Banking API & Collateral

Why

A partner bank that reviews files in Tauraco's bank portal may want to process them in its own system. The banking API lets it connect that system to the files sent to it, without re-entry. The company stays in control: only designating a bank as the recipient of a request gives that bank access to the file.

How, in the application

Create the institution's access. In the Financing menu, the institution has the “Institution API keys” and “Institution webhooks” entries. These accesses are reserved for a financial institution and are created by a human decision-maker at the institution. The application receives a reader role, or an operator role if it writes information requests or reconciliations; it never receives the decision-maker role.

What the bank sees.

• Its file inbox.
• Each file as frozen at submission, with a timeline limited to its own institution.
• The file's documents, downloaded one by one.
• Information requests, which it can create and read, but not close.
• Facilities and repayment schedules, read-only, as well as a facility's reconciliation and its discrepancies.
• Collateral items and their timeline.

Institution events. Institution webhooks receive the events that concern the institution: financing request submitted, financing status changed, financing disbursed, agreement signed, collateral registered, collateral released, and test event. Their payloads contain neither amounts nor rates; details are read back through the API.

Withdrawn request. When the company withdraws a request, its history (metadata, frozen snapshot, and documents) remains available to a recipient bank. It is refused to a bank that was not a recipient or that declined. Every file view and every document download is logged.

Company side. The company's ERP owner (ERP_OWNER), or a user with the FINANCE role, can export the dataset of Collateral deposits entrusted to a third-party custodian; each row carries a legal disclaimer. Through the API, reading this dataset requires access delegated by an ERP owner.

Safeguards

• No decisions through the API: offers, declines, disbursements, drawdowns, deregistrations, and releases remain human actions by a decision-maker, in the portal.
• A bank never sees another bank's offers or internal amounts, nor the private file of a collateral item.
• Each collateral data item carries a reminder: it is not legal proof of an enforceable security interest. Only deeds and formalities completed with the competent registry are authoritative.
• Opening the banking API requires the connection of an authorized partner institution; Tauraco enables it once the legal texts above are validated, and they cannot be reworded without a new written decision.
• The API reads no bank account and initiates no payment: the pain.001 credit transfer order is not supported and the camt.053 statement remains experimental.