Integration guides

The Accounts API lets you query account data, including paginated lists, single account details, and balances.

List every account, fetch each balance, and roll them up by currency and entity into the number treasury looks at first thing in the morning.

The Approvals API allows your application to view pending approvals

What happens to an API-created payment when an approval policy applies, how to find its approval record, and how to know when it has been sent.

This page will help you get started with Xace. You'll be up and running in no time!

How client-credentials authentication works, what the token carries, which scopes gate which endpoints, and how to cache and refresh tokens safely.

How page, limit and excludeTotal work on the list endpoints, the per-endpoint page sizes, and a loop that walks a full collection without missing or duplicating rows.

What each status code means on the Customer API, which ones are safe to retry, and a retry policy that will not create duplicate payments.

The Payees API lets you create, list, and retrieve saved payees associated with customer accounts.

The minimum field set for GBP, EUR, USD and CAD payees, the reference length rule, purpose codes, and why upsert is usually the endpoint you want.

POST /payments end to end: the idempotency header, the body for one payment or many, the 202 response, and what happens next.

How the x-idempotent-key header works, how to generate and store keys so a retry can never double-pay, and what to do after a timeout.

Generate daily CAMT053 statements

Fetch the previous day’s CAMT.053 for every account each morning, parse the totals, and use it as the control against your transaction sync.

The Transactions API allows you to query both individual and paginated transaction records tied to customer accounts.

A scheduled job that pulls new transactions per account, handles fees as separate rows, dedupes on xtid, and matches against your ledger.

Validation You can validate webhook events by validating the signature attached in the request header: Webhook-Signature Base64(RSA512(_WEBHOOK_PRIVATE_KEY_, SHA512(timestamp+eventBody))) To validate the signature in Production workspaces, please use the public key below: \-----BEGIN PUBLIC KEY-----…

Register an endpoint per account and event, understand the two transaction events, and unsubscribe cleanly.

Acknowledge fast, verify the signature, dedupe on xtid, fetch the truth from the API, and never let a slow downstream system cause redeliveries.

The pre-built connections in the Xace web app, what each one does, and when to reach for them instead of the API.

Four ways to connect systems to Xace, what each is good at, and a short decision guide for the common integration jobs.