: 10
              maxLength: 10
              readOnly: true
            creditsOn:
              description: The effective the transfer is scheduled to credit the target account, in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. This is derived from the `scheduledOn` date, based on the financial institution's transfer rules.
              format: date
              type: string
              minLength: 10
              maxLength: 10
              readOnly: true
      examples:
        - scheduledOn: '2026-06-28'
          creditsOn: '2026-06-26'
          debitsOn: '2026-06-24'
          frequency: once
        - scheduledOn: '2023-08-01'
          frequency: monthly
          recurrenceType: fixed
          count: 9
          creditsOn: '2023-08-01'
          debitsOn: '2026-08-01'
    transferAccountReference:
      x-apiture-version: 3.0.0
      title: Transfer Account Reference (v3.0.0)
      description: A reference to a banking account used within an account to account transfer. This object may be set from an account's `account.reference` object.
      type: object
      required:
        - id
      properties:
        id:
          description: The unique ID of a banking account.
          $ref: '#/components/schemas/resourceId'
        label:
          $ref: '#/components/schemas/accountLabel'
        type:
          description: The product type of the account.
          $ref: '#/components/schemas/productType'
        location:
          description: Indicates where an account is held.
          $ref: '#/components/schemas/accountLocation'
      example:
        id: e821ce54-c715
        label: Premiere Checking *6789
        type: checking
        location: internal
    transferFields:
      x-apiture-version: 4.0.0
      title: Transfer Fields (v4.0.0)
      description: Common fields of the transfer resource used to build other model schemas.
      type: object
      x-apiture-fragment: true
      properties:
        amount:
          description: The amount of money to transfer between accounts.
          $ref: '#/components/schemas/monetaryValue'
        sourceAccount:
          description: The source account where the funds are withdrawn.
          $ref: '#/components/schemas/transferAccountReference'
        targetAccount:
          description: The target account where the funds are deposited.
          $ref: '#/components/schemas/transferAccountReference'
        memo:
          description: A customer-defined memo to describe the transfer.
          type: string
          maxLength: 128
          format: text
    newTransfer:
      x-apiture-version: 4.0.0
      title: New Transfer (v4.0.0)
      description: Representation used to create a new transfer.
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/transferFields'
        - type: object
          properties:
            schedule:
              description: When the transfer should occur and any recurrence.
              $ref: '#/components/schemas/transferSchedule'
      required:
        - schedule
        - amount
        - sourceAccount
        - targetAccount
      example:
        amount: '275.00'
        memo: Cover check for car repair
        sourceAccount:
          id: bd9b7af2-6f9b
          location: internal
        targetAccount:
          id: 88b1ca3e-d0f3
          location: internal
        schedule:
          scheduledOn: '2022-06-28'
          frequency: once
    transferPatch:
      x-apiture-version: 4.0.0
      title: Transfer Patch Request (v4.0.0)
      description: Representation used to patch an existing transfer using the [JSON Merge Patch](https://datatracker.ietf.org/doc/html/rfc7396) format and processing rules.
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/transferFields'
        - type: object
          properties:
            schedule:
              description: When the transfer should occur and any recurrence.
              x-apiture-todo: We should probably define transferSchedulePatch schema for this
              $ref: '#/components/schemas/transferSchedule'
      example:
        amount: '275.00'
        targetAccount:
          id: 88b1ca3e-d0f3
        schedule:
          scheduledOn: '2022-06-28'
          frequency: once
    transferState:
      x-apiture-version: 2.0.0
      title: Transfer State (v2.0.0)
      description: |+
        The state of a transfer resource.

        <strong><code>transferState</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>unscheduled</code></strong></td><td>Unscheduled: <p>A transfer which is not ready to be queued for processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>pendingApproval</code></strong></td><td>Pending Approval: <p>A transfer which is awaiting approval before it can be queued for processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>scheduled</code></strong></td><td>Scheduled: <p>A transfer which has been queued for processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>processing</code></strong></td><td>Processing: <p>A transfer which is being processed</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>processed</code></strong></td><td>Processed: <p>A transfer which has completed processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>failed</code></strong></td><td>Failed: <p>A transfer which has cannot be processed or failed while processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>other</code></strong></td><td>Other: <p>A transfer which is in some other state</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: transferState
      enum:
        - unscheduled
        - pendingApproval
        - scheduled
        - processing
        - processed
        - failed
        - other
    transferItem:
      x-apiture-version: 5.0.0
      title: Transfer Item (v5.0.0)
      description: Summary representation of a transfer resource in transfers collections. To fetch the full representation of this transfer, use the [`getTransfer`](#op-getTransfer) operation, passing this item's `id` field as the `transferId` path parameter.
      allOf:
        - $ref: '#/components/schemas/transferFields'
        - $ref: '#/components/schemas/timestampFields'
        - type: object
          required:
            - id
            - schedule
            - amount
            - sourceAccount
            - targetAccount
            - state
          properties:
            id:
              description: The unique identifier for this transfer resource. This is an immutable opaque string.
              allOf:
                - $ref: '#/components/schemas/readOnlyResourceId'
            schedule:
              description: When the transfer should occur and any recurrence.
              $ref: '#/components/schemas/transferItemSchedule'
            state:
              description: The state of this transfer resource.
              allOf:
                - $ref: '#/components/schemas/transferState'
              readOnly: true
            processedAt:
              description: The date/time the transfer was processed.
              $ref: '#/components/schemas/readOnlyTimestamp'
            updatedBy:
              description: The full name of the banking customer who last updated the transfer.
              type: string
              format: text
              maxLength: 40
      example:
        id: f0de6bc7722f9cb8ab27
        state: scheduled
        amount: '275.00'
        sourceAccount:
          id: bd9b7af2-6f9b
        targetAccount:
          id: 88b1ca3e-d0f3
          label: Personal Savings *4567
          type: savings
        schedule:
          scheduledOn: '2026-06-28'
          frequency: once
          creditsOn: '2026-06-26'
          debitsOn: '2026-06-24'
        processedAt: '2026-06-26T21:00:00.000Z'
        updatedBy: James Bond
    transfer:
      x-apiture-version: 5.0.0
      title: Transfer (v5.0.0)
      description: Representation of a transfer resource.
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/transferItem'
      example:
        id: 0399abed-fd3d
        amount: '275.00'
        memo: Cover check for car repair
        state: scheduled
        sourceAccount:
          id: bd9b7af2-6f9b
          label: Premiere Checking *6789
          type: checking
          location: internal
        targetAccount:
          id: 88b1ca3e-d0f3
          label: Personal Savings *4567
          type: savings
          location: internal
        schedule:
          scheduledOn: '2026-06-28'
          frequency: once
          creditsOn: '2026-06-26'
          debitsOn: '2026-06-24'
    transfers:
      x-apiture-version: 5.0.0
      title: Transfer Collection (v5.0.0)
      description: Collection of transfers. The items in the collection are ordered in the `items` array. The response object may contain the `nextPage_url` pagination link..
      allOf:
        - $ref: '#/components/schemas/abstractPagedBody'
        - type: object
          required:
            - items
          properties:
            items:
              description: An array containing a page of transfer items.
              type: array
              maxItems: 1000
              items:
                $ref: '#/components/schemas/transferItem'
            count:
              description: The number of transfers that meet the filters in the `listTransfers` operation. This is optional and only included if the service can calculate it efficiently.
              type: integer
              format: int32
              minimum: 0
              maximum: 1000000
      example:
        start: d1b48af913464aa49fcb07065dcc0616
        limit: 10
        nextPage_url: https://static.api.apiture.com/transfers/transfers?start=6117a4dcefb841cab7316cef1ac8b58c&limit=10
        items:
          - id: 0399abed-fd3d
            amount: '275.00'
            memo: Cover check for car repair
            state: processed
            sourceAccount:
              id: bd9b7af2-6f9b
              label: Premiere Checking *6789
              type: checking
              location: internal
            targetAccount:
              id: 88b1ca3e-d0f3
              label: Personal Savings *4567
              type: savings
              location: internal
            schedule:
              scheduledOn: '2026-06-28'
              frequency: once
              creditsOn: '2026-06-26'
              debitsOn: '2026-06-24'
            processedAt: '2022-06-28T21:00:00.000Z'
          - id: d62c0701-0d74
            amount: '100.00'
            state: scheduled
            memo: school expenses
            sourceAccount:
              id: bd9b7af2-6f9b
              label: Checking *6789
              type: checking
              location: internal
            targetAccount:
              id: c8396f59-624b
              label: Checking *3456
              type: checking
              location: internal
            schedule:
              scheduledOn: '2023-08-01'
              frequency: monthly
              recurrenceType: fixed
              count: 9
              creditsOn: '2023-08-01'
              debitsOn: '2026-08-01'
    dateRange:
      title: Date Range (v1.0.0)
      description: 'A date range, supporting inclusive or exclusive endpoints. Dates ranges use dates expressed in `YYYY-MM-DD` [RFC 3339](https://tools.ietf.org/html/rfc3339) `date` format. The value may have the following forms: <ul> <li>`YYYY-MM-DD` match the date exactly; equivalent to matching dates in the range `[YYYY-MM-DD,YYYY-MM-DD]`</li> <li>`[YYYY-MM-DD,YYYY-MM-DD]` between two dates, inclusive of the endpoints</li> <li>`(YYYY-MM-DD,YYYY-MM-DD)` between two dates, exclusive of the endpoints</li> <li>`[YYYY-MM-DD,]` on or after the date</li> <li>`(YYYY-MM-DD,)` after the date</li> <li>`[,YYYY-MM-DD]` before or on the date</li> <li>`(,YYYY-MM-DD)` before the date</li> </ul>'
      type: string
      maxLength: 24
      pattern: ^\d{4}-\d{2}-\d{2}|([[(](\d{4}-\d{2}-\d{2},(\d{4}-\d{2}-\d{2})?|,\d{4}-\d{2}-\d{2})[)\]])$
      examples:
        - '2022-05-19'
        - '[2022-05-01,2022-05-31]'
        - '[2022-05-01,2022-06-01)'
        - '[2022-05-19,]'
        - (2022-05-19,)
        - '[,2022-05-19]'
        - (,2022-05-19)
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/dateRange
      x-apiture-version: 1.0.0
    problemResponse:
      title: Problem Response (v0.4.1)
      x-apiture-version: 0.4.1
      description: API problem or error response, as per [RFC 9457 application/problem+json](https://tools.ietf.org/html/rfc9457).
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/apiProblem'
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/noSuchAccount/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists for the given account reference
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/problemResponse
    resourceId:
      x-apiture-version: 1.0.1
      title: Resource Identifier (v1.0.1)
      description: The unique, opaque system identifier for a resource. This case-sensitive ID is also used as path parameters in URLs or in other properties or parameters that reference a resource by ID rather than URL.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/resourceId
    challengeToken:
      x-apiture-version: 1.1.0
      title: Challenge Token (v1.1.0)
      description: The value of the identity `Challenge` request header that the client must send when retrying an operation which required a challenge.
      type: string
      pattern: ^[-_:.~%$a-zA-Z0-9]{6,255}$
      minLength: 6
      maxLength: 255
      x-resolved-from: ../../challenges/openapi.yaml#/components/schemas/challengeToken
    transferRecurrenceType:
      title: Transfer Recurrence Type (v1.0.0)
      description: |+
        Describes whether the transfer amount in the transfer varies or is fixed when the transfer recurs. This is ignored if the transfer frequency is `once`.

        <strong><code>transferRecurrenceType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>fixed</code></strong></td><td>Fixed: <p>The transfer amounts are the same each time a transfer recurs</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>variable</code></strong></td><td>Variable: <p>The transfer amounts vary and must be entered/verified each time a transfer recurs</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: transferRecurrenceType
      enum:
        - fixed
        - variable
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/transferRecurrenceType
      x-apiture-version: 1.0.0
    transferFrequency:
      title: Transfer Frequency (v1.0.0)
      description: |+
        For recurring transfers, the interval at which the money movement recurs.

        <strong><code>transferFrequency</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>once</code></strong></td><td>Once: <p>Transfer does not repeat</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>occasional</code></strong></td><td>Occasional: <p>Transfer recurs but without a new scheduled date</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>daily</code></strong></td><td>Daily: <p>Repeat daily on business days</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>weekly</code></strong></td><td>Weekly: <p>Repeat weekly</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>biweekly</code></strong></td><td>biweekly: <p>Repeat every two weeks (26 times a year)</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>semimonthly</code></strong></td><td>Semimonthly: <p>Repeat twice a month (24 times a year)</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>monthly</code></strong></td><td>Monthly: <p>Repeat monthly</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>monthlyFirstDay</code></strong></td><td>Monthly First Day: <p>Repeat on the first business day of the month</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>monthlyLastDay</code></strong></td><td>Monthly Last Day: <p>Repeat on the last business day of the month</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>bimonthly</code></strong></td><td>Bimonthly: <p>Repeat every other month</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>quarterly</code></strong></td><td>Quarterly: <p>Repeat quarterly (four times a year)</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>semiyearly</code></strong></td><td>Semiyearly: <p>Repeat every six months (twice a year)</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>yearly</code></strong></td><td>Yearly: <p>Repeat once every year</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: transferFrequency
      enum:
        - once
        - occasional
        - daily
        - weekly
        - biweekly
        - semimonthly
        - monthly
        - monthlyFirstDay
        - monthlyLastDay
        - bimonthly
        - quarterly
        - semiyearly
        - yearly
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/transferFrequency
      x-apiture-version: 1.0.0
    monetaryValue:
      x-apiture-version: 1.1.1
      title: Monetary Value (v1.1.1)
      description: The monetary value, supporting only positive amounts. The numeric value is  represented as a string so that it can be exact with no loss of precision.
      example: '3456.78'
      format: decimal
      type: string
      pattern: ^(0|[1-9][0-9]*)\.[0-9][0-9]$
      maxLength: 16
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/monetaryValue
    accountLabel:
      title: Account Label (v1.0.0)
      description: The human-readable label for this account. This is either the `nickname` (if assigned for the current customer), or the `product.label` concatenated with the `maskedNumber`.
      type: string
      minLength: 1
      maxLength: 80
      format: text
      example: Checking *1008
      x-resolved-from: ../../accounts/openapi.yaml#/components/schemas/accountLabel
      x-apiture-version: 1.0.0
    productType:
      x-apiture-version: 2.1.0
      title: Product Type (v2.1.0)
      description: |+
        The type (or category) of banking product.

        <strong><code>productType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>savings</code></strong></td><td>Savings: <p>Savings Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>checking</code></strong></td><td>Checking: <p>Checking Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>cd</code></strong></td><td>CD: <p>Certificate of Deposit Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>ira</code></strong></td><td>IRA: <p>Individual Retirement Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>loan</code></strong></td><td>Loan: <p>Loan Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>creditCard</code></strong></td><td>Credit Card: <p>Credit Card Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>moneyMarket</code></strong></td><td>Money Market: <p>Money Market Account</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: productType
      enum:
        - savings
        - checking
        - cd
        - ira
        - loan
        - creditCard
        - moneyMarket
      x-resolved-from: ../../products/openapi.yaml#/components/schemas/productType
    accountLocation:
      x-apiture-version: 1.1.0
      title: Account Location (v1.1.0)
      description: |+
        Indicates where an account is held

        <strong><code>accountLocation</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>internal</code></strong></td><td>Internal: <p>Accounts held by the banking customer at the current financial institution</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>external</code></strong></td><td>External: <p>Accounts held by the banking customer at another financial institution</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>outside</code></strong></td><td>Outside: <p>Non-banking accounts such as brokerage and fund accounts.</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>peer</code></strong></td><td>Peer: <p>Accounts held by others at the same financial institution, for which the banking customer has transfer to and/or transfer from entitlements.</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: accountLocation
      enum:
        - internal
        - external
        - outside
        - peer
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/accountLocation
    abstractBody:
      title: Abstract Body (v0.2.0)
      x-apiture-version: 0.2.0
      description: An abstract schema used to define other request and response body model schemas.
      x-apiture-fragment: true
      type: object
      properties: {}
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractBody
    timestampFields:
      x-apiture-version: 1.1.0
      title: Timestamp Fields (v1.1.0)
      description: Timestamps which describe when a resource was created or last updated.
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/createdAtField'
        - type: object
          properties:
            updatedAt:
              description: The date-time when the resource was last updated, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
              $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/timestampFields
    readOnlyResourceId:
      x-apiture-version: 1.0.1
      title: Read-only Resource Identifier (v1.0.1)
      description: The unique, opaque system-assigned identifier for a resource. This case-sensitive ID is also used in URLs as path parameters or in other properties or parameters that reference a resource by ID rather than URL. Resource IDs are immutable.
      readOnly: true
      allOf:
        - $ref: '#/components/schemas/resourceId'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyResourceId
    readOnlyTimestamp:
      title: Read-Only Timestamp (v1.0.0)
      description: 'A readonly or derived timestamp (an instant in time) formatted in [RFC 3339](https://tools.ietf.org/html/rfc3339) `date-time` UTC format: `YYYY-MM-DDThh:mm:ss.sssZ`.'
      type: string
      minLength: 20
      maxLength: 30
      format: date-time
      readOnly: true
      example: '2021-10-30T19:06:04.250Z'
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyTimestamp
      x-apiture-version: 1.0.0
    abstractPagedBody:
      title: Abstract Paged Body (v0.5.1)
      x-apiture-version: 0.5.1
      description: An abstract schema used to define paginated collections of resources. Collection classes which extend this schema define an array of `items` which represent a page of data.
      x-apiture-fragment: true
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/abstractPagedBodyFields'
        - type: object
          properties:
            start:
              description: The opaque cursor that specifies the starting location of this page of items.
              type: string
              format: text
              maxLength: 256
      example:
        start: 1922a8531e8384cfa71b
        limit: 100
        nextPage_url: https://static.api.apiture.com/banking/resources?start=8b76b4a97dccad88890e&limit=100
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractPagedBody
    apiProblem:
      x-apiture-version: 1.2.1
      title: API Problem (v1.2.1)
      description: API problem or error, as per [RFC 7807 application/problem+json](https://tools.ietf.org/html/rfc7807).
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: |
            A [URI reference (RFC3986)](https://tools.ietf.org/html/rfc3986) that identifies the problem type. If present, this is the URL of human-readable HTML documentation for the problem type. When this member is not present, its value is assumed to be `"about:blank"`.
          example: https://static.api.apiture.com/errors/forbidden/v1.0.0
          maxLength: 2048
        title:
          type: string
          description: |
            A short, human-readable summary of the problem type. The title is usually the same for all problem with the same `type`.
          maxLength: 120
          format: text
          example: User is not authorized to perform the requested action or access the requested resource.
        status:
          type: integer
          format: int32
          description: |
            The [HTTP status code](https://datatracker.ietf.org/doc/html/rfc7231#section-6) for this occurrence of the problem.
          minimum: 100
          maximum: 599
          example: 403
        detail:
          type: string
          description: |
            A human-readable explanation specific to this occurrence of the problem.
          maxLength: 256
          format: text
          example: User is not authorized to perform this operation.
        instance:
          type: string
          format: uri-reference
          description: |
            A URI reference that identifies the specific occurrence of the problem. This is the URI of an API resource that the problem is related to, with a unique error correlation ID URI fragment
          example: https://prduction.api.apiture.com/banking/accounts/ad80fc3e722q5402a#189c13ff-c54c-45f7-b8e0-c88984ba724d
          maxLength: 2048
        id:
          description: The unique identifier for this problem. This is an immutable opaque string.
          $ref: '#/components/schemas/readOnlyResourceId'
        occurredAt:
          description: The timestamp when the problem occurred, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC.
          $ref: '#/components/schemas/readOnlyTimestamp'
        problems:
          description: Optional root-causes if there are multiple problems in the request or API call processing.
          type: array
          maxItems: 128
          items:
            $ref: '#/components/schemas/apiProblem'
        attributes:
          type: object
          description: Additional optional attributes related to the problem. This data conforms to the schema associated with the error type.
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/accountNotFound/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists at the given account_url
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/apiProblem
    requiredIdentityChallenge:
      x-apiture-version: 1.2.3
      title: Required Challenge (v1.2.3)
      description: A request from the service for the user to verify their identity. This contains a challenge ID, the corresponding operation ID, and a list of challenge factors for identity verification. The user must complete one of these challenge factors to satisfy the challenge. This schema defines the attributes in the 401 [Unauthorized problem response](#schema-apiProblem) when the 401 problem type name is `challengeRequired`. See the "Challenge API" for details.
      type: object
      required:
        - operationId
        - challengeId
        - factors
      properties:
        operationId:
          $ref: '#/components/schemas/challengeOperationId'
        challengeId:
          description: The unique ID of this challenge instance. This is an opaque string. This is passed when starting a challenge factor or when validating the identity challenge responses.
          $ref: '#/components/schemas/readOnlyResourceId'
        factors:
          description: 'A list of challenge factors. The user must complete one of these challenge factors. The `labels` in each factor identify one or more channels the user may use, such as a list of email addresses the system may use to send a one-time passcode to the user. ***Note**: The same channel may be used by multiple factors in the array of factors. For example, the user''s primary mobile phone number may be used for both an `sms` factor and a `voice` factor.'
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeFactor'
      example:
        operationId: createTransfer
        challengeId: 0504076c566a3cf7009c
        factors:
          - type: sms
            labels:
              - '9876'
            id: 85c0ee5753fcd0b0953f
          - type: voice
            labels:
              - '9876'
            id: d089e10a80a8627df37b
          - type: voice
            labels:
              - '6754'
            id: 10506ecf9d1c2ee00403
          - type: email
            labels:
              - an****nk@example.com
              - an****98@example.com
            id: e917d671cb2f030b56f1
          - type: authenticatorToken
            labels:
              - Acme fob
            id: fe6c452d7da0bbb4e407
          - type: securityQuestions
            securityQuestions:
              questions:
                - id: q1
                  prompt: What is your mother's maiden name?
                - id: q4
                  prompt: What is your high school's name?
                - id: q9
                  prompt: What is the name of your first pet?
            id: df33c6f88a37d6b3f0a6
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/requiredIdentityChallenge
    createdAtField:
      description: A field used to represent the `createdAt` date-time for a resource.
      x-apiture-fragment: true
      type: object
      properties:
        createdAt:
          description: The date-time when this resource was created, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
          $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/createdAtField
      x-apiture-version: 1.0.0
      title: ' (v1.0.0)'
    abstractPagedBodyFields:
      x-apiture-version: 1.1.1
      title: Abstract Paged Body Fields (v1.1.1)
      description: Common properties of collection page responses.
      x-apiture-fragment: true
      type: object
      required:
        - limit
      properties:
        limit:
          description: The number of items requested for this page response. The length of the `items` array may be less that `limit`.
          type: integer
          format: int32
          minimum: 0
          maximum: 10000
        nextPage_url:
          description: The URL of the next page of resources. If this URL is omitted, there are no more resources in the collection.
          readOnly: true
          maxLength: 8000
          type: string
          format: uri-reference
          example: https://static.api.apiture.com/banking/resources/8b76b4a97dccad88890e
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractPagedBodyFields
    challengeOperationId:
      x-apiture-version: 1.0.1
      title: Challenge Operation ID (v1.0.1)
      description: The ID of an operation/action for which the user must verify their identity via an identity challenge. This is passed when starting a challenge factor or when validating the identity challenge responses.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeOperationId
    challengeFactor:
      x-apiture-version: 1.2.1
      title: Challenge Factor (v1.2.1)
      description: A challenge factor. See [`requiredIdentityChallenge`](#schema-requiredIdentityChallenge) for multiple examples.
      type: object
      required:
        - type
      properties:
        id:
          description: |-
            The ID of an a challenge factor. This ID is unique within the challenge factors associated with a challenge. The client should pass this `id` value as the `factorId` when starting or verifying a challenge factor.

            *Note*: The `id` will become `required` in a future update to this schema.
          $ref: '#/components/schemas/challengeFactorId'
        type:
          $ref: '#/components/schemas/challengeFactorType'
        labels:
          description: A list of text label which identifies the channel(s) through which the user completes the challenge. For an `sms` or `voice` challenge, the only label item is the last four digits of the corresponding phone number. For an `email` challenge, each label is the masked email address.
          type: array
          minItems: 1
          maxItems: 4
          items:
            type: string
            maxLength: 300
            format: text
        securityQuestions:
          $ref: '#/components/schemas/challengeSecurityQuestions'
      example:
        type: sms
        labels:
          - '9876'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactor
    challengeFactorId:
      title: Challenge Factor ID (v1.0.0)
      description: The ID of an a challenge factor. This ID is unique within the factors offered with a challenge.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{3,48}$
      minLength: 3
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorId
      x-apiture-version: 1.0.0
    challengeFactorType:
      title: Challenge Factor Type (v1.0.0)
      description: |+
        The name of challenge factor.

        <strong><code>challengeFactorType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>sms</code></strong></td><td>SMS: <p>One-time passcode sent to the primary mobile phone number</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>email</code></strong></td><td>Email: <p>One-time passcode sent to the primary email address</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>voice</code></strong></td><td>Voice: <p>One-time passcode communicated via automated voice phone call</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>authenticatorToken</code></strong></td><td>authenticator Token: <p>One-time passcode issued by a pre-registered hardware device, such as a token key fob, or an authenticator app</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>securityQuestions</code></strong></td><td>Security Questions: <p>Prompt with the user&#39;s security questions registered with their security profile</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: challengeFactorType
      enum:
        - sms
        - email
        - voice
        - securityQuestions
        - authenticatorToken
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorType
      x-apiture-version: 1.0.0
    challengeSecurityQuestions:
      x-apiture-version: 1.0.1
      title: Challenge Security Questions (v1.0.1)
      description: Describes a `securityQuestions` challenge. This is omitted if the challenge `type` is not `securityQuestions`.
      type: object
      required:
        - questions
      properties:
        questions:
          description: The array of security questions.
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeSecurityQuestion'
      example:
        questions:
          - id: q1
            prompt: What is your mother's maiden name?
          - id: q4
            prompt: What is your high school's name?
          - id: q9
            prompt: What is the name of your first pet?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestions
    challengeSecurityQuestion:
      x-apiture-version: 1.0.1
      title: Challenge Security Question (v1.0.1)
      description: A single security question within the `questions` array of the [`challengeSecurityQuestions`](#schema-challengeSecurityQuestions)
      type: object
      required:
        - id
        - prompt
      properties:
        id:
          description: The unique ID of security question prompt. This should be included in the [`challengeVerification`](#schema-challengeVerification) response as the `promptId`.
          $ref: '#/components/schemas/challengePromptId'
        prompt:
          description: The text prompt of this security question.
          type: string
          format: text
          maxLength: 80
      example:
        id: 74699fa628911e762ea5
        prompt: What is your mother's maiden name?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestion
    challengePromptId:
      title: Challenge Prompt ID (v1.0.0)
      description: The unique ID of a prompt (such as a security question) in a challenge factor.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]+$
      minLength: 1
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengePromptId
      x-apiture-version: 1.0.0
  x-apiture-errors:
    cannotTransferFrom:
      description: The customer does not have `transferFrom` entitlement on the source account.
      remediation: Choose a source account that allows transfers from it.
    cannotTransferTo:
      description: The customer does not have `transferTo` entitlement on the target account.
      remediation: Choose a target account that allows transfers to it.
    invalidSourceAccountId:
      description: The named `sourceAccountId` does not exist or the user is not entitled to access the account.
      remediation: Pass the `id` of an existing account the caller has access to.
    invalidTargetAccountId:
      description: The named `targetAccountId` does not exist or the user is not entitled to access the account.
      remediation: Pass the `id` of an existing account the caller has access to.
    sameSourceAndTargetTransferAccounts:
      description: The source and target account are the same.
      remediation: Choose different source and target accounts.
    externalToExternalTransferNotAllowed:
      description: Transfers from an external account to another external is not allowed.
      remediation: At least one of the source or target accounts must be an internal account held at the financial institution.
    nonPositiveAmount:
      description: The transfer amount may not be 0.00.
      remediation: Set the transfer amount to a positive number.
    insufficientFundsForTransfer:
      description: The source account has insufficient funds.
      remediation: Reduce the transfer amount to less than the available balance.
    invalidTransferSchedule:
      description: The transfer schedule is invalid.
      remediation: Choose a date that is not in the past or past the cutoff time.
    cannotDeleteProcessedTransfers:
      description: The delete operation is only allowed for transfers which have not begun processing.
      remediation: Select a pending or scheduled transfer.
    badRequest:
      description: The request body and/or parameters was not well-formed.
      remediation: Correct any syntax or schema errors in the request body or parameters.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/badRequest
    unauthorized:
      description: The request lacks valid authentication credentials for the target resource or operation.
      remediation: Authenticate the user and pass the required authorization with the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unauthorized
    forbidden:
      description: The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
      remediation: Check the user's permissions and entitlements before attempting the operation.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/forbidden
    customerDisabled:
      description: The customer is disabled.
      remediation: Have the customer contact the financial institution for support.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/customerDisabled
    antiMalwareRequired:
      description: The financial institution requires the customer to have anti-malware software installed.
      remediation: Direct the user to the software requirements guide to install the correct anti-malware software.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/antiMalwareRequired
    modificationForbidden:
      description: The customer is properly authenticated but not authorized to create, modify, or delete resources.
      remediation: Avoid modification operation for customers with read-only authorization.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/modificationForbidden
    challengeRequired:
      description: The operation requires the customer to complete an identity challenge.
      remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
      attributes:
        $ref: '#/components/schemas/requiredIdentityChallenge'
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeRequired
    challengeBlocked:
      description: The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
      remediation: Have the user end their login session and login again.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeBlocked
    noIdentityChallengeFactors:
      description: This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
      remediation: Have the user register one or more challenge security code delivery factors.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/noIdentityChallengeFactors
    invalidIdentityChallengeHeader:
      description: The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
      remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/invalidIdentityChallengeHeader
    tooManyRequests:
      description: The client has sent too many requests in a given amount of time, exceeding rate limiting.
      remediation: Slow down the rate of API calls.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/tooManyRequests
x-apiture-traits:
  - resource:
      name: transfer
      applied: true
  - security:
      applied: true
x-resolved-from: ../../transfers/status-codes-openapi.yaml
x-resolved-at: '2024-10-01T15:43:43.857Z'
x-apiture-annotated-at: '2024-10-01T15:43:44.109Z'
