March 2026
## Flinks Enrich
Note on the API call URL
In this guide, the sandbox instance is used. Therefore, you will need to adjust the API call URL for your needs.You must authenticate first
Please note that you will need to provide a private Authentication key in order to use this endpoint. If you do not have one already provided, contact your Flinks Representative.This endpoint is only available to clients who are based in Canada
If you are based in Canada and want to use this feature, contact your Flinks Representative and we will enable it for you in your private instance.Add the Flinks Connect parameter to your iframe URL before calling this endpoint
To retrieve statements successfully, you must add the Flinks Connect parameter `detailsAndStatementEnable=true` to your iframe URL.Keep in mind
The routing numbers are present only for US institutions.Setting up webhooks in your private instance
For us to configure your private instance with your webhook endpoint address, please open a ticket via [Flinks Support Portal](https://help.flinks.com/support/home). You must provide the name of the **Live** instance where the webhook will be configured. It is not possible to test a webhooks integration using a Sandbox environment.Note on this Endpoint:
This Endpoint is locked for clients that do not take a Tier 2 or above package.Note on 'Filters' and 'AccountFilter'
The parameter `AccountFilter` can only be used in conjunction with `Filter`. You *must* have both present if you need to filter by specific accounts.Note on 'AttributesDetail'
Only Attributes that are 'Sum' or 'Count' are allowed here. 'Average' or other types of Attributes are not supported here. Any Attribute name that is included here must also be included in the mandatory `Attributes` parameter above.Note on Custom Attributes
If you are utilizing the `Attributes Builder` feature to create custom Attributes within the Client Dashboard, then you are able to include your created `Attribute Names` under the `card` object alongside any other pre-created Attributes.You may receive NONE\_DETECTED in the response
If your response contains the `NONE_DETECTED` field, we did not find any transactions in that category in the account history and, therefore, do not have any data to return. All attributes will return the `NONE_DETECTED` field if no data is available.A note on the API Call Flow
The previous live call to [`/GetAccountsDetail`](../connect/endpoints/account-linking/get-accounts-detail) must be completely finished before initiating the below series of calls, otherwise you may receive a `202 OPERATION_PENDING` error.Operations accounts only
Operations is the only supported value.Use this endpoint if you want to receive a more detailed response
This endpoint performs a similar function to the [List Active Data Providers (v1)](./list-active-data-providers) endpoint, but returns a more robust data response. Use this endpoint if you need to retrieve any of the data points listed in the 200 HTTPS response, such as Data Provider name, providerId, registration status, and more.Receiving a 400, 401, or 403 response
The data collection lifecycle is not connected to the `refresh_token`. If you receive a 400, 401, or 403 error when calling this endpoint, it means that either of the tokens that are managed by Flinks have expired.If you are still experiencing issues
If you complete the steps above to receive a new token but continue to experience the same error, it may be consent related. For more information about how to resolve a consent error, see the [*Consent Errors*](/api/outbound/endpoints/fdx/fdx-errors#consent-errors) section.Response is different for each Data Provider
This endpoint returns different fields for each Data Provider. For more information about the fields that each Data Provider supports, review the [Data Provider's details](../registration/a-data-recipient).Response is different for each Data Provider
This endpoint returns different fields for each Data Provider. For more information about the fields that each Data Provider supports, review the [Data Provider's details](/api/outbound/endpoints/registration/a-data-recipient).Response is different for each Data Provider
This endpoint returns different fields for each Data Provider. For more information about the fields that each Data Provider supports, review the [Data Provider's details](/api/outbound/endpoints/registration/a-data-recipient).Not all Data Providers support this endpoint
If the Data Provider does not support payment networks, this endpoint returns 405 Method Not Allowed.Response is different for each Data Provider
This endpoint returns different fields for each Data Provider. For more information about the fields that each Data Provider supports, review the [Data Provider's details](/api/outbound/endpoints/registration/a-data-recipient).Response is different for each Data Provider
This endpoint returns different fields for each Data Provider. For more information about the fields that each Data Provider supports, review the [Data Provider's details](/api/outbound/endpoints/registration/a-data-recipient).This API is for our Open Banking product
This API is used for Outbound, the Flinks Open Banking product. For more information about using Outbound, speak with your Flinks Representative.One token per session
A token can only initiate a single session. Call `/Authorize` again before each subsequent session.Precedence of Balance Fields
MostRecentBalance takes precedence over OldestBalance - therefore if both are provided, only MostRecentBalance will be used.Note on transaction order
Flinks will assume that the order of the transactions is either ascending or descending. Please ensure that this format is followed. If there are irregularities (transactions out of order), inconsistent results may be returned.A note on Authorization
In order to access and use any of the /Upload endpoints, you will need a secret authorization token from Flinks. If you do not already have one, please reach out to your Flinks Representative.A note on Authorization
In order to access and use any of the `/Upload` endpoints, you will need a secret authorization token from Flinks. If you do not already have one, please reach out to your Flinks Representative.A note on Use Case and All Attributes endpoints
The `Card` and `AttributesDetails` objects within these requests are not required and, if provided, will be overwritten with the expected Attributes contained within the requested endpoint.A note on Authorization
In order to access and use any of the `/Upload` endpoints, you will need a secret authorization token from Flinks. If you do not already have one, please reach out to your Flinks Representative.Note on Optional Parameters
All optional parameters listed in the `Optional Parameters` section of this documentation can also be used by embedding them within the 'Options' object.Before getting started
The APIs detailed in this documentation should be viewed as an extension of the core Flinks Enrichment services. It is recommended that you understand the concept and use cases contained within Attributes before proceeding with this implementation.Before getting started
You will need a secret bearer (authentication) token in order to use any of the /Upload API endpoints. If you do not have one already, contact your Flinks Representative to have one issued based on your private instance.Note on unformatted data
This documentation will **not** detail how to submit data directly from another provider. If you plan on using a JSON file directly from another provider without reformatting first, please reach out to our team for information on how to do so and the API schemas we currently support.Deleting Cards If you call the
[/DeleteCard](../../connect/endpoints/account-linking/delete-card) endpoint to delete data for a specific user, Access Tokens that are associated with that user will immediately become invalid and no data will be available for the partner to retrieve.You must authenticate first
Please note that you will need to provide a private Authentication key in order to use this endpoint. If you do not have one already provided, contact your Flinks Representative.Still unsure?
If you're still unsure how to use the `/GetWealthNightlyRefreshStatus` endpoint, contact your Flinks Representative and we'll work with you to make sure it is implemented correctly.
These credentials will only work for testing purposes within the Flinks Dashboard
It's not a live sandbox environment and therefore will not work if you refer to it (either the environment or credentials) in your code. Do not include the sandbox credentials when you start to code. Instead, use the API credentials that are located on the same page under your company project name.No Multifactor Authentication
Sometimes an account doesn't have Multifactor Authentication. When this happens, an authenticated loginId will be issued after the username and password are validated by the Financial Institution. To test this, change the username to: `greatday_nomfa`.Selected Account Identification
You can store the information about which account your user has selected by collecting and keeping the `AccountId` along with the `loginId`.Note:
Different tags need to be assigned directly in the iframe URL using the "Tag" parameter.Hosting your own consent page is a compliance requirement
If you replace Flinks' default consent screen with your own, you **must** include the three required transparency disclosures: 1. **What information is collected** from the end user. 2. **How that data is shared** with your organization. 3. **The user's privacy choices.** Your consent page must also include agreement language referencing the **Flinks Services Privacy Statement**. This is mandatory: you cannot disable the default consent screen without providing a compliant replacement.Whitelist your redirect domain before go-live
The domain used in `redirectUrl` **must** be whitelisted by Flinks before go-live. Share it with us by opening a support ticket. If the domain is not whitelisted, the iframe fails to load entirely and the URL updates to an error state: ``` https://instance-iframe.private.fin.ag/v2/Error?validRedirectUrl=false ``` Also remember to **URL-encode** the redirect URL and any of its parameters.Already using version 1?
If you're an existing customer using version 1, this is still accessible to you without specifying a version.Only available for certain US financial institutions
If the routing number is not associated with a financial institution in our system, an error message will display to the user, and they'll be redirected back to the Financial Institution Selection screen.These parameters are deprecated
Enhanced MFA is no longer an actively supported feature. Most Canadian financial institutions have moved to one-time passwords and push notifications, which cannot be answered automatically. Do not use these parameters in new integrations. For refreshing account data, implement a user-initiated reconnection flow instead. See the [Reconnect](/guides/connect/resume-and-reconnect) guide for more details.redirectUrl whitelisting
As an added layer of security, Flinks requires that the domain name used in the redirectUrl parameter be shared with us so we can whitelist it. Failure to share this information could prevent Flinks Connect to load entirely and result in displaying the following message: The iframe URL will also update to the following: [https://instance-iframe.private.fin.ag/v2/Error?validRedirectUrl=false](https://instance-iframe.private.fin.ag/v2/Error?validRedirectUrl=false)Parameters in your Redirect URL
You must encode all parameters that are specific to your landing page URL. ✔️ Good usage: redirectUrl=https%3A%2F%2example.com%2F%3FurlEncoded%3Dtrue ❌ Bad usage: redirectUrl=[https://example.com/?urlEncoded=true](https://example.com/?urlEncoded=true)Accounts details for selected accounts
By default, Flinks Connect only collects the details of the selected accounts, but it is possible to still gather all account details by specifying the parameter fetchAllAccounts=true.We will unlock that for you
If you want to use this feature, please contact our support so we can enable it in your private instance.Nightly Refresh is no longer actively supported
Automatic nightly refresh is no longer supported for most financial institutions. Do not use `scheduleRefresh` in new integrations. To refresh account data, the end-user must be present and complete a live connection through Flinks Connect. See the [Nightly Refreshes (Deprecated)](/guides/connect/nightly-refresh) page for details and alternatives.Never include personal information (PII) in tags
Tag values are passed through URLs, logs, and webhook payloads. They are **not** a secure channel. Do not include any PII, such as: * Email addresses * Phone numbers * Full names * Dates of birth * Government IDs (SIN, SSN, driver's license, etc.) * Physical or mailing addresses Use an opaque identifier (e.g., your own `userId` as a GUID) that maps back to PII inside your own systems.This feature must be switched on
To start using Flinks Upload, contact your Flinks Representative, and we will enable it for you.Custom integrations only
This section explains how to set up custom integrations that use a direct API connection. If you are using Flinks Connect, this section does not apply to you.Disclaimer
Please be mindful that this session addresses a legacy type of integration with Flinks. The following articles are mostly to support customers who already live with this methodology. Flinks Connect was developed to replace this integration and solve the following challenges: * Increase conversion rate. * Avoid maintenance efforts on your side to account for authentication flow changes by the financial institution. * It includes support for our new OAuth connections which is not the case with the legacy flow.This is only required for legacy integrations
This is only required if you are using a legacy integration (that does not support OAuth 2.0). If you are using a custom integration that supports OAuth 2.0, see Custom Integrations.Integrating with Flinks Connect?
Integrations that use Flinks Connect for handling user banking authentication, use `/Authorize` in cached mode, by only specifying the parameter `"MostRecentCached": "true"` and `LoginId`, as you need to retrieve already processed data. More details can be found here.Disclaimer
Please be mindful that this session addresses a legacy type of integration with Flinks. The following articles are mostly to support customers that are already live with this methodology. Flinks Connect was developed to replace this integration and solve the following challenges: * Increase conversion rate. * Avoid maintenance efforts on your side to account for authentication flow changes by the financial institution. * It includes support for our new OAuth connections which is not the case with the legacy flow.Note:
This is identical to the procedure as described above with **Case 2: Reset Questions/Answers when user has to select new questions.**Nightly Refresh is no longer actively supported
Automatic nightly refresh (without end-user presence) is no longer a supported feature for most financial institutions. Due to the prevalence of one-time passwords and push-notification MFA, automatic refresh success rates are extremely low in Canada (except for a small number of OAuth-connected institutions). **What this means for your integration:** * Do not rely on automatic nightly refresh for your use case. * To refresh account data, the end-user must be present and complete a live connection through Flinks Connect. * You can implement a "Refresh" button in your application that triggers a live [/Authorize](/api/authorize/endpoints/authorize) call with `MostRecentCached: false`. The user will need to complete MFA if prompted. * [Reconnect](/guides/connect/resume-and-reconnect) can help reduce friction for end-user reconnections. Existing customers with active nightly refresh configurations will continue to be supported. Contact your Flinks Representative for details on your specific setup.Enhanced MFA is no longer supported
Enhanced MFA is no longer an actively supported feature. Most Canadian financial institutions have moved to one-time passwords and push notifications for MFA, which cannot be answered automatically. The `enhancedMFA` and `skipEnhancedMFA` iframe parameters should not be used in new integrations. For refreshing account data, implement a user-initiated reconnection flow instead. See the [Reconnect](/guides/connect/resume-and-reconnect) guide for recommended approaches.Custom integrations only
This page explains how to set up custom integrations that use a direct API connection. If you are using Flinks Connect, see Set Up Flinks Connect.If your business case is listed above, this is mandatory.
If you do not integrate the Wealth Reconnect Flow by completing all of the steps below, your business case and billing process will be impacted.Use the [/GetIncomeAttributes](/api/enrich/endpoints/consumer-attributes/get-income-attributes) endpoint if you need a high-level overview of your users' income sources.
This is a primary basic use-case of Attributes and is often utilized by organizations that need a high-level, standard overview of your users Total Income, Employment Income, and Government Income. It will provide the following Attributes to enable a quick and easy standard Income verification. This is often used in manual processes.
Please find a breakdown of the Attributes contained within this use-case below:
Note:
If you need a deeper review of Income, please refer to our Lending use-case.Employer Income:
Non-Employer Income:
Government Income:
Others:
Use the [/GetLendingAttributes](/api/enrich/endpoints/consumer-attributes/get-lending-attributes) endpoint if you need a comprehensive breakdown of all of your users income sources, deep credit risk analysis, and all necessary data points for underwriting your users.
The Lending Attribute package is designed specifically for underwriting a user based upon their transactional behaviour and is also an advanced use-case. It provides the necessary Attributes for both manual and automated underwriting methodologies. It covers most aspects of Income, Overall Risk Analysis, Predictive Risk and Cash-Flow Analysis, Specific Risk Analysis and Liability Analysis. This is our most comprehensive package offering before moving to the full library, offering a total of 750 data points on each end-user.
Please find a breakdown of the Attributes contained within this use-case below:
The following is the selection of Income Analysis Attributes covered by the Lending Attributes package.
Total Income:
Employer Income (Overall):
Employer Income (Primary):
Employer Income (Secondary):
Employer Income (Other):
Non-Employer Income:
Government Income:
Employment Insurance Income:
Workplace Safety Income:
Disability Income:
Social Assistance Income:
Child Support Income:
Pension Income:
Insurance Income:
The following is the selection of Overall Risk Analysis Attributes covered by the Lending Attributes package.
Account Analysis:
Overall Balance Analysis:
Specific Balance Analysis:
The following is the selection of Specific Risk Analysis Attributes covered by the Lending Attributes package.
NSF Fees:
Stop Payment Fees and Reversals:
Detection Attributes:
Committed Transfers:
Loan Deposits:
The following is the selection of Liability Analysis Attributes covered by the Lending Attributes package.
Overall Loan Payments:
Micro-Loan Payments:
Mortgage Payments:
Auto Loan Payments:
Student Loan Payments:
Other Loan Payments:
Telecom Payments:
Utility Payments:
Use the [/GetCreditRiskAttributes](/api/enrich/endpoints/consumer-attributes/get-credit-risk-attributes) endpoint if you need a high-level overview of your users' basic income sources and credit risk measures.
This is a primary basic use of Attributes and is often utilized by organizations that need to conduct a high-level risk analysis of their users. It contains basic Attributes needed to view your users overall Financial Information, Employment Income sources, Non-Employment Income sources, Loan Payments, Bill Payments, and Additional Risk Analysis measures. This is often used in manual processes.
Please find a breakdown of the Attributes contained within this use-case below:
Account Overview:
Employer Income Overview:
Non-Employer Income Overview:
Loan Payments Breakdown:
Committed Bill Payments Breakdown:
Additional Risk Analysis:
Use the [/GetUserAnalysisAttributes](/api/enrich/endpoints/consumer-attributes/get-user-analysis-attributes) endpoint if you need a deeper, combined view of your users' income sources, credit risk measures, and potential fraudulent flags.
The User Analysis use-case is the first of our "advanced" use-cases. This use-case combines the previous two packages (Income and Credit Risk) into one use-case and adds an additional "fraudulent/primary account detection" layer. This use-case is often utilized where both Income and Credit Risk are important factors to consider for the same user, and is often the starting point for organizations automation processes.
Please find a breakdown of the Attributes contained within this use-case below:
Employer Income:
Non-Employer Income:
Government Income:
Other Income Attributes:
Account Risk Overview:
Loan Payments Breakdown:
Committed Bill Payments Breakdown:
Additional Risk Analysis:
Fraud Detection Attributes:
Use the [/GetBusinessAnalysis](/api/enrich/endpoints/business-attributes/get-business-analysis-attributes) endpoint if you would like to receive Business Analysis Attributes, specifically focused on SMB and corporate accounts.
The Business Analysis use-case is the first of our "advanced" use-cases for businesses specifically. This use-case is primarily utilized when you are underwriting or analyzing business specific accounts. It enables your team to quickly, easily, and efficiently break out all important aspects of a users account. This includes a Business Revenue (Income) Analysis, Loan Deposits Analysis, Operating Expenses Analysis, Liabilities and Loan Payments Analysis, and finally an analysis of Fees and Other Expenses. This use-case is primarily used within our Client Dashboard through an auto-generated report, but can often be the starting point for organizations automation processes for their business clients.
Please find a breakdown of the Attributes contained within the use-case below:
The following is the selection of Income Analysis Attributes covered by the Business Analysis Attributes package.
Overall Operating Income:
Merchant Service Provider Deposits:
Transfer Deposits:
Branch Deposits:
Other Vendor Deposits:
Payroll Deposits:
Credit Card Deposits:
Other Operating Income:
Overall Government Income:
Tax Rebates and Refunds:
Other Government Income:
Other Types of Income:
Insurance Deposits:
Rent Deposits:
All Other Income:
The following is the selection of Loan Deposits Analysis Attributes covered by the Business Analysis Attributes package.
Overall Loan Deposits:
Business Loan Deposits:
Mortgage Loan Deposits:
Micro-Loan Deposits:
Auto Loan Deposits:
Other Loan Deposits:
The following is the selection of Operating Expense Analysis Attributes covered by the Business Analysis Attributes package.
Overall Operating Expenses:
Vendor Expenses:
Cash Withdrawals:
Payroll Expenses:
Credit Card Expenses:
Other Operating Expenses:
The following is the selection of Liabilities Analysis Attributes covered by the Business Analysis Attributes package.
Overall Liabilities:
Insurance Payments:
Rent Payments:
Telecom Payments:
Utility Payments:
Overall Loan Payments:
The following is the selection of Fees Breakdown Attributes covered by the Business Analysis Attributes package.
Overall Fees:
Bank Fees:
NSF Fees:
Other Fees:
The following is the selection of Other (Non-Operating) Expenses Attributes covered by the Business Analysis Attributes package.
Other Expenses:
Restricted location for this endpoint
Note on usage of endpoints
Your team may only have access to one of the above use cases (dependent on the package taken at the time of onboarding). Please ensure that you only set up requests to the available endpoints for your integration to avoid any complications.An important note:
The previous call to [/GetAccountsDetail](../../api/connect/endpoints/account-linking/get-accounts-detail) **must** be completely finished before initiating the series of calls below, otherwise, you may receive a `202 OPERATION_PENDING` error.Operations accounts only
Operations is the only supported value.Note on making API calls
If you have not already set up these API calls, please refer to [Flinks API Reference ](../../api-home) for more details about setting this up.When sending requests for data...
Your integration must handle the 202 OPERATION\_PENDING response.If you're still receiving 202 OPERATION PENDING...
In case your data is still pending, you need to call this endpoint every 10 seconds for maximum of 30 minutes. This doesn't mean that your request is going to take that long, but this global timeout is required to avoid infinite loops.Note on steps 1 and 2
These have been covered previously in the Make API Calls section. Please refer to that for more information.Operations accounts only
Operations is the only supported value.Note on Attributes Field\*
If you are on a Tier 2 Package and need to create a custom Attribute request, please reach out to our team for the full list of Attribute Names that you can include here as needed for your custom use-case.Custom integrations only
This page explains how to set up custom integrations that use a direct API connection. If you are using Flinks Connect, see [`Set Up Flinks Connect`](../connect/getting-started#getting-started-with-connect).Flinks Pay is currently only available in Canada.
Flinks Pay is currently only available in Canada.
When sending requests for data...
Your integration must handle the 202 OPERATION\_PENDING response.If you're still receiving 202 OPERATION PENDING
In case your data is still pending, you need to call this endpoint every 10 seconds for a maximum of 30 minutes. This doesn't mean that your request is going to take that long, but this global timeout is required to avoid infinite loops.Receive fraud signals by API connection
To receive fraud signals by API, call the [/FraudAnalysis](../../api/upload/endpoints/fraud/fraud-analysis) endpoint.Receive fraud signals by API connection
To receive fraud signals by API, call the [/FraudAnalysis](../../api/upload/endpoints/fraud/fraud-analysis) endpoint.Build financial apps with our secure API, access bank data, transactions, and account info easily. Watch the video below to learn what Flinks can do for you.