openapi: 3.1.0
info:
  title: System Core Adapter
  description: This API provides an integration as an adapter into a subset of banking core operations.
  version: 0.1.2
  contact:
    name: Apiture
    url: https://developer.apiture.com/help/support/
    email: api@apiture.com
  termsOfService: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
  license:
    name: Apiture API License
    url: https://developer.apiture.com/docs/Apiture-API-License-Agreement.pdf
x-apiture-namespace: systemCoreAdapter
x-apiture-package-name: system-coreAdapter
servers:
  - url: /system
tags:
  - name: Transfers
    description: Banking Core Transfers
  - name: Accounts
    description: Banking Core Accounts
paths:
  /cores/account/find:
    post:
      summary: Find an account within the banking core.
      operationId: findAccount
      x-apiture-api: systemCoreAdapter
      description: |-
        Retrieve the details of a single account based on account number, core type and product type.
        This operation uses the POST over GET pattern for security purposes.
      tags:
        - Accounts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/internalAccountReference'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/coreAccount'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - clientCredentials:
            - banking/read
  /cores/transfers:
    post:
      summary: Create a transfer between accounts.
      operationId: createTransfer
      x-apiture-api: systemCoreAdapter
      description: Create an account to account transfer in the banking core.
      tags:
        - Transfers
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/newTransfer'
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/transfer'
        '400':
          $ref: '#/components/responses/400'
        '401':
          $ref: '#/components/responses/401'
        '403':
          $ref: '#/components/responses/403'
        '422':
          $ref: '#/components/responses/422'
        '429':
          $ref: '#/components/responses/429'
        4XX:
          $ref: '#/components/responses/4XX'
        5XX:
          $ref: '#/components/responses/5XX'
      security:
        - clientCredentials:
            - moneyMovement/write
components:
  schemas:
    coreAccountReferenceFields:
      title: Core Account Reference Fields (v1.0.0)
      description: Fields used to compose core account reference schemas.
      x-apiture-fragment: true
      type: object
      properties:
        accountNumber:
          description: The full account number of the account.
          $ref: '#/components/schemas/fullAccountNumber'
        coreType:
          $ref: '#/components/schemas/coreAccountType'
        productType:
          $ref: '#/components/schemas/productType'
      x-apiture-version: 1.0.0
    internalAccountReference:
      title: Internal Account Reference (v1.0.0)
      description: Data needed to retrieve an internal account from the banking core.
      type: object
      required:
        - accountNumber
        - coreType
        - productType
      allOf:
        - $ref: '#/components/schemas/coreAccountReferenceFields'
      x-apiture-version: 1.0.0
    accountReference:
      title: Account Reference (v1.0.0)
      description: Data needed to retrieve an account. Internal accounts to the banking core require `coreType` and `productType`. External accounts require `routingNumber`.
      type: object
      required:
        - accountNumber
      allOf:
        - $ref: '#/components/schemas/coreAccountReferenceFields'
        - type: object
          properties:
            routingNumber:
              $ref: '#/components/schemas/accountRoutingNumber'
      x-apiture-version: 1.0.0
    coreAccountType:
      title: Core Account Type (v1.0.0)
      description: The account product type in the banking core. For example, some cores may use `"D"` for a demand deposit (checking) account, some may use `"DDA"`.
      type: string
      pattern: ^[A-Z0-9]{1,4}$
      minLength: 1
      maxLength: 4
      x-apiture-version: 1.0.0
    coreAccountDetailFields:
      title: Core Account Detail Fields (v1.0.0)
      type: object
      x-apiture-fragment: true
      properties:
        accountNumber:
          $ref: '#/components/schemas/fullAccountNumber'
        routingNumber:
          $ref: '#/components/schemas/accountRoutingNumber'
        location:
          $ref: '#/components/schemas/bankingAccountLocation'
      x-apiture-version: 1.0.0
    coreProduct:
      title: Core Product (v1.0.0)
      description: Product properties for an internal account.
      required:
        - type
        - coreType
        - code
      allOf:
        - $ref: '#/components/schemas/bankingProductFields'
      x-apiture-version: 1.0.0
    loanAccount:
      title: Loan Account (v1.0.0)
      description: Properties specific to loan accounts.
      type: object
      properties:
        creditLimit:
          description: The maximum credit allowed for loan advances against this loan account. Use `availableCredit` to determine the amount that is able to be used.
          allOf:
            - $ref: '#/components/schemas/monetaryValue'
        availableCredit:
          description: |-
            The amount of money available for a loan advance.

            This is calculated by subtracting any outstanding balances from the credit limit.
          allOf:
            - $ref: '#/components/schemas/monetaryValue'
      x-apiture-version: 1.0.0
    coreAccount:
      title: Core Account (v1.0.0)
      description: Representation of a banking account within the core.
      required:
        - accountHolder
        - accountNumber
        - location
        - product
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/coreAccountDetailFields'
        - type: object
          properties:
            accountHolder:
              description: The name of the account holder for this account.
              type: string
              format: text
              maxLength: 120
            nickname:
              description: A nickname for this account.
              allOf:
                - $ref: '#/components/schemas/accountNickname'
            availableBalance:
              description: The available balance of the account, if known. This is the string representation of the exact decimal amount. This value may be omitted if the system is unable to obtain it.
              allOf:
                - $ref: '#/components/schemas/creditOrDebitValue'
            currentBalance:
              description: The current balance of the account, if known. The current balance includes any pending payments or deposits that have not been settled. This is the string representation of the exact decimal amount. This value may be omitted if the system is unable to obtain it.
              allOf:
                - $ref: '#/components/schemas/creditOrDebitValue'
            loan:
              description: |-
                Properties of the account specific to loans.

                This is only included for accounts with a product type of `loan`.
              allOf:
                - $ref: '#/components/schemas/loanAccount'
            product:
              description: Product details for this account.
              $ref: '#/components/schemas/coreProduct'
      example:
        accountHolder: Phil Duciary
        nickname: Credit Card Consolidation 9/23
        accountNumber: '123456789'
        routingNumber: '123123123'
        location: internal
        availableBalance: '-2233.00'
        currentBalance: '-2233.00'
        loan:
          creditLimit: '2000.00'
          availableCredit: '1867.00'
        product:
          customerType: personal
          type: loan
          coreType: LN
          code: 24M_LN
          label: 24 Month Loan
          description: 24 Month Loan account
      x-apiture-version: 1.0.0
    transferFields:
      title: Transfer Fields (v1.0.0)
      description: Fields used to compose transfer schemas.
      x-apiture-fragment: true
      type: object
      properties:
        amount:
          description: The amount of money to transfer between accounts.
          $ref: '#/components/schemas/monetaryValue'
        type:
          $ref: '#/components/schemas/transferType'
      x-apiture-version: 1.0.0
    immutableTransferFields:
      title: Immutable Transfer Fields (v1.0.0)
      description: Immutable fields used to compose transfer schemas.
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/timestampFields'
        - type: object
          properties:
            state:
              $ref: '#/components/schemas/transferState'
            sourceAccount:
              description: |-
                The funding account for this transfer.

                This must be an account with a `location` of `internal`.
              allOf:
                - $ref: '#/components/schemas/coreAccountDetailFields'
            targetAccount:
              description: The destination account for this transfer.
              allOf:
                - $ref: '#/components/schemas/coreAccountDetailFields'
      x-apiture-version: 1.0.0
    transferState:
      title: Transfer State (v1.0.0)
      description: |+
        The state of a transfer resource.

        <strong><code>transferState</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>submitted</code></strong></td><td>Submitted: <p>A transfer which has been queued for processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>processing</code></strong></td><td>Processing: <p>A transfer which is being processed</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>processed</code></strong></td><td>Processed: <p>A transfer which has completed processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>failed</code></strong></td><td>Failed: <p>A transfer which has cannot be processed or failed while processing</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>other</code></strong></td><td>Other: <p>A transfer which is in some other state</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: coreTransferState
      enum:
        - submitted
        - processing
        - processed
        - failed
        - other
      x-apiture-version: 1.0.0
    transferType:
      title: Transfer Type (v1.0.0)
      description: |+
        The type of this transfer.

        <strong><code>transferType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>direct</code></strong></td><td>Direct: <p>A transfer between two accounts owned by the same customer</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>peer</code></strong></td><td>Peer: <p>A transfer between accounts owned by different customers in the same financial institution</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>loanPayment</code></strong></td><td>Loan Payment: <p>A transfer between a customer account and a loan account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>loanPayoff</code></strong></td><td>Loan Payoff: <p>A transfer to settle the remaining balance on a target loan account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>loanAdvance</code></strong></td><td>Loan Advance: <p>A transfer from a loan account to a customer account, funded through the credit limit</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: coreTransferType
      enum:
        - direct
        - peer
        - loanPayment
        - loanPayoff
        - loanAdvance
      x-apiture-version: 1.0.0
    newTransfer:
      title: New Transfer (v1.0.0)
      description: Data required to create a new transfer between accounts within the core.
      required:
        - amount
        - sourceAccount
        - targetAccount
        - type
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/transferFields'
        - type: object
          properties:
            sourceAccount:
              description: The source account where the funds are withdrawn.
              allOf:
                - $ref: '#/components/schemas/accountReference'
            targetAccount:
              description: The source account where the funds are deposited.
              allOf:
                - $ref: '#/components/schemas/accountReference'
      x-apiture-version: 1.0.0
    transfer:
      title: Transfer (v1.0.0)
      description: Representation of a transfer between accounts within the core.
      type: object
      required:
        - amount
        - sourceAccount
        - targetAccount
        - type
        - state
        - createdAt
        - updatedAt
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/transferFields'
        - $ref: '#/components/schemas/immutableTransferFields'
      x-apiture-version: 1.0.0
    fullAccountNumber:
      title: Full Account Number (v1.0.0)
      description: A full account number. This is the number that the customer uses to reference the account within the financial institution.
      type: string
      minLength: 1
      maxLength: 32
      pattern: ^[- a-zA-Z0-9.]{1,32}$
      examples:
        - '123456789'
      x-resolved-from: ../../accounts/openapi.yaml#/components/schemas/fullAccountNumber
      x-apiture-version: 1.0.0
    productType:
      x-apiture-version: 2.2.0
      title: Product Type (v2.2.0)
      description: |+
        The type (or category) of banking product.

        <strong><code>productType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>savings</code></strong></td><td>Savings: <p>Savings Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>checking</code></strong></td><td>Checking: <p>Checking Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>cd</code></strong></td><td>CD: <p>Certificate of Deposit Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>ira</code></strong></td><td>IRA: <p>Individual Retirement Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>loan</code></strong></td><td>Loan: <p>Loan Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>creditCard</code></strong></td><td>Credit Card: <p>Credit Card Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>moneyMarket</code></strong></td><td>Money Market: <p>Money Market Account</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>healthSavings</code></strong></td><td>Health Savings: <p>Health Savings Account</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: productType
      enum:
        - savings
        - checking
        - cd
        - ira
        - loan
        - creditCard
        - moneyMarket
        - healthSavings
      x-resolved-from: ../../products/openapi.yaml#/components/schemas/productType
    accountRoutingNumber:
      title: Account Routing Number (v1.0.0)
      description: An account ABA routing and transit number.
      type: string
      minLength: 9
      maxLength: 9
      pattern: ^[0-9]{9}$
      example: '123123123'
      x-resolved-from: ../../accounts/openapi.yaml#/components/schemas/accountRoutingNumber
      x-apiture-version: 1.0.0
    bankingAccountLocation:
      x-apiture-version: 1.1.0
      title: Banking Account Location (v1.1.0)
      description: |+
        Indicates where an account is held:
          * `internal` accounts at the current financial institution;
          * `external` accounts at another financial institution;

        <strong><code>bankingAccountLocation</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>internal</code></strong></td><td>Internal: <p>Accounts held by the banking customer at the current financial institution</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>external</code></strong></td><td>External: <p>Accounts held by the banking customer at another financial institution</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>peer</code></strong></td><td>Peer: <p>Accounts held by others at the same financial institution, for which the banking customer has transfer to and/or transfer from entitlements.</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: bankingAccountLocation
      enum:
        - internal
        - external
        - peer
      x-resolved-from: ../../adminAccounts/openapi.yaml#/components/schemas/bankingAccountLocation
    bankingProductFields:
      x-apiture-version: 1.3.0
      title: Banking Product Fields (v1.3.0)
      description: Common fields of the product resource used to build other model schemas.
      type: object
      allOf:
        - $ref: '#/components/schemas/productReference'
        - type: object
          properties:
            customerType:
              description: Describes the target audience or consumer of the accounts, `personal` or `business`. Labels and descriptions for the enumeration values are in the `productTarget` key in the response of the `getLabels` operation.
              $ref: '#/components/schemas/productCustomerType'
      x-resolved-from: ../../products/openapi.yaml#/components/schemas/bankingProductFields
    monetaryValue:
      x-apiture-version: 1.1.1
      title: Monetary Value (v1.1.1)
      description: The monetary value, supporting only positive amounts. The numeric value is  represented as a string so that it can be exact with no loss of precision.
      example: '3456.78'
      format: decimal
      type: string
      pattern: ^(0|[1-9][0-9]*)\.[0-9][0-9]$
      maxLength: 16
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/monetaryValue
    abstractBody:
      title: Abstract Body (v0.2.0)
      x-apiture-version: 0.2.0
      description: An abstract schema used to define other request and response body model schemas.
      x-apiture-fragment: true
      type: object
      properties: {}
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/abstractBody
    accountNickname:
      x-apiture-version: 1.2.0
      title: Account Nickname (v1.2.0)
      description: The nickname (friendly name) the customer has given this account. Each customer can define their own nickname for the same account. If omitted, the customer has not set a nickname.
      type: string
      maxLength: 50
      format: text
      example: Payroll Checking
      x-resolved-from: ../../accounts/openapi.yaml#/components/schemas/accountNickname
    creditOrDebitValue:
      x-apiture-version: 1.1.1
      title: Credit Or Debit Value (v1.1.1)
      description: The monetary value representing a credit (positive amounts with no prefix or a `+` prefix) or debit (negative amounts with a `-` prefix). The numeric value is  represented as a string so that it can be exact with no loss of precision.
      example: '3456.78'
      type: string
      format: decimal
      pattern: ^(-|\+)?(0|[1-9][0-9]*)\.[0-9][0-9]$
      maxLength: 16
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/creditOrDebitValue
    timestampFields:
      x-apiture-version: 1.1.0
      title: Timestamp Fields (v1.1.0)
      description: Timestamps which describe when a resource was created or last updated.
      x-apiture-fragment: true
      allOf:
        - $ref: '#/components/schemas/createdAtField'
        - type: object
          properties:
            updatedAt:
              description: The date-time when the resource was last updated, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
              $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/timestampFields
    problemResponse:
      title: Problem Response (v0.4.1)
      x-apiture-version: 0.4.1
      description: API problem or error response, as per [RFC 9457 application/problem+json](https://tools.ietf.org/html/rfc9457).
      type: object
      allOf:
        - $ref: '#/components/schemas/abstractBody'
        - $ref: '#/components/schemas/apiProblem'
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/noSuchAccount/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists for the given account reference
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/problemResponse
    productReference:
      title: Product Reference (v2.4.0)
      x-apiture-version: 2.4.0
      description: A reference to a banking product.
      type: object
      required:
        - type
        - coreType
        - code
        - label
      properties:
        type:
          description: The type of account.
          $ref: '#/components/schemas/productType'
        coreType:
          description: The account product type in the banking core. For example, some cores may use `"D"` for a demand deposit (checking) account, some may use `"DDA"`.
          type: string
          pattern: ^[A-Z0-9]{1,4}$
          minLength: 1
          maxLength: 4
        code:
          description: The product's product code which uniquely identifies the product from other banking products. Codes are unique to the financial institution. For example, different products with the same `type` and the same `coreType` but different rates or other properties have different product codes, such as `CD3M`, `DDA_HI_YLD`, `P3207`.
          type: string
          format: text
          minLength: 1
          maxLength: 16
          example: CD001
        label:
          description: A human-readable label for this banking product.
          type: string
          minLength: 2
          maxLength: 48
          format: text
        description:
          description: A human-readable description of this banking product.
          type: string
          minLength: 2
          maxLength: 400
          format: markdown
      example:
        type: cd
        coreType: CD
        code: 180D_CDA
        label: 180 Day CD
        description: Certificate of Deposit with a 180 day term
      x-resolved-from: ../../products/openapi.yaml#/components/schemas/productReference
    productCustomerType:
      title: Product Customer Type (v1.0.0)
      description: |+
        Indicates the type of customer that uses this banking product: personal (retail) or business (commercial).

        <strong><code>productCustomerType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>personal</code></strong></td><td>Personal: <p>Retail banking products for personal customers</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>business</code></strong></td><td>Business: <p>Commercial banking products for business customers</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>both</code></strong></td><td>Personal and Business: <p>Banking products for personal or business customers</p>
        </td>
            </tr>
        </table>

      type: string
      enum:
        - personal
        - business
        - both
      x-apiture-enum: productCustomerType
      x-resolved-from: ../../products/openapi.yaml#/components/schemas/productCustomerType
      x-apiture-version: 1.0.0
    createdAtField:
      description: A field used to represent the `createdAt` date-time for a resource.
      x-apiture-fragment: true
      type: object
      properties:
        createdAt:
          description: The date-time when this resource was created, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC. This is derived and immutable.
          $ref: '#/components/schemas/readOnlyTimestamp'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/createdAtField
      x-apiture-version: 1.0.0
      title: ' (v1.0.0)'
    readOnlyTimestamp:
      title: Read-Only Timestamp (v1.0.0)
      description: 'A readonly or derived timestamp (an instant in time) formatted in [RFC 3339](https://tools.ietf.org/html/rfc3339) `date-time` UTC format: `YYYY-MM-DDThh:mm:ss.sssZ`.'
      type: string
      minLength: 20
      maxLength: 30
      format: date-time
      readOnly: true
      example: '2021-10-30T19:06:04.250Z'
      x-apiture-since: 0.4.0
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyTimestamp
      x-apiture-version: 1.0.0
    apiProblem:
      x-apiture-version: 1.2.1
      title: API Problem (v1.2.1)
      description: API problem or error, as per [RFC 7807 application/problem+json](https://tools.ietf.org/html/rfc7807).
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: |
            A [URI reference (RFC3986)](https://tools.ietf.org/html/rfc3986) that identifies the problem type. If present, this is the URL of human-readable HTML documentation for the problem type. When this member is not present, its value is assumed to be `"about:blank"`.
          example: https://static.api.apiture.com/errors/forbidden/v1.0.0
          maxLength: 2048
        title:
          type: string
          description: |
            A short, human-readable summary of the problem type. The title is usually the same for all problem with the same `type`.
          maxLength: 120
          format: text
          example: User is not authorized to perform the requested action or access the requested resource.
        status:
          type: integer
          format: int32
          description: |
            The [HTTP status code](https://datatracker.ietf.org/doc/html/rfc7231#section-6) for this occurrence of the problem.
          minimum: 100
          maximum: 599
          example: 403
        detail:
          type: string
          description: |
            A human-readable explanation specific to this occurrence of the problem.
          maxLength: 256
          format: text
          example: User is not authorized to perform this operation.
        instance:
          type: string
          format: uri-reference
          description: |
            A URI reference that identifies the specific occurrence of the problem. This is the URI of an API resource that the problem is related to, with a unique error correlation ID URI fragment
          example: https://prduction.api.apiture.com/banking/accounts/ad80fc3e722q5402a#189c13ff-c54c-45f7-b8e0-c88984ba724d
          maxLength: 2048
        id:
          description: The unique identifier for this problem. This is an immutable opaque string.
          $ref: '#/components/schemas/readOnlyResourceId'
        occurredAt:
          description: The timestamp when the problem occurred, in [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time `YYYY-MM-DDThh:mm:ss.sssZ` format, UTC.
          $ref: '#/components/schemas/readOnlyTimestamp'
        problems:
          description: Optional root-causes if there are multiple problems in the request or API call processing.
          type: array
          maxItems: 128
          items:
            $ref: '#/components/schemas/apiProblem'
        attributes:
          type: object
          description: Additional optional attributes related to the problem. This data conforms to the schema associated with the error type.
      example:
        id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
        type: https://static.api.apiture.com/errors/accountNotFound/v1.0.0
        title: Account Not Found
        status: 422
        occurredAt: '2022-04-25T12:42:21.375Z'
        detail: No account exists at the given account_url
        instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/apiProblem
    requiredIdentityChallenge:
      x-apiture-version: 1.2.3
      title: Required Challenge (v1.2.3)
      description: A request from the service for the user to verify their identity. This contains a challenge ID, the corresponding operation ID, and a list of challenge factors for identity verification. The user must complete one of these challenge factors to satisfy the challenge. This schema defines the attributes in the 401 [Unauthorized problem response](#schema-apiProblem) when the 401 problem type name is `challengeRequired`. See the "Challenge API" for details.
      type: object
      required:
        - operationId
        - challengeId
        - factors
      properties:
        operationId:
          $ref: '#/components/schemas/challengeOperationId'
        challengeId:
          description: The unique ID of this challenge instance. This is an opaque string. This is passed when starting a challenge factor or when validating the identity challenge responses.
          $ref: '#/components/schemas/readOnlyResourceId'
        factors:
          description: 'A list of challenge factors. The user must complete one of these challenge factors. The `labels` in each factor identify one or more channels the user may use, such as a list of email addresses the system may use to send a one-time passcode to the user. ***Note**: The same channel may be used by multiple factors in the array of factors. For example, the user''s primary mobile phone number may be used for both an `sms` factor and a `voice` factor.'
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeFactor'
      example:
        operationId: createTransfer
        challengeId: 0504076c566a3cf7009c
        factors:
          - type: sms
            labels:
              - '9876'
            id: 85c0ee5753fcd0b0953f
          - type: voice
            labels:
              - '9876'
            id: d089e10a80a8627df37b
          - type: voice
            labels:
              - '6754'
            id: 10506ecf9d1c2ee00403
          - type: email
            labels:
              - an****nk@example.com
              - an****98@example.com
            id: e917d671cb2f030b56f1
          - type: authenticatorToken
            labels:
              - Acme fob
            id: fe6c452d7da0bbb4e407
          - type: securityQuestions
            securityQuestions:
              questions:
                - id: q1
                  prompt: What is your mother's maiden name?
                - id: q4
                  prompt: What is your high school's name?
                - id: q9
                  prompt: What is the name of your first pet?
            id: df33c6f88a37d6b3f0a6
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/requiredIdentityChallenge
    readOnlyResourceId:
      x-apiture-version: 1.0.1
      title: Read-only Resource Identifier (v1.0.1)
      description: The unique, opaque system-assigned identifier for a resource. This case-sensitive ID is also used in URLs as path parameters or in other properties or parameters that reference a resource by ID rather than URL. Resource IDs are immutable.
      readOnly: true
      allOf:
        - $ref: '#/components/schemas/resourceId'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/readOnlyResourceId
    challengeOperationId:
      x-apiture-version: 1.0.1
      title: Challenge Operation ID (v1.0.1)
      description: The ID of an operation/action for which the user must verify their identity via an identity challenge. This is passed when starting a challenge factor or when validating the identity challenge responses.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeOperationId
    challengeFactor:
      x-apiture-version: 1.2.1
      title: Challenge Factor (v1.2.1)
      description: A challenge factor. See [`requiredIdentityChallenge`](#schema-requiredIdentityChallenge) for multiple examples.
      type: object
      required:
        - type
      properties:
        id:
          description: |-
            The ID of an a challenge factor. This ID is unique within the challenge factors associated with a challenge. The client should pass this `id` value as the `factorId` when starting or verifying a challenge factor.

            *Note*: The `id` will become `required` in a future update to this schema.
          $ref: '#/components/schemas/challengeFactorId'
        type:
          $ref: '#/components/schemas/challengeFactorType'
        labels:
          description: A list of text label which identifies the channel(s) through which the user completes the challenge. For an `sms` or `voice` challenge, the only label item is the last four digits of the corresponding phone number. For an `email` challenge, each label is the masked email address.
          type: array
          minItems: 1
          maxItems: 4
          items:
            type: string
            maxLength: 300
            format: text
        securityQuestions:
          $ref: '#/components/schemas/challengeSecurityQuestions'
      example:
        type: sms
        labels:
          - '9876'
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactor
    resourceId:
      x-apiture-version: 1.0.1
      title: Resource Identifier (v1.0.1)
      description: The unique, opaque system identifier for a resource. This case-sensitive ID is also used as path parameters in URLs or in other properties or parameters that reference a resource by ID rather than URL.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]{6,48}$
      minLength: 6
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/resourceId
    challengeFactorId:
      title: Challenge Factor ID (v1.0.0)
      description: The ID of an a challenge factor. This ID is unique within the factors offered with a challenge.
      type: string
      pattern: ^[-a-zA-Z0-9$_]{3,48}$
      minLength: 3
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorId
      x-apiture-version: 1.0.0
    challengeFactorType:
      title: Challenge Factor Type (v1.0.0)
      description: |+
        The name of challenge factor.

        <strong><code>challengeFactorType</code></strong> strings may have one of the following
        [enumerated values](https://developer.apiture.com/docs/concepts/label-groups#enumerations):

        <table>
        <tr>
          <th>Value</th><th>Description</th>
        </tr>

        <tr>
            <td><strong><code>sms</code></strong></td><td>SMS: <p>One-time passcode sent to the primary mobile phone number</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>email</code></strong></td><td>Email: <p>One-time passcode sent to the primary email address</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>voice</code></strong></td><td>Voice: <p>One-time passcode communicated via automated voice phone call</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>authenticatorToken</code></strong></td><td>authenticator Token: <p>One-time passcode issued by a pre-registered hardware device, such as a token key fob, or an authenticator app</p>
        </td>
            </tr>
        <tr>
            <td><strong><code>securityQuestions</code></strong></td><td>Security Questions: <p>Prompt with the user&#39;s security questions registered with their security profile</p>
        </td>
            </tr>
        </table>

      type: string
      x-apiture-enum: challengeFactorType
      enum:
        - sms
        - email
        - voice
        - securityQuestions
        - authenticatorToken
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeFactorType
      x-apiture-version: 1.0.0
    challengeSecurityQuestions:
      x-apiture-version: 1.0.1
      title: Challenge Security Questions (v1.0.1)
      description: Describes a `securityQuestions` challenge. This is omitted if the challenge `type` is not `securityQuestions`.
      type: object
      required:
        - questions
      properties:
        questions:
          description: The array of security questions.
          type: array
          minItems: 1
          maxItems: 8
          items:
            $ref: '#/components/schemas/challengeSecurityQuestion'
      example:
        questions:
          - id: q1
            prompt: What is your mother's maiden name?
          - id: q4
            prompt: What is your high school's name?
          - id: q9
            prompt: What is the name of your first pet?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestions
    challengeSecurityQuestion:
      x-apiture-version: 1.0.1
      title: Challenge Security Question (v1.0.1)
      description: A single security question within the `questions` array of the [`challengeSecurityQuestions`](#schema-challengeSecurityQuestions)
      type: object
      required:
        - id
        - prompt
      properties:
        id:
          description: The unique ID of security question prompt. This should be included in the [`challengeVerification`](#schema-challengeVerification) response as the `promptId`.
          $ref: '#/components/schemas/challengePromptId'
        prompt:
          description: The text prompt of this security question.
          type: string
          format: text
          maxLength: 80
      example:
        id: 74699fa628911e762ea5
        prompt: What is your mother's maiden name?
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengeSecurityQuestion
    challengePromptId:
      title: Challenge Prompt ID (v1.0.0)
      description: The unique ID of a prompt (such as a security question) in a challenge factor.
      type: string
      pattern: ^[-_:.~$a-zA-Z0-9]+$
      minLength: 1
      maxLength: 48
      x-resolved-from: ../../common/openapi.yaml#/components/schemas/challengePromptId
      x-apiture-version: 1.0.0
  securitySchemes:
    clientCredentials:
      type: oauth2
      description: Client Credentials OAuth2 flow that allows a secure service application to access resources. (This access is not used with insecure clients such as web or mobile applications.) See details at [Secure Access](https://dx.apiture.com/docs/api/guides/secure-access/).
      flows:
        clientCredentials:
          tokenUrl: https://dev-oidc.apiture-comm-nonprod.com/oidc/token
          scopes:
            bankingAdmin/read: Read a wide variety of banking and other financial institution and customer data.
            bankingAdmin/write: Write a wide variety of banking and other financial institution and customer data.
            adminData/read: Read access to non-banking data and resources.
            adminData/write: Read, write, and delete access to non-banking data and resources.
            samlPlatform/write: Write access to security-critical Apiture internal key and certificate data.
            samlPlatform/read: Read access to integration resources, e.g. supported codes.
            samlAdmin/write: Write, delete and execute access to service provider metadata and SAML computation operations.
            systemIntegrations/read: Read access to integration definition resources.
            systemIntegrations/write: Write, delete and execute access to integration definition resources.
      x-resolved-from: ../../common/openapi.yaml#/components/securitySchemes/clientCredentials
  responses:
    '400':
      description: |
        Bad Request. The request body, request headers, and/or query parameters are not well-formed.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/badRequest/v1.0.0`](https://static.api.apiture.com/errors/badRequest/v1.0.0)<br>
          The request body and/or parameters was not well-formed.
          Remediation: Correct any syntax or schema errors in the request body or parameters.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/badRequest'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/badRequest/v1.0.0
              title: Bad Request
              status: 400
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: Input did not parse as JSON
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/400
    '401':
      description: |
        Unauthorized. The operation requires authentication but no authentication or insufficient authentication was given.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/unauthorized/v1.0.0`](https://static.api.apiture.com/errors/unauthorized/v1.0.0)<br>
          The request lacks valid authentication credentials for the target resource or operation.
          Remediation: Authenticate the user and pass the required authorization with the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/unauthorized'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unauthorized/v1.0.0
              title: Unauthorized
              status: 401
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request lacks valid authentication credentials
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/401
    '403':
      description: |
        Forbidden. The authenticated caller is not authorized to perform the requested operation.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/forbidden/v1.0.0`](https://static.api.apiture.com/errors/forbidden/v1.0.0)<br>
          The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
          Remediation: Check the user's permissions and entitlements before attempting the operation.

        * [`https://static.api.apiture.com/errors/customerDisabled/v1.0.0`](https://static.api.apiture.com/errors/customerDisabled/v1.0.0)<br>
          The customer is disabled.
          Remediation: Have the customer contact the financial institution for support.

        * [`https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0`](https://static.api.apiture.com/errors/antiMalwareRequired/v1.0.0)<br>
          The financial institution requires the customer to have anti-malware software installed.
          Remediation: Direct the user to the software requirements guide to install the correct anti-malware software.

        * [`https://static.api.apiture.com/errors/modificationForbidden/v1.0.0`](https://static.api.apiture.com/errors/modificationForbidden/v1.0.0)<br>
          The customer is properly authenticated but not authorized to create, modify, or delete resources.
          Remediation: Avoid modification operation for customers with read-only authorization.

        * [`https://static.api.apiture.com/errors/challengeRequired/v1.0.0`](https://static.api.apiture.com/errors/challengeRequired/v1.0.0)<br>
          The operation requires the customer to complete an identity challenge.
          Remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
        The `attributes` object in the error may have the properties defined by the [`requiredIdentityChallenge` schema](#schema-requiredIdentityChallenge).
        * [`https://static.api.apiture.com/errors/challengeBlocked/v1.0.0`](https://static.api.apiture.com/errors/challengeBlocked/v1.0.0)<br>
          The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
          Remediation: Have the user end their login session and login again.

        * [`https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0`](https://static.api.apiture.com/errors/noIdentityChallengeFactors/v1.0.0)<br>
          This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
          Remediation: Have the user register one or more challenge security code delivery factors.

        * [`https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0`](https://static.api.apiture.com/errors/invalidIdentityChallengeHeader/v1.0.0)<br>
          The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
          Remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/forbidden'
        - $ref: '#/components/x-apiture-errors/customerDisabled'
        - $ref: '#/components/x-apiture-errors/antiMalwareRequired'
        - $ref: '#/components/x-apiture-errors/modificationForbidden'
        - $ref: '#/components/x-apiture-errors/challengeRequired'
        - $ref: '#/components/x-apiture-errors/challengeBlocked'
        - $ref: '#/components/x-apiture-errors/noIdentityChallengeFactors'
        - $ref: '#/components/x-apiture-errors/invalidIdentityChallengeHeader'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/forbidden/v1.0.0
              title: Forbidden
              status: 403
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request has valid authentication, but the authenticated agent is forbidden from accessing this resource or operation
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/403
    '422':
      description: |
        Unprocessable Entity. The request body and/or query parameters were well-formed but otherwise invalid.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0`](https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0)<br>
          The syntax of the request entity is correct but was unable to process the contained instructions.
          Remediation: Provide a semantically correct request.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/unprocessableEntity'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0
              title: Unprocessable Entity
              status: 422
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request body and/or query parameters were well-formed but otherwise invalid.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/unprocessableEntity/v1.0.0
              title: Unprocessable Entity
              status: 422
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The request body and/or query parameters were well-formed but otherwise invalid.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/422
    '429':
      description: |
        Too Many Requests. The client has sent too many requests in a given amount of time.

        This problem response may have one of the following `type` values:
        * [`https://static.api.apiture.com/errors/tooManyRequests/v1.0.0`](https://static.api.apiture.com/errors/tooManyRequests/v1.0.0)<br>
          The client has sent too many requests in a given amount of time, exceeding rate limiting.
          Remediation: Slow down the rate of API calls.
      x-apiture-errors:
        - $ref: '#/components/x-apiture-errors/tooManyRequests'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/tooManyRequests/v1.0.0
              title: Too Many Requests
              status: 429
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The user has sent too many requests in a given amount of time.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/429
    4XX:
      description: Client Request Problem. The client request had a problem not listed under another specific 400-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/methodNotAllowed/v1.0.0
              title: Method Not Allowed
              status: 405
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: This HTTP method is not allowed for the given resource URL.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/4XX
    5XX:
      description: Server Problem. The server encountered a problem not listed under another specific 500-level HTTP response code. View the `detail` in the problem response for additional details.
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
        application/json:
          schema:
            $ref: '#/components/schemas/problemResponse'
            example:
              id: 3fbad566-be86-4b22-9ba6-3ca99fdc0799
              type: https://static.api.apiture.com/errors/gatewayTimeout/v1.0.0
              title: Insufficient Storage
              status: 507
              occurredAt: '2022-04-25T12:42:21.375Z'
              detail: The server is unable to store the representation needed to successfully complete the request.
              instance: https://static.api.apiture.com/banking/transfers/bb709151-575041fcd617
      x-resolved-from: ../../common/openapi.yaml#/components/responses/5XX
  x-apiture-errors:
    badRequest:
      description: The request body and/or parameters was not well-formed.
      remediation: Correct any syntax or schema errors in the request body or parameters.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/badRequest
    unauthorized:
      description: The request lacks valid authentication credentials for the target resource or operation.
      remediation: Authenticate the user and pass the required authorization with the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unauthorized
    forbidden:
      description: The user or agent is not allowed to perform this operation; authentication credentials were provided in the request, but the server considers them insufficient to grant access.
      remediation: Check the user's permissions and entitlements before attempting the operation.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/forbidden
    customerDisabled:
      description: The customer is disabled.
      remediation: Have the customer contact the financial institution for support.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/customerDisabled
    antiMalwareRequired:
      description: The financial institution requires the customer to have anti-malware software installed.
      remediation: Direct the user to the software requirements guide to install the correct anti-malware software.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/antiMalwareRequired
    modificationForbidden:
      description: The customer is properly authenticated but not authorized to create, modify, or delete resources.
      remediation: Avoid modification operation for customers with read-only authorization.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/modificationForbidden
    challengeRequired:
      description: The operation requires the customer to complete an identity challenge.
      remediation: Complete the challenge as per the problem response, and add an additional `Challenge` header to the call.
      attributes:
        $ref: '#/components/schemas/requiredIdentityChallenge'
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeRequired
    challengeBlocked:
      description: The user has failed challenges too many times and is blocked from attempting more or performing operations which require additional authentication.
      remediation: Have the user end their login session and login again.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/challengeBlocked
    noIdentityChallengeFactors:
      description: This operation requires an identity challenge, but the user does not have the necessary registered authentication factors.
      remediation: Have the user register one or more challenge security code delivery factors.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/noIdentityChallengeFactors
    invalidIdentityChallengeHeader:
      description: The additional on-time `Challenge` header in this request is expired, already used, or otherwise invalid.
      remediation: Supply a valid, unexpired, unclaimed `Challenge` header in the request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/invalidIdentityChallengeHeader
    unprocessableEntity:
      description: The syntax of the request entity is correct but was unable to process the contained instructions.
      remediation: Provide a semantically correct request.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/unprocessableEntity
    tooManyRequests:
      description: The client has sent too many requests in a given amount of time, exceeding rate limiting.
      remediation: Slow down the rate of API calls.
      x-resolved-from: ../../common/openapi.yaml#/components/x-apiture-errors/tooManyRequests
x-resolved-from: ../../systemCoreAdapter/status-codes-openapi.yaml
x-resolved-at: '2024-12-09T22:18:05.115Z'
x-apiture-annotated-at: '2024-12-09T22:18:05.355Z'
