Fineract

Twin of the Apache Fineract core banking API.


Covers	`leopard.mifos.io`, `mifos.mifos.gazelle.test`
Auth	HTTP Basic, plus a tenant header
Webhooks	No
Operations	25

Coverage

Retail core banking: offices, clients, savings accounts and their transactions, loans and their repayment schedules, loan and savings products, and the interoperation party directory and transfer state machine. The back office is not part of that, so calls into the general ledger, tellers, reports and admin configuration are refused.

One dialect, under the /fineract-provider/api/v1 prefix your deployment already uses. The version is in the path and there is no selector.

Credentials

Every call carries two things: Authorization: Basic and Fineract-Platform-TenantId. Basic is checked first, so a bad pair is a 401 with WWW-Authenticate, and only then does a missing or unknown tenant become a 400 in Spring’s {timestamp, status, error, path} shape rather than Fineract’s own error envelope.

Any well-formed Basic pair authenticates by default, so your existing credential and tenant id need no change. Set auth.mode to enforced to accept only the credential the world knows. See Credentials. There are no scopes or roles.

Vendor specific details

The credential check beats the router. An unknown path sent without a credential is a 401, not a 404.
Every write that carries a date must also carry dateFormat and locale, and you get one error per missing companion. Dates come back as three-element [year, month, day] arrays, not strings.
?command= drives the state machine, ?action= for interoperation transfers. It is checked before the body and before the resource is looked up, so an unknown command is a 400 naming the allowed list even when the id does not exist.
A 403 here is often a business rule, not an auth problem. An over-balance withdrawal and a bad orderBy are both 403, while a wrong-state transition is a 400.
Interoperation validation errors repeat. A missing accountId on a transfer comes back 64 times in errors. That is an upstream loop and the twin reproduces it, so deduplicate before showing anything to a user and never assert on the array length.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.