"
BASE_URL="https://api.waycore.com/v1"
ENTITY_ID="11111111-2222-3333-4444-555555555555"
INSTITUTION_ID="chase"
CONNECTION_ID="conn_123"
```
## 1. Find the owning entity
Start by listing entities and choosing either the default org entity or a customer entity you created earlier.
```bash theme={null}
curl -sS "$BASE_URL/entities?limit=10" \
-H "Authorization: Bearer $API_KEY"
```
## 2. Choose the bank target
If the bank is already in the public institution catalog, search by name, identifier, portal URL, or portal domain, then capture the `institutionId` you want to connect.
A bank does not need to appear in `/v1/institutions` before you can start onboarding it. If it is not listed, use its HTTPS `portalUrl` when creating the connection.
```bash theme={null}
curl -sS "$BASE_URL/institutions?query=chase" \
-H "Authorization: Bearer $API_KEY"
```
## 3. Create or return a connection
Create the connection using the chosen `entityId` plus either `institutionId` or `portalUrl`. The response returns a `ConnectionResource`, which may be a new `kind="setup"` connection or an existing connection returned directly.
If the response is `kind="setup"`, you can use the returned `setup.instructions` immediately. The current email, username, phone number, and other setup details are included on that first create response.
```bash theme={null}
curl -sS "$BASE_URL/connections" \
-X POST \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
"entityId": "'"$ENTITY_ID"'",
"institutionId": "'"$INSTITUTION_ID"'"
}'
```
```bash theme={null}
curl -sS "$BASE_URL/connections" \
-X POST \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
"entityId": "'"$ENTITY_ID"'",
"portalUrl": "https://business.bank.example.com/login"
}'
```
## 4. Provide credentials
Once the delegated user exists in the bank, submit the current working credentials. Include `password` when that bank requires one.
```bash theme={null}
curl -sS "$BASE_URL/connections/$CONNECTION_ID/credentials" \
-X PUT \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
"bankUsername": "waycore.user",
"bankCustomerId": "company-001",
"password": "super-secret-password"
}'
```
## 5. Mark setup complete
After the bank-side delegated-user setup is finished, notify Waycore so activation can continue. From there, Waycore completes activation and starts the initial historical backfill automatically.
```bash theme={null}
curl -sS "$BASE_URL/connections/$CONNECTION_ID/setupCompletion" \
-X PUT \
-H "Authorization: Bearer $API_KEY"
```
## 6. Wait for `kind="ready"`
If the create call returned `kind="setup"`, poll the connection until it transitions to `kind="ready"`. Once the connection is ready, the normal steady-state status is `active`.
```bash theme={null}
curl -sS "$BASE_URL/connections/$CONNECTION_ID" \
-H "Authorization: Bearer $API_KEY"
```
## 7. Read data or queue a sync
Once the connection is ready, you can read accounts and transactions immediately, or trigger a sync if you need fresh data right away. Manual sync triggers are subject to the connection cooldown described in [Connections](/connections).
```bash theme={null}
curl -sS "$BASE_URL/accounts?connectionId=$CONNECTION_ID" \
-H "Authorization: Bearer $API_KEY"
```
```bash theme={null}
curl -sS "$BASE_URL/connections/$CONNECTION_ID/sync" \
-X PUT \
-H "Authorization: Bearer $API_KEY"
```
From there, use `GET /v1/transactions` for backfills and `GET /v1/transactions/sync` plus webhooks to keep your mirror current.
# Institutions
Source: https://docs.waycore.com/institutions
Use catalog records when available, or start onboarding with a portal URL
An **Institution** is a catalog record for a bank or banking platform Waycore already recognizes. It is not required to start onboarding a bank, and it is not a live connection.
Use the institutions endpoints to discover the correct `institutionId` when a bank is already in the catalog.
A bank does not need to appear in `/v1/institutions` before you can start onboarding it. If it is not listed, create the connection with `entityId` plus `portalUrl`; Waycore returns a setup-stage connection and delegated-user instructions while support is added.
## Institution vs connection
| Object | What it represents |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Institution** | A bank record in Waycore's public catalog, used when one is available. |
| **Connection** | A live, entity-owned integration created with either an `institutionId` or a bank `portalUrl`, after delegated-user setup and activation. |
In other words: institutions are a convenience for known banks, not a prerequisite for onboarding a new one.
## Connection input paths
| Input path | When to use it |
| ------------------------------- | ------------------------------------------------------------------------------------- |
| `entityId` plus `institutionId` | Use when the bank appears in `GET /v1/institutions`. |
| `entityId` plus `portalUrl` | Use when the bank is not listed yet, or when you are starting from a bank portal URL. |
For catalog records, call `GET /v1/institutions`, search by institution name, identifier, portal URL, or portal domain, then use the returned `institutionId` in `POST /v1/connections`. For banks that are not listed, use the HTTPS bank `portalUrl` directly in `POST /v1/connections`.
## Key fields
* **`institutionId`** — Stable Waycore identifier used when creating connections.
* **`name`** — Display name for the bank or banking platform.
* **`canonicalPortalUrl`** — Default HTTPS portal URL for the institution.
* **`additionalPortalUrls`** — Other known HTTPS portal URLs that can be supplied when creating a connection.
* **`alternativeNames`** — Other names by which the institution is commonly known.
* **`logoUrl`** — URL of the institution's logo, when available.
* **`setupGuideUrl`** — Link to Waycore's user-facing setup guide for this institution.
* **`status`** — `live` if the institution is fully supported, or `pending` if it is in the catalog but not yet available for new connections.
## Searching
`GET /v1/institutions` supports a `query` parameter for name, identifier, portal URL, or portal domain search. Results are cursor-paginated, so you can browse the full catalog or power a searchable picker in your product.
Use `institutionId` when a catalog record fits the bank. Use `portalUrl` directly in the connection create call when the bank is unsupported, newly requested, or better identified by a specific portal URL.
## Endpoints
## Required scopes
| Scope | Used by |
| ------------------- | --------------------------------------------------------------- |
| `connections:read` | List, get |
| `connections:write` | Create a connection with the selected institution or portal URL |
# Aggregators vs. Waycore
Source: https://docs.waycore.com/intro/aggregators-vs-waycore
For platforms and finance teams evaluating commercial-bank access, the important question is not only "which provider has a listed connection?" The important question is: can the workflow performed inside the bank portal be made programmable, observable, permissioned, and recoverable under bank-native controls?
Waycore & aggregators solve different problems.
![Image]()
## Where aggregators work well
Aggregators are genuinely good infrastructure for consumer fintech apps, SMB lending, and basic cash-flow dashboards. The aggregator model is a good choice when the integration requires read-only access, the target accounts are retail or simple SMB, and there is no requirement for payment execution or deterministic reliability.
## Where aggregators fail in commercial banking
Our own first-hand experience trying to build real-time treasury applications on top of standard aggregators confirms these failure modes are systemic for commercial workflows:
1. **Geographic and institutional coverage:** Aggregators maintain a fixed catalog of supported institutions, weighted heavily toward US retail and SMB accounts. Adding a bank outside that catalog requires a new integration, which may take months or never happen.
2. **No near real-time data:** Aggregators batch and delay data. For execution workflows like payments, sweeps, and approval chains, you need to know the current state of an account before you act on it. Aggregators cannot reliably deliver this.
3. **Commercial portal coverage:** Aggregators are optimized for consumer accounts. An aggregator's dashboard may list a major institution like Chase or Morgan Stanley as "supported," but attempting to pull reliable data from their commercial portals is often a terrible experience.
4. **Missing commercial features:** Because they do not specialize in commercial banking, aggregators completely lack support for core treasury features.
5. **No execution:** Aggregators are read-only data pipes. They cannot reliably support commercial payment workflows like staged transfers, approval chains, or bulk payroll uploads.
6. **Poor developer support:** When a bank updates its portal and an aggregator connection breaks, resolution can take months. The developer experience is notoriously poor, with no human fallback to maintain continuity.
## Comparison for integrators
| Dimension | Waycore | Aggregators |
| :----------------------------- | :------------------------------------------------------------------- | :------------------------------------------------ |
| **Core function** | Read + write treasury infrastructure | Read-only data aggregation |
| **Target market** | Enterprise ERPs, treasury platforms | Consumer apps, basic fintech |
| **Geographic coverage** | Any bank worldwide with delegated access; on demand, typically hours | Fixed catalog; new banks require new integrations |
| **Data freshness** | Near real-time as standard | Batched or delayed; not suitable for execution |
| **Commercial portal coverage** | Deep, demand-led; any portal with delegated access | Uneven to weak; dashboard claims often mislead |
| **Commercial features** | Native support for sweeps, shadow accounts, NAT files | Basic data only |
| **Execution capability** | Payments, approvals, sweeps, bulk uploads | None, or limited consumer transfers |
| **Reliability model** | HITL fallback; human operators maintain continuity | Best-effort; breaks on portal changes |
| **Developer support** | Managed recovery; proactive exception handling | Ticket-based; often months to resolve |
# Core concepts
Source: https://docs.waycore.com/intro/core-concepts
> Waycore is built around a small set of structural primitives.\
> If you understand these, you understand the system.
***
## Delegated User
A **delegated user** is a bank-native login created by your customer inside their commercial bank. This is **functionally identical to hiring an outsourced treasury clerk**. Waycore operates strictly within the permissions granted by the account owner.
The nomenclature can vary across banks, but you will normally see this feature appears as **user**, **sub-user,** **authorized user, portal user, operator, delegate**.
It is not:
* A shared credential
* A consumer OAuth token
It is a real user identity inside the bank’s permission model.
Permissions are explicitly scoped:
* Read-only access
* Transfer initiation (optional)
* Approval authority (optional)
Waycore operates exclusively through this delegated identity.
**Implication:**\
The bank controls the permission surface. Waycore does not (and cannot) bypass it.
***
## Entity
An **entity** is the business that owns data and connections in the public API.
It gives you a stable ownership boundary for:
* Connections
* Accounts
* Transactions
* Your own internal customer or fund mappings
In practice, entities let you model customer businesses, subsidiaries, SPVs, or your own operating company in a way that stays consistent across institutions.
***
## Institution
An **institution** is a bank or fintech record Waycore already recognizes in the public catalog.
An institution object represents:
* The bank, banking platform, or fintech
* A stable `institutionId`
* Default and additional portal URLs when known
* A searchable discovery record you can use when one is available
It does **not** represent a live connection by itself, and it is not required before onboarding starts. Banks that are not in the catalog can still be onboarded through a raw `portalUrl` on the connection create call.
***
## Connection
A **connection** is the live, entity-owned integration with a bank target identified by either an `institutionId` or a bank `portalUrl`.
Connections are created in stages:
* `kind="setup"` while delegated-user onboarding is still in progress
* `kind="ready"` once the connection is activated and able to sync
The public API integrates first around this connection lifecycle, then around the accounts and transactions discovered through it.
***
## Connection Lifecycle
Public connection states include:
* `draft`: The connection is created, but onboarding inputs are still incomplete.
* `pendingActivation`: Bank-side setup is complete and Waycore is validating and activating the connection.
* `active`: Syncing normally.
* `reauthRequired`: Bank authentication requires re-authentication before sync can continue.
* `errored`: A recoverable issue is preventing sync. Waycore will address and retry automatically.
* `invalidConfig`: Connection configuration is invalid and needs correction before normal operation can resume.
* `paused`: Syncing has been intentionally suspended by the Waycore team, usually during a new version release or an active bug investigation. API read endpoints continue to work as expected during this period.
* `revoked`: Access has been removed. No further syncs will occur.
These states make delegated-user onboarding and ongoing bank health explicit, rather than hiding them behind a single "connected" flag.
***
## Transfer
A **transfer** is a public API payment object that represents a requested movement of funds through a connected bank account.
Transfers support internal account movements and external payment rails such as ACH, wire, SWIFT, FedNow, RTP, SEPA, and local rails, subject to API access, institution capabilities, and the delegated user's bank-side permissions.
> **Note:** All external transfers require end-user approval in the bank portal. Waycore initiates the bank-side flow, then the end user completes approval at the bank. Internal transfer approval requirements depend on the bank, account setup, and delegated-user permissions.
***
## Webhook Event
A **webhook event** is an operational signal emitted by the public API when subscribed events occur.
Current public producers include:
* Connection status changes
* Transaction sync availability
* Explicit `test` deliveries
Additional event types are reserved for future public producers.
Use webhooks to trigger follow-up work and monitor connection health. For transaction reconciliation, use `transactions.sync_available` as a prompt to call `GET /v1/transactions/sync`.
***
## Audit Trail
Every action is written to an immutable audit log.
The audit trail includes:
* Timestamp
* Institution
* Delegated user identity
* Action performed
* Result
* Metadata
This enables:
* Compliance reporting
* Operational debugging
* Post-facto review
***
## Human-in-the-Loop (HITL)
When automation cannot proceed (e.g., hardware MFA, unexpected bank UI), the execution enters a controlled human intervention path.
HITL actions:
* Are permission-bound
* Are logged
* Emit state updates
* Do not bypass policy
***
## Design Philosophy
Waycore is opinionated:
* Bank permissions are the root authority.
* Every action is observable.
* State is explicit.
* Failure modes are surfaced, not hidden.
* Human-in-the-loop as a fallback for banks that require it.
# How it works
Source: https://docs.waycore.com/intro/how-it-works
Waycore turns a commercial bank portal into a programmable surface area using **entity-aware ownership**, **delegated user access**, and **observable state transitions**.
We act as an end-user's authorised representative, operating under a delegated user, at the portal level, to automate treasury workflows under human supervision.
***
## The Core Loop
Your platform starts by selecting or creating the business that owns the bank connection.
This entity becomes the ownership boundary for:
* Connections
* Accounts
* Transactions
* Your own internal customer mapping
Your platform either looks up the target institution in the public catalog or provides a raw bank portal URL, then creates or returns a connection.
If onboarding is still required, the setup-stage connection returns:
* Structured setup details
* The next required action
* Which party needs to take it
Your customer creates a dedicated user inside their bank portal for Waycore. Permissions are scoped explicitly by the bank.
Then the integrator:
* Submits the temporary credentials
* Marks bank-side setup complete
* Polls the connection until it is activated
Once activation is complete, the connection becomes `active`.
From there, your platform can:
* Read accounts
* Backfill transactions
* Trigger a sync when freshness matters, subject to connection cooldown
* Create and track transfers where transfer access is enabled
The public API exposes webhook notifications for operational changes such as:
* Connection status changes
* Fresh transaction sync availability
All of this sits on top of the same audit and operational control model that powers the broader Waycore platform.
***
## Guarantees
* Ownership is explicit through entities and connections.
* Every major state change is observable.
* Delegated access preserves bank-native permissions.
## Non-Guarantees
* Banks may change portal flows.
* MFA requirements vary by institution.
* Activation and sync latency depend on bank behavior.
* Bank portal uptime is not guaranteed.
# What is Waycore
Source: https://docs.waycore.com/intro/what-is-waycore
> **Waycore is a universal API adapter for commercial banking.** A business provisions a dedicated delegated user inside its existing bank portal, often through an onboarding interface hosted by its software provider; Waycore turns that bank-authorized workspace into one developer interface for balances, transactions, statements, payment preparation, approval support, audit trails, and recovery workflows across any commercial bank.
Through that API, Waycore delivers **treasury operations with the speed and flexibility of software**, without removing the permissions, approvals, and audit trails banks and finance teams rely on.
***
## The Problem
**Commercial banking access is not solved by connection lists or bank APIs.**
Aggregators often break down where commercial banking is most complex: incomplete coverage, stale data, limited write support, uneven scopes, and developer experiences built around what the connection can expose rather than what the workflow requires.
Bank API projects have the opposite problem: every bank exposes a different interface, approval process, permission model, file format, and operational surface area. Even when those bank APIs are wrapped by another provider, coverage is often limited, onboarding can take weeks, and access may still depend on relationship-manager approval or bank-side implementation work.
![Positioning chart comparing commercial banking access options by universal access and visibility/control.]()
A positioning chart comparing commercial banking access options by universal access and visibility/control. Existing approaches such as open banking aggregators, support matrices, ERP transaction feeds, manual portals, RPA scripts, custom integrations, and bank APIs are shown as partial or bank-by-bank solutions. Waycore is positioned in the high-access, high-control quadrant as remote control for any commercial bank account, exposing universal read/write access through one developer API while preserving bank-native permissions, approvals, and audit trails.
Waycore is best understood as a remote control for any commercial bank account. It is not limited to banks with open banking APIs, aggregator support, file rails, or bespoke bank integrations. Compared with alternatives, Waycore combines universal access with reliable visibility and control through a single developer API.
| Category | Universal access | Reliable visibility and control | Limitation |
| -------------------------------------------------- | ---------------: | ------------------------------: | -------------------------------------------------------------------------------------------------------------------------------- |
| Open banking and aggregators | Medium | Medium-low | Often read-only, institution-catalog dependent, and unreliable for commercial banking workflows. |
| ERP or accounting transaction feeds | Medium-low | Medium-low | Usually limited to transaction visibility and cannot reproduce full commercial banking workflows. |
| Reports, exports, spreadsheets, and manual portals | Low | Low | Bank-by-bank manual work with poor programmability and weak operational leverage. |
| RPA or internal scripts | Low-medium | Low | Fragile, bank-by-bank automation maintained internally. |
| Bank APIs and file rails | Low-medium | Medium-high | Reliable where available, but gated, partial, bank-specific, and not universal. |
| H2H, EBICS, SFTP, and custom integrations | Medium-low | Medium-high | Strong for selected banks and workflows, but expensive and bank-by-bank. |
| Selective connectivity vendors | Medium | Medium | Useful for selected banks or regions, but not universal commercial-bank coverage. |
| Waycore | High | High | Universal read/write access exposed through one developer API, governed by bank-native permissions, approvals, and audit trails. |
A positioning chart comparing commercial banking access options by universal access and visibility/control. Existing approaches such as open banking aggregators, support matrices, ERP transaction feeds, manual portals, RPA scripts, custom integrations, and bank APIs are shown as partial or bank-by-bank solutions. Waycore is positioned in the high-access, high-control quadrant as remote control for any commercial bank account, exposing universal read/write access through one developer API while preserving bank-native permissions, approvals, and audit trails.
Waycore is best understood as a remote control for any commercial bank account. It is not limited to banks with open banking APIs, aggregator support, file rails, or bespoke bank integrations. Compared with alternatives, Waycore combines universal access with reliable visibility and control through a single developer API.
| Category | Universal access | Reliable visibility and control | Limitation |
| -------------------------------------------------- | ---------------: | ------------------------------: | -------------------------------------------------------------------------------------------------------------------------------- |
| Open banking and aggregators | Medium | Medium-low | Often read-only, institution-catalog dependent, and unreliable for commercial banking workflows. |
| ERP or accounting transaction feeds | Medium-low | Medium-low | Usually limited to transaction visibility and cannot reproduce full commercial banking workflows. |
| Reports, exports, spreadsheets, and manual portals | Low | Low | Bank-by-bank manual work with poor programmability and weak operational leverage. |
| RPA or internal scripts | Low-medium | Low | Fragile, bank-by-bank automation maintained internally. |
| Bank APIs and file rails | Low-medium | Medium-high | Reliable where available, but gated, partial, bank-specific, and not universal. |
| H2H, EBICS, SFTP, and custom integrations | Medium-low | Medium-high | Strong for selected banks and workflows, but expensive and bank-by-bank. |
| Selective connectivity vendors | Medium | Medium | Useful for selected banks or regions, but not universal commercial-bank coverage. |
| Waycore | High | High | Universal read/write access exposed through one developer API, governed by bank-native permissions, approvals, and audit trails. |
Waycore takes a different path. It adapts the bank-authorized workspace the business can already provision, then exposes the underlying treasury workflow through **one developer API**.
For banks Waycore already supports, we **aim to go-live in under 8 hours** after the delegated user is created. For newly requested banks, Waycore aims to add support in **under 48 hours** from the point the required bank-side sub-user or authorized portal profile is available. \
\
Waycore supports **any bank** that supports sub-users.
So, if you're building:
* A treasury platform
* An ERP
* An AP automation tool
* A lending or capital product
You eventually hit the same wall:
> You can’t reliably see, let alone move money across commercial banks.
***
## The Waycore Model
Waycore makes a company’s delegated bank workspace programmable through dedicated delegated-user access.
Instead of scraping with shared credentials, your customer:
1. Creates a delegated user inside their bank
2. Assigns permissions (read, transfer, approval)
3. Connects that user to Waycore
Waycore then:
* Onboards delegated-user bank connections
* Reads balances and account data
* Normalizes accounts and transactions
* Creates and tracks transfers where transfer access is enabled
* Emits real-time webhooks
* Maintains a complete audit trail
Transfer execution remains bounded by the delegated user's bank permissions, bank-side approval requirements, and the institution capabilities available to your integration.
***
## What Waycore Is Not
* Not a consumer bank aggregator
* Not a neobank
* Not a regulated Payment Service Provider (PSP) or Third Party Provider (TPP) under PSD2
* Not a UI-first treasury tool
* Not dependent on bank APIs
Waycore is infrastructure.
***
## Who It’s For
When bank connectivity gaps create manual work, broken workflows, or bank-by-bank integration overhead.
When customers need balances, transactions, statements, or payment actions at commercial banks that are hard to support.
When teams are already logging into bank portals on behalf of clients and need to reduce manual effort, errors, and servicing cost.
When critical bank workflows still depend on portal hopping, downloads, and error-prone manual intervention.
***
## Design Principles
* Deterministic > probabilistic
* Execution > aggregation
* Delegated access > credential sharing
* Policy before action
* Observable by default
***
## Summary
Waycore turns commercial bank portals into programmable infrastructure. If your product needs reliable bank connectivity, read capabilities, and transfer workflows where enabled, Waycore is your gateway.
# Evaluation Terms
Source: https://docs.waycore.com/legal/evaluation-terms
*Last updated: June 3rd, 2026*
These Terms of Service (the “Terms”) are a contract between you and the applicable **Waycore** contracting entity (“Waycore,” “we,” “our,” or “us”), determined as follows: (a) if your principal place of business is in the United States, Waycore is **Waycore, Inc., a Delaware corporation**; (b) if your principal place of business is in the United Kingdom, the European Economic Area, Switzerland, or any jurisdiction other than the United States, Waycore is **Waycore Ltd, a private company incorporated in England and Wales**; and (c) if an Order Form or other written agreement between you and Waycore identifies a different contracting entity, that agreement controls.
By accessing or using any Waycore evaluation environment, sandbox, API credentials, developer tools, documentation, support channels, demonstrations, proof-of-concept environments, or related materials (collectively, the “Evaluation Services”), you agree to be bound by these Terms. If you are accepting these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity. If you do not agree to these Terms, you must not access or use the Evaluation Services.
## **1. Purpose of Evaluation**
Waycore grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable right to access and use the Evaluation Services solely for your internal evaluation of Waycore's products and services. The Evaluation Services may not be used for production workloads, customer-facing services, commercial operations, or any purpose other than evaluating whether to enter into a commercial relationship with Waycore. No rights are granted except those expressly stated in these Terms.
## **2. Eligibility and Accounts**
You must be at least 18 years old and have full power and authority to enter into these Terms. To access certain Evaluation Services, you may be required to create an account or receive credentials from Waycore. You agree to provide accurate, complete, and current information. You are responsible for maintaining the confidentiality of all credentials, API keys, tokens, and access mechanisms associated with your account and for all activities that occur under those credentials.
## **3. Evaluation Environment**
The Evaluation Services are provided solely for testing, evaluation, and technical review. Waycore may modify, suspend, restrict, replace, or discontinue any portion of the Evaluation Services at any time and without notice. Features, APIs, functionality, workflows, user interfaces, data models, documentation, pricing, product plans, and technical specifications may change at any time. Waycore has no obligation to continue offering any feature made available during evaluation or to make any feature generally available.
## **4. Evaluation Data**
You are responsible for all data, content, files, prompts, inputs, and materials that you submit to the Evaluation Services ("Evaluation Data"). Unless otherwise agreed in writing, you should not submit production customer data, regulated personal data, financial credentials, banking credentials, payment card information, health information, or other highly sensitive information to the Evaluation Services. You represent that you possess all rights, permissions, and consents necessary to provide Evaluation Data to Waycore. Waycore may process Evaluation Data solely as necessary to provide, maintain, secure, support, and improve the Evaluation Services.
## **5. Confidentiality**
The Evaluation Services and all non-public information disclosed by Waycore constitute Waycore Confidential Information.
Confidential Information includes, without limitation:
* APIs and API specifications;
* documentation;
* product functionality;
* user interfaces;
* architecture and technical designs;
* security controls and operational processes;
* pricing and commercial information;
* demonstrations and proof-of-concept environments;
* performance characteristics;
* roadmaps and future plans;
* support communications;
* screenshots, recordings, and exports;
* evaluation results and observations.
You agree to: (a) protect Confidential Information using at least reasonable care; (b) use Confidential Information solely for evaluating Waycore; (c) not disclose Confidential Information to any third party except employees, contractors, advisors, and representatives who have a need to know and who are bound by confidentiality obligations at least as protective as these Terms.
You may not publish, disclose, distribute, or communicate benchmark results, performance analyses, security findings, competitive comparisons, reviews, screenshots, recordings, blog posts, press releases, customer references, social media posts, or other public commentary relating to the Evaluation Services without Waycore's prior written consent.
The obligations in this Section survive for five (5) years following termination.
## **6. Acceptable Use**
You will not, and will not permit any third party to: (a) use the Evaluation Services for production purposes; (b) copy, reproduce, distribute, sell, lease, sublicense, or otherwise make available the Evaluation Services; (c) modify, adapt, translate, or create derivative works of the Evaluation Services; (d) reverse engineer, decompile, disassemble, decode, or otherwise attempt to discover source code, algorithms, models, workflows, architectures, or underlying technical implementations; (e) access the Evaluation Services for the purpose of developing, improving, training, benchmarking, validating, or operating a competing product or service; (f) use the Evaluation Services to create competing documentation, specifications, APIs, schemas, or product designs; (g) interfere with or disrupt the Evaluation Services; (h) exceed any rate limits, quotas, or technical restrictions imposed by Waycore; (i) circumvent security controls or access restrictions; (j) use the Evaluation Services in violation of applicable law.
## **7. Security Testing Restrictions**
You may not conduct or attempt any penetration testing, vulnerability scanning, stress testing, denial-of-service testing, fuzzing, credential attacks, automated extraction, scraping, security research, or similar activities without Waycore's prior written approval.
Nothing in these Terms grants permission to test or evaluate the security of Waycore's systems beyond ordinary product evaluation.
## **8. Intellectual Property**
The Evaluation Services are licensed, not sold. Waycore and its licensors retain all right, title, and interest in and to the Evaluation Services, including all intellectual property rights. No ownership rights are transferred to you under these Terms. You may not remove, alter, obscure, or destroy any copyright notices, trademarks, proprietary legends, or other notices contained within the Evaluation Services.
## **9. Feedback**
If you provide comments, suggestions, ideas, bug reports, recommendations, or other feedback regarding the Evaluation Services ("Feedback"), Waycore may use, modify, incorporate, disclose, commercialize, and otherwise exploit such Feedback without restriction and without compensation or attribution.
## **10. No Service Commitments**
The Evaluation Services are pre-production offerings. Waycore provides no service-level commitments, uptime commitments, support commitments, maintenance commitments, response-time commitments, recovery commitments, or data-retention commitments in connection with the Evaluation Services. The Evaluation Services may contain errors, defects, interruptions, inaccuracies, incomplete functionality, or experimental features.
## **11. No Obligation to Contract**
Participation in an evaluation does not obligate either party to enter into any commercial agreement. Any production use of Waycore's services requires a separate written agreement between the parties.
## **12. Suspension and Termination**
These Terms commence when you first access the Evaluation Services and continue until terminated. Waycore may suspend, restrict, or terminate access to the Evaluation Services at any time, with or without cause and with or without notice. Upon termination, all rights granted under these Terms immediately cease and you must stop using the Evaluation Services. Upon request, you will destroy or return any Waycore Confidential Information in your possession. Sections intended to survive termination shall survive termination, including Sections 5, 8, 9, 13, 14, 15, and 16.
## **13. Disclaimers**
The Evaluation Services are provided solely for testing, evaluation, and technical review. Waycore may modify, suspend, restrict, replace, or discontinue any portion of the Evaluation Services at any time and without notice. Features, APIs, functionality, workflows, user interfaces, data models, documentation, pricing, product plans, and technical specifications may change at any time. Waycore has no obligation to continue offering any feature made available during evaluation or to make any feature generally available.
## **4. Evaluation Data**
You are responsible for all data, content, files, prompts, inputs, and materials that you submit to the Evaluation Services ("Evaluation Data"). Unless otherwise agreed in writing, you should not submit production customer data, regulated personal data, financial credentials, banking credentials, payment card information, health information, or other highly sensitive information to the Evaluation Services. You represent that you possess all rights, permissions, and consents necessary to provide Evaluation Data to Waycore. Waycore may process Evaluation Data solely as necessary to provide, maintain, secure, support, and improve the Evaluation Services.
## **5. Confidentiality**
The Evaluation Services and all non-public information disclosed by Waycore constitute Waycore Confidential Information.
Confidential Information includes, without limitation:
* APIs and API specifications;
* documentation;
* product functionality;
* user interfaces;
* architecture and technical designs;
* security controls and operational processes;
* pricing and commercial information;
* demonstrations and proof-of-concept environments;
* performance characteristics;
* roadmaps and future plans;
* support communications;
* screenshots, recordings, and exports;
* evaluation results and observations.
You agree to: (a) protect Confidential Information using at least reasonable care; (b) use Confidential Information solely for evaluating Waycore; (c) not disclose Confidential Information to any third party except employees, contractors, advisors, and representatives who have a need to know and who are bound by confidentiality obligations at least as protective as these Terms.
You may not publish, disclose, distribute, or communicate benchmark results, performance analyses, security findings, competitive comparisons, reviews, screenshots, recordings, blog posts, press releases, customer references, social media posts, or other public commentary relating to the Evaluation Services without Waycore's prior written consent.
The obligations in this Section survive for five (5) years following termination.
## **6. Acceptable Use**
You will not, and will not permit any third party to: (a) use the Evaluation Services for production purposes; (b) copy, reproduce, distribute, sell, lease, sublicense, or otherwise make available the Evaluation Services; (c) modify, adapt, translate, or create derivative works of the Evaluation Services; (d) reverse engineer, decompile, disassemble, decode, or otherwise attempt to discover source code, algorithms, models, workflows, architectures, or underlying technical implementations; (e) access the Evaluation Services for the purpose of developing, improving, training, benchmarking, validating, or operating a competing product or service; (f) use the Evaluation Services to create competing documentation, specifications, APIs, schemas, or product designs; (g) interfere with or disrupt the Evaluation Services; (h) exceed any rate limits, quotas, or technical restrictions imposed by Waycore; (i) circumvent security controls or access restrictions; (j) use the Evaluation Services in violation of applicable law.
## **7. Security Testing Restrictions**
You may not conduct or attempt any penetration testing, vulnerability scanning, stress testing, denial-of-service testing, fuzzing, credential attacks, automated extraction, scraping, security research, or similar activities without Waycore's prior written approval. Nothing in these Terms grants permission to test or evaluate the security of Waycore's systems beyond ordinary product evaluation.
## **8. Intellectual Property**
The Evaluation Services are licensed, not sold. Waycore and its licensors retain all right, title, and interest in and to the Evaluation Services, including all intellectual property rights. No ownership rights are transferred to you under these Terms. You may not remove, alter, obscure, or destroy any copyright notices, trademarks, proprietary legends, or other notices contained within the Evaluation Services.
## **9. Feedback**
If you provide comments, suggestions, ideas, bug reports, recommendations, or other feedback regarding the Evaluation Services ("Feedback"), Waycore may use, modify, incorporate, disclose, commercialize, and otherwise exploit such Feedback without restriction and without compensation or attribution.
## **10. No Service Commitments**
The Evaluation Services are pre-production offerings. Waycore provides no service-level commitments, uptime commitments, support commitments, maintenance commitments, response-time commitments, recovery commitments, or data-retention commitments in connection with the Evaluation Services. The Evaluation Services may contain errors, defects, interruptions, inaccuracies, incomplete functionality, or experimental features.
## **11. No Obligation to Contract**
Participation in an evaluation does not obligate either party to enter into any commercial agreement. Any production use of Waycore's services requires a separate written agreement between the parties.
## **12. Suspension and Termination**
These Terms commence when you first access the Evaluation Services and continue until terminated. Waycore may suspend, restrict, or terminate access to the Evaluation Services at any time, with or without cause and with or without notice. Upon termination, all rights granted under these Terms immediately cease and you must stop using the Evaluation Services. Upon request, you will destroy or return any Waycore Confidential Information in your possession. Sections intended to survive termination shall survive termination, including Sections 5, 8, 9, 13, 14, 15, and 16.
## **13. Disclaimers**
THE EVALUATION SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE."
TO THE MAXIMUM EXTENT PERMITTED BY LAW, WAYCORE DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, ACCURACY, RELIABILITY, AVAILABILITY, SECURITY, OR PERFORMANCE.
WAYCORE DOES NOT WARRANT THAT THE EVALUATION SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, SECURE, OR FREE FROM HARMFUL COMPONENTS.
## **14. Limitation of Liability**
TO THE MAXIMUM EXTENT PERMITTED BY LAW, WAYCORE'S TOTAL LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE EVALUATION SERVICES WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS (US \$100).
IN NO EVENT WILL WAYCORE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOST PROFITS, LOST REVENUE, LOST DATA, LOST BUSINESS OPPORTUNITIES, LOSS OF GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
## **15. Governing Law and Dispute Resolution**
These Terms and any dispute, claim, or controversy arising out of or relating to these Terms or the Evaluation Services will be governed by the laws of the jurisdiction of the applicable Waycore contracting entity, without regard to conflict-of-law principles. If you are contracting with Waycore, Inc., these Terms and any such dispute will be governed by the laws of the State of Delaware, and the state and federal courts located in Delaware will have exclusive jurisdiction. If you are contracting with Waycore Ltd, these Terms and any such dispute will be governed by the laws of England and Wales, and the courts of England and Wales will have exclusive jurisdiction. Before bringing any formal proceeding, the parties will first attempt to resolve the dispute in good faith.
## **16. Miscellaneous**
These Terms constitute the entire agreement between the parties regarding the Evaluation Services and supersede all prior or contemporaneous understandings relating to the Evaluation Services. If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect. No failure or delay by either party in exercising any right under these Terms will constitute a waiver of that right. You may not assign these Terms without Waycore's prior written consent. Waycore may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of assets. Nothing in these Terms creates a partnership, joint venture, employment relationship, or agency relationship between the parties.
These Terms constitute the entire agreement between the parties regarding the Evaluation Services and supersede all prior or contemporaneous understandings relating to the Evaluation Services. If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect. No failure or delay by either party in exercising any right under these Terms will constitute a waiver of that right. You may not assign these Terms without Waycore's prior written consent. Waycore may assign these Terms in connection with a merger, acquisition, corporate reorganization, or sale of assets. Nothing in these Terms creates a partnership, joint venture, employment relationship, or agency relationship between the parties.
## **17. Contact**
If you have any questions about these Terms, please contact Waycore at [hello@waycore.com](mailto:hello@waycore.com).
# Privacy Policy
Source: https://docs.waycore.com/legal/privacy-policy
This Privacy Notice explains how the applicable Waycore entity (“Waycore,” “we,” “our,” or “us”) collects, uses, shares, and protects personal data when you use Waycore’s software and related services (the “Services”). It also describes the rights and choices available to you.
## **1. Who we are**
The Waycore entity responsible for processing your personal data under this Privacy Notice depends on your relationship with us and the Waycore entity with which you contract:
* if your principal place of business is in the United States, the responsible entity is **Waycore, Inc., a Delaware corporation**;
* if your principal place of business is in the United Kingdom, the European Economic Area, Switzerland, or any jurisdiction other than the United States, the responsible entity is **Waycore Ltd, a private company incorporated in England and Wales**;
* if an Order Form or other written agreement with Waycore identifies a different Waycore entity, that agreement controls.
**Waycore Ltd**\
Company number: 16451137\
Registered office: 12 New Fetter Lane, London, United Kingdom, EC4A 1JP
**Waycore, Inc.**\
File number: 10476670\
Registered office: 12 New Fetter Lane, London, United Kingdom, EC4A 1JP
Email: [hello@waycore.com](mailto:hello@waycore.com)
For the purposes of applicable data protection law, the relevant Waycore entity identified above is the controller of the personal data described in this Privacy Notice, except where this Notice states otherwise.
## 2. Scope of this Notice
This Privacy Notice applies to:
* visitors to our websites and documentation portals;
* authorized users of the Services;
* business contacts at our customers, prospects, suppliers, and partners; and
* personal data contained in customer data that we process on behalf of our customers in connection with the Services.
Our Services are designed for business use. They are not directed to children.
## 3. Personal data we collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
* **Account and profile data**, such as your name, business email address, telephone number, title, employer, username, and authentication credentials;
* **Customer data**, such as bank, treasury, accounting, transaction, statement, and related operational data that our customers or their authorized users choose to connect, import, transmit, or make available through the Services, which may incidentally include personal data;
* **Usage and device data**, such as log data, IP address, browser type, device identifiers, timestamps, pages viewed, API requests, and feature usage;
* **Communications data**, such as correspondence with us, support requests, meeting notes, and feedback;
* **Marketing data**, such as subscription preferences, event registrations, and survey responses; and
* **Cookie and similar technology data**, as described in any cookie notice or similar disclosure we make available.
Please do not submit sensitive personal data to the Services unless it is necessary for the relevant business use case and permitted by your organization and applicable law.
## 4. How we use personal data
We use personal data for the following purposes:
* to provide, operate, maintain, support, and secure the Services;
* to authenticate users and manage accounts;
* to process, transmit, display, and otherwise handle customer data in accordance with our customers’ instructions;
* to communicate with you about the Services, including support, service notices, updates, and administrative matters;
* to manage our business relationships with customers, prospects, suppliers, and partners;
* to monitor, troubleshoot, audit, and improve the performance, reliability, and security of the Services;
* to develop new features and functionality;
* to comply with legal, regulatory, contractual, and risk-management requirements; and
* to send marketing communications where permitted by law, subject to your choices.
### Our role
Where we process personal data for our own business purposes, such as account administration, relationship management, billing, security, website operation, and product improvement, we act as a **controller**.
Where we process customer data on behalf of a customer and in accordance with that customer’s instructions, we act as a **processor** or **service provider**, as applicable. In those cases, the relevant customer is responsible for its own privacy disclosures and for handling rights requests relating to that data, unless applicable law requires otherwise.
### Lawful bases
Where required by applicable law, we rely on one or more of the following legal bases:
* performance of a contract or steps taken at your request before entering into a contract;
* compliance with a legal obligation;
* our legitimate interests, including operating, securing, supporting, and improving the Services and managing our business relationships, provided those interests are not overridden by your rights; and
* your consent, where required by law.
## 5. Aggregated and de-identified data
We may create aggregated, statistical, and de-identified data from personal data and customer data for purposes such as analytics, service improvement, benchmarking, capacity planning, security monitoring, and product development, provided that the resulting information does not identify you or any specific individual.
We do not use raw customer bank or accounting records for unrelated marketing purposes. We do not sell personal data.
## 6. How we share personal data
We may share personal data with:
* our affiliates;
* cloud infrastructure, hosting, analytics, communications, security, and other service providers that support the Services;
* professional advisors, such as lawyers, auditors, insurers, and accountants;
* counterparties involved in a merger, acquisition, financing, reorganization, or sale of assets; and
* regulators, courts, law enforcement, or other third parties where required by law or where necessary to protect our rights, users, customers, or the Services.
Where we process customer data on behalf of a customer, we share that data only as permitted by our agreement with that customer, the customer’s instructions, or applicable law.
## 7. International transfers
Waycore and its service providers may process personal data in the United States, the United Kingdom, the European Economic Area, and other jurisdictions in which we or our providers operate.
Where we transfer personal data outside the United Kingdom, the European Economic Area, or Switzerland, we will use appropriate safeguards where required by applicable law, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum, or another lawful transfer mechanism.
You may request additional information about the safeguards relevant to your personal data by contacting us at [hello@waycore.com](mailto:hello@waycore.com).
## 8. Security
We implement administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include encryption in transit and at rest where appropriate, access controls, authentication measures, logging and monitoring, backup and recovery procedures, vendor review, and vulnerability-management practices.
No security measure is perfect, and we cannot guarantee absolute security.
## 9. Data retention
We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Notice, including to provide the Services, comply with legal obligations, resolve disputes, enforce our agreements, and protect our business.
In general:
* customer data is retained in accordance with our agreements with customers and our customers’ instructions;
* account, contact, billing, and relationship data is retained for the duration of the relationship and for a reasonable period thereafter;
* usage logs and security records are retained for as long as reasonably necessary for security, support, audit, and service-improvement purposes; and
* aggregated or de-identified data may be retained for longer periods, including indefinitely, where it no longer identifies any individual.
## 10. Your rights
Depending on your location and the circumstances, you may have rights to:
* access personal data;
* correct inaccurate personal data;
* delete personal data;
* restrict or object to certain processing;
* withdraw consent where processing is based on consent;
* receive a portable copy of certain personal data; and
* lodge a complaint with a competent supervisory authority.
If we process your personal data on behalf of one of our customers, you should ordinarily direct your request to that customer first. We may assist our customers in responding to such requests where required by law or contract.
You may opt out of marketing communications at any time by using the unsubscribe mechanism in the relevant message or by contacting us at [hello@waycore.com](mailto:hello@waycore.com).
If you are in the United Kingdom, you may also lodge a complaint with the Information Commissioner’s Office.
### 10a. How to request deletion
To request deletion of personal data, email **[hello@waycore.com](mailto:hello@waycore.com)** with the subject line *"Data deletion request"*. Please include:
* the requester's name and contact email;
* the entity, organization, or account the request relates to;
* the scope of the request (e.g. all personal data, a specific account, or a specific dataset); and
* any relevant identifiers (account ID, user ID, or email used with the Services).
We may ask for additional information to verify the requester's identity and authority before acting on a request, particularly where the request relates to a customer organization's data.
We aim to acknowledge requests within **5 business days** of receipt and to complete verified requests within **30 days**, in line with the timeframes contemplated by the GDPR. We may extend this period where permitted by law for complex or numerous requests and will notify the requester if we do.
Some data may be retained after a deletion request where we are legally required or permitted to do so (for example, audit logs, fraud-prevention records, or information required to comply with financial-services obligations). Where this applies, we will describe what is being retained and why.
## 11. Automated decision-making
Waycore does not engage in solely automated decision-making that produces legal effects or similarly significant effects on individuals.
## 12. Contact us
If you have questions about this Privacy Notice or our privacy practices, please contact us at:
[hello@waycore.com](mailto:hello@waycore.com)
or by mail to:
**Waycore UK Ltd **or** Waycore, Inc.**\
12 New Fetter Lane\
London\
United Kingdom\
EC4A 1JP
## 13. Updates to this Notice
We may update this Privacy Notice from time to time. If we make a material change, we will post the updated version here and, where appropriate, notify customers or users through the Services or by email. The revised Privacy Notice will become effective when posted unless otherwise stated.
# Terms of Use
Source: https://docs.waycore.com/legal/terms-of-use
*Last updated: May 10th, 2026*
These Terms of Service (the “Terms”) are a contract between you and the applicable **Waycore** contracting entity (“Waycore,” “we,” “our,” or “us”), determined as follows: (a) if your principal place of business is in the United States, Waycore is **Waycore, Inc., a Delaware corporation**; (b) if your principal place of business is in the United Kingdom, the European Economic Area, Switzerland, or any jurisdiction other than the United States, Waycore is **Waycore Ltd, a private company incorporated in England and Wales**; and (c) if an Order Form or other written agreement between you and Waycore identifies a different contracting entity, that agreement controls.
By accessing or using Waycore’s software, application-programming interfaces (the “API”), websites, and any related documentation or support (collectively, the “Services”), you agree to be bound by these Terms. If you are accepting these Terms on behalf of a company or other legal entity, you represent that you have authority to bind that entity. If you do not agree to these Terms, you must not access or use the Services.
## **1. Eligibility and Accounts**
You must be at least 18 years old and have full power and authority to enter into these Terms. To use certain features you must create an account and provide accurate, complete, and current information. You are responsible for all activities that occur under your credentials and must keep them secure.
## **2. Changes to Terms or Services**
We may update these Terms or the Services from time to time. Material changes will be posted on our website or sent to your account email at least 30 days before they take effect, unless immediate changes are required by law or to protect the security of the Services. Continued use after the effective date constitutes acceptance.
## **3. Description of Services**
Waycore provides software-enabled treasury operations and programmable bank connectivity for business customers. The Services may include delegated access workflows, bank data retrieval, account and transaction synchronization, statement collection, payment preparation or staging, treasury workflow automation, APIs, webhooks, dashboards, operational support, and related functionality.
Waycore performs these Services solely for the customer’s own treasury, finance, accounting, and operational purposes, and only as directed by the customer through the Services, an Order Form, a Statement of Work, or other agreed instructions.
### 3.A. Your Authorized Representative
By using the Services, you appoint Waycore, including its employees and the automated systems they supervise, as your authorized agent and representative (“Authorized Representative”). This appointment is solely for the purpose of accessing your designated financial accounts and performing actions on your behalf as explicitly directed by you through the Services. You agree that all actions taken by Waycore as your Authorized Representative are considered to be your actions.
Waycore acts in this capacity solely to perform your treasury, finance, accounting, and operational workflows, and not to harvest, resell, independently exploit, or redistribute financial institution portal data for Waycore’s own purposes.
You retain full responsibility for all instructions you provide to the Services. Waycore provides technical and operational support for your treasury functions. Waycore is not a bank, payment institution, or regulated payment service provider.
### 3.B. Delegated Access and Human Oversight
To use the Services, the user agrees to create and provide the company with dedicated access credentials (a “sub-user,” “delegate,” or similar profile with limited permissions) for the user's financial accounts (“Delegated Access”). The user will not provide the company with the user's primary or administrator login credentials. The user is responsible for creating and managing the permissions of this delegate profile within the financial institution’s platform.
1. **Service Profiles and Individual Access.** The user acknowledges that the Delegated Access profile may be provisioned as a corporate or service user (a "Service Profile"). Where a financial institution's terms require that access be exercised by an "individual," the user agrees that the Service Profile operates strictly as a secure conduit for individual access. The company warrants that every session initiated through the Service Profile is directed by, and immutably attributed to, a specific, authenticated individual within the company's organization.
2. **Named Officer Designation and Sub-Delegation.** Should a financial institution technically prohibit a Service Profile naming convention during enrollment, the user authorizes the company to designate a specific company senior officer or accountable manager (the "Named Officer") as the registered profile holder. The user expressly consents to the Named Officer sub-delegating the execution of portal actions to authorized company personnel. The company accepts full accountability for the actions of its sub-delegated personnel acting under the Named Officer's profile.
3. **Human Oversight.** While the Services use automated systems to assist in gathering, organizing, transmitting, and preparing information or workflows, all activities performed on the user’s behalf are subject to the oversight and final authority of the company’s trained human agents. The user authorizes these agents, acting as the user’s Authorized Representative, to supervise the automated systems and provide final approval for actions as required by the operational workflow. Where required by configuration or bank policy, the company will only prepare or stage transactions, requiring the user’s separate approval within the bank portal for execution.
### **3.C. Customer Compliance with Third-Party Terms**
The user represents and warrants that it possesses the authority to appoint the company as its agent and to authorize the access models described herein. The user assumes sole responsibility for ensuring that this delegated access model does not violate any binding agreement between the user and its financial institutions. The company disclaims all liability for any suspension, termination, or disruption of portal access, or any freezing of the user's accounts, arising from a financial institution's enforcement of its portal terms against the models authorized by the user in Section 3.B.
## **4. Customer Data**
"Customer Data" means any data, content, or materials that you or your authorised users, **including Waycore acting as your Authorized Representative**, submit to or generate through the Services, including bank transaction logs, accounting records, prompts, and files. You retain all rights in Customer Data, subject to the licences granted in Section 5. You represent that you have obtained all necessary rights and consents to provide Customer Data to Waycore and to appoint Waycore as your Authorized Representative to access it on your behalf.
## **5. Permitted Use of Customer Data**
You grant Waycore a non-exclusive, worldwide licence to host, copy, process, transmit, and display Customer Data solely as necessary to (i) provide and maintain the Services; (ii) detect, prevent, and resolve security or technical issues; and (iii) develop, train, and improve our models, algorithms, and features, only after Customer Data has been de-identified and aggregated so that neither you nor any natural person or legal entity can be identified.
Waycore will not sell, disclose, harvest, resell, independently exploit, or otherwise use raw, identifiable Customer Data for advertising, marketing, benchmarking, enrichment, or redistribution purposes, except as expressly directed by the user or permitted under these Terms.
## **6. Privacy and Security**
Our collection and use of personal data is governed by the Waycore Privacy Notice. We maintain administrative, technical, and physical safeguards designed to protect Customer Data consistent with applicable law and industry standards. Where relevant to a Customer’s compliance needs, our safeguards are designed to align with frameworks such as the **GLBA Safeguards Rule** and **SOC 2** controls, and with U.S. state privacy requirements including **CPRA**, to the extent applicable.
## **7. Confidentiality**
Each party agrees to protect the other party’s non‑public information using the same degree of care it uses to protect its own confidential information (but not less than reasonable care) and to use such information only to perform under these Terms. This duty survives for five (5) years after termination.
## **8. Acceptable Use**
You will not (and will not allow anyone else to): (a) use the Services in violation of any applicable law; (b) attempt to reverse engineer, decompile, or discover the source code or underlying algorithms of the Services except to the extent such restriction is prohibited by law; (c) use the Services to develop or train competing models or services; (d) submit or store infringing, defamatory, or otherwise unlawful content; (e) interfere with or disrupt the Services or their integrity or performance; or (f) exceed rate limits or quotas specified by Waycore.
## **9. Fees and Payment**
If your plan requires payment, you agree to pay all fees specified in an order form or price schedule. Fees are non‑refundable unless required by law. Late payments may accrue interest at 1.5 % per month or the maximum rate permitted by law.
## **10. Intellectual Property; Feedback**
Except for Customer Data, Waycore and its licensors own all rights, title, and interest in the Services, including all intellectual‑property rights and training data generated under Section 5. If you provide feedback or suggestions, Waycore may use them without restriction or obligation to you.
## **11. Open‑Source and Third‑Party Software**
The Services may include components subject to open‑source licences. Such components are provided to you under their respective licences, which shall govern your use to the extent required by those licences.
## **12. Term, Suspension, and Termination**
These Terms commence when you first use the Services and continue until terminated. Either party may terminate for cause if the other party materially breaches these Terms and fails to cure within thirty (30) days’ notice.
Waycore may suspend your access immediately if needed to protect the Services or comply with law. Upon termination, your licence ends and you must cease use; Waycore will delete or return Customer Data within thirty (30) days, except that de‑identified, aggregated data created under Section 5 may be retained.
You may revoke Waycore's Delegated Access at any time by removing or disabling the delegate user within your financial institution's platform. Such revocation will immediately terminate Waycore's ability to access your accounts, regardless of the status of these Terms.
## **13. Disclaimers**
The Services are provided **“as is”** without warranties of any kind, whether express, implied, statutory, or otherwise, including warranties of merchantability, fitness for a particular purpose, non‑infringement, or availability. Waycore does not warrant that the Services will be uninterrupted, error‑free, or free of harmful components, or that any output will be accurate or meet your requirements. Waycore does not warrant or guarantee that any financial institution will permit, accept, or continue to permit Delegated Access or the use of the Services. You acknowledge that financial institutions may, at their sole discretion, restrict, suspend, or terminate access to their platforms for any reason.
## **14. Limitation of Liability**
To the maximum extent permitted by law, in no event will Waycore’s total liability arising out of or relating to these Terms exceed the amounts you paid (if any) to Waycore for the Services in the twelve (12) months before the event giving rise to the claim, or one hundred U.S. dollars (US \$100) if no fees were paid. Waycore will not be liable for any indirect, incidental, consequential, special, or punitive damages, or for lost profits or revenues, even if advised of the possibility.
## **15. Indemnification**
The user will defend, indemnify, and hold harmless the company, its affiliates, and their respective officers (including any Named Officer designated under Section 3.B(2)), directors, employees, and agents from and against any third‑party claims, damages, or expenses (including reasonable legal fees) arising from the user's Customer Data, the user's use of the Services in violation of these Terms, the user's breach of Section 8, the user's **breach of** **any third-party terms of use (including those of the user's financial institutions), or any misrepresentation regarding the user's authority to appoint the company as the user's Authorized Representative.**
## **16. Export and Sanctions Compliance**
You represent that you are not located in, organised under the laws of, or ordinarily resident in any country subject to comprehensive U.S. sanctions, and that you are not on any U.S. government list of prohibited or restricted parties. You will comply with all applicable export‑control and sanctions laws.
## **17. Governing Law and Dispute Resolution**
These Terms and any dispute, claim, or controversy arising out of or relating to these Terms or the Services will be governed by the laws of the jurisdiction of the applicable Waycore contracting entity, without regard to conflict-of-law principles. If you are contracting with **Waycore, Inc., these Terms and any such dispute will be governed by the laws of the State of Delaware**, and the state and federal courts located in Delaware will have exclusive jurisdiction. If you are contracting with **Waycore Ltd, these Terms and any such dispute will be governed by the laws of England and Wales**, and the courts of England and Wales will have exclusive jurisdiction. Before bringing any formal proceeding, the parties will first attempt to resolve the dispute in good faith. Each party consents to the personal jurisdiction and venue of the applicable courts identified above.
## **18. Miscellaneous**
These Terms, together with any applicable Order Form, Statement of Work, Data Processing Addendum, service-specific terms, or other written agreement between the parties that incorporates these Terms or references the Services, constitute the entire agreement between the parties regarding the Services and supersede all prior or contemporaneous agreements, proposals, or understandings on that subject. In the event of a conflict, the order of precedence will be: (a) the applicable Order Form or other signed written agreement; (b) any Statement of Work, Data Processing Addendum, or service-specific terms; and (c) these Terms. If any provision of these Terms is held unenforceable, the remaining provisions will remain in full force and effect. Neither party may assign these Terms without the other party’s prior written consent, except that Waycore may assign these Terms, in whole or in part, to an affiliate or in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets. Any attempted assignment in violation of this Section will be void.
## **19. Contact**
If you have any questions about these Terms, please contact Waycore at [hello@waycore.com](mailto:hello@waycore.com)
# What the alternative really costs
Source: https://docs.waycore.com/pricing/cost-of-the-alternative
Business-bank connectivity is often treated like commodity infrastructure. In practice, it is not.
For many commercial accounts, open banking and aggregator-led connectivity is incomplete, brittle, delayed, or simply unavailable. Coverage varies by bank and geography. Data quality can be inconsistent. Resolution times are often too slow for the connection to function as real infrastructure.
When that abstraction breaks, the work does not disappear. It falls back onto people.
Many business-bank connections do not exist at all, or only exist in a shallow, unreliable form.
When a connection breaks, resolution can take days or weeks. That is not dependable infrastructure.
The burden shifts to finance, ops, implementation, or support teams to manually recover the workflow.
***
## What the alternative actually looks like
In practice, teams usually end up in one of three states.
First, someone logs into bank portals, downloads statements, aligns formats, checks for duplicates, and uploads data into the ERP or ledger.
Second, they pursue direct bank feeds or file-based integrations bank by bank, with long lead times, setup friction, and limited cadence.
Third, they rely on an aggregator where possible and absorb the rest of the mess through support, implementation, and manual workarounds.
Portal login, statement download, cleanup, de-dup, upload, repeat.
Weeks of lead time, coordination overhead, bank-by-bank rollout, low frequency.
Some banks work, others do not, and the hard cases become operational burden.
***
## A simple economics example
Assume the conservative estimate of a finance or ops person spending 2 hours per week across 3 banks pulling statements, aligning formats, checking for duplicates, and pushing data downstream.
Conservatively priced at \$35 per hour, that is already a meaningful monthly cost for a low-frequency workflow.
If you want the same workflow daily rather than weekly, or operate across more banks of regions, the cost scales quickly.
| Scenario | Assumption | Monthly cost |
| :---------------------- | :------------------------------ | :--------------- |
| Manual weekly workflow | 2 hrs/week at \$35/hr | \$280 |
| Manual daily workflow | \~10 hrs/week at \$35/hr | \~\$1,400 |
| Bank file / direct feed | Typical market pricing per bank | \~\$250 per bank |
Even before accounting for support burden, onboarding delays, and customer frustration, the cost of “doing it manually” or “waiting for the ecosystem to catch up” is often higher than it first appears.
***
## Why the economics are different
Business-bank connectivity is case-by-case. Commercial portals differ by permissions model, MFA flow, file formats, operational behavior, and bank-specific quirks. This is not one clean universal API surface. Reliability matters more than nominal coverage. A connection that works sometimes, breaks silently, or takes weeks to resolve is not dependable infrastructure.
And when connectivity fails, the cost does not vanish. It moves into labor, delay, and operational risk.
**Business-bank connectivity is case-by-case**\
Different banks behave differently. Permissions, authentication, file formats, and operational flows vary meaningfully.
**Reliability matters more than nominal coverage**\
A flaky connection is not infrastructure. It is a future support burden.
**The real fallback is labor**\
When connectivity fails, someone ends up doing the work manually.
***
## What Waycore is priced against
Waycore is not priced against the fantasy of universal, reliable aggregator coverage.
It is priced against the real alternatives: **manual retrieval** and **reconciliation**, **bank-by-bank file projects**, **implementation drag**, **support burden**, **delayed onboarding**, and **brittle connectivity** that forces fallback workflows.
**When connectivity fails, the cost does not vanish. It moves into labor, delay, and risk.**
***
## Comparison table
| Dimension | Aggregator model | Manual alternative | Waycore |
| :----------------- | :------------------ | :------------------------- | :----------------------------------- |
| **Coverage** | Uneven | Possible but labor-heavy | High, bank-by-bank |
| **Reliability** | Often brittle | Depends on people/process | Designed for operational reliability |
| **Time to deploy** | Fast when supported | Slow | Fast once delegated access exists |
| **Cost structure** | Cheap when it works | Hidden labor + vendor cost | Flat per user/account type |
| **Failure mode** | Tickets and waiting | Human work | Managed infrastructure |
# How pricing works
Source: https://docs.waycore.com/pricing/plans
Waycore pricing is simple: a base **platform fee**, a **per-connection fee** for each maintained delegated user, and **usage-based** pricing for execution workflows.
API access, sandbox environment, monitoring, support, and integration tooling.
A per-connection fee for each maintained bank portal session, priced as standard or complex.
Usage-based pricing for write-side workflows such as transfers, uploads, and scheduled actions.
The main variable is the **delegated user**. Each delegated user represents one maintained bank portal connection for one entity at one institution. That portal may expose one account or many accounts; the pricing unit is the maintained portal access, not the number of accounts behind it.
These connections are priced as either **standard** or **complex**, depending on the operational effort required to keep the portal reliable.
Larger partners can access enhanced support, committed-volume pricing, and custom commercial terms. Get in touch with us via [hello@waycore.com](mailto:hello@waycore.com).
***
## What is a Standard vs. Complex Portal?
Delegated users are priced in two bands: **standard portals** and **complex portals**. The band depends on the operational effort required to keep the connection reliable, including authentication, MFA, session recovery, permission structure, and bank-specific behavior.
Common authentication and recovery patterns, such as email OTP, SMS codes, phone-call verification, or app-based two-factor authentication.
Higher operational load caused by tighter session constraints, device-bound approvals, hardware tokens, mobile soft tokens, or non-standard auth.
Portal complexity is based on the operational effort required to maintain reliable delegated access. If a portal’s classification is unclear, Waycore assesses it during onboarding as part of implementation.
***
## Want to learn more?
Whether you are exploring coverage for a specific bank, evaluating a partner rollout, or trying to estimate production pricing, we can help map the right setup.
Schedule a short conversation to discuss your use case, coverage requirements, and implementation path.
Email us for pricing questions, custom quotes, partner terms, or anything else we can help clarify.
# Reliability
Source: https://docs.waycore.com/reliability
Waycore combines automated systems with human oversight.
Banking environments introduce variability through session expiry, MFA challenges, and interface changes. Pure automation does not consistently handle these conditions.
Waycore uses automated agents for routine operation and human intervention when required to recover from edge cases and maintain continuity.
***
## Data access and freshness
Data retrieval is configured based on the institution and use case:
* Scheduled retrieval for reporting and reconciliation
* Higher-frequency access where supported
* On-demand access when needed
The system prioritizes completeness and consistency of data over unsupported real-time claims.
***
## Workflow continuity
For supported banks, Waycore maintains:
* Consistent access across sessions
* Recovery from authentication interruptions
* Continuity of payment preparation workflows
When automation encounters limitations, fallback mechanisms are used to complete the workflow.
***
## SLA
Waycore provides SLAs for enterprise deployments.
These typically cover:
* Data availability expectations
* Response and recovery times
* Operational coverage windows
* Support and escalation processes
Given differences across banking environments, SLAs are structured around service outcomes rather than generic uptime percentages.
***
## Observability
Waycore provides visibility into system behavior, including:
* Connection status per institution
* Data retrieval history
* Workflow execution logs
* Exception handling and recovery events
This allows teams to monitor reliability directly.
Please [contact us ](mailto:hello@waycore.com)for detailed SLA terms.
# Delegated Access & HITL
Source: https://docs.waycore.com/security/access-oversight
This page discusses how Waycore establishes secure and high quality connections with commercial banking institutions.
This page describes the broader Waycore operating model. The public API supports onboarding, accounts, transactions, sync, webhooks, and transfers where transfer access is enabled.
## The Delegated User Access Model
Every major bank allows account administrators to create sub-users with scoped permissions. This is a standard commercial banking feature, built for exactly this purpose: granting audited, controlled access to third parties like treasury teams, accountants, and software platforms.
When a business connects their bank to Waycore, they create a dedicated Waycore user directly inside their bank portal. That user gets only the permissions the business chooses: read balances today, and initiate or execute transfers under certain guardrails when those execution capabilities are enabled. The bank knows Waycore exists. The access is sanctioned, logged, and revocable at any time.
The nomenclature can vary across banks, but you will normally see this feature appears as **user**, **sub-user,** **authorized user, portal user, operator, delegate**.
This matters for three reasons:
1. **It's compliant by design.** No terms of service are stretched. No bots impersonate account holders. The bank's own authentication and permission model governs everything Waycore can and cannot do. We've validated this approach across the top 250 US banks with outside counsel.
2. **It's execution-native.** Because Waycore operates as a legitimate bank user, the platform can support actions like initiating transfers, staging payments, and triggering approvals when those capabilities are enabled. Screen scrapers can only read. Delegated users can act.
3. **It's durable.** Scraping breaks when banks update their UI. Delegated user sessions persist because they're maintained through the bank's own access management infrastructure. Connections don't silently fail. When re-authentication is needed, we know immediately and handle it, including through human-assisted fallback for banks that require physical tokens or RSA devices.
The result is bank connectivity that behaves like infrastructure: reliable, auditable, and sanctioned from the moment it's established.
## Human Accountability: The "Human-in-the-Loop" Guarantee
While our platform uses automation to efficiently execute tasks, it is never fully autonomous. Every action is supervised by our team of trained financial operations specialists. This is our Human-in-the-Loop (HITL) guarantee.
### How It Works:
1. **Agent-First for Efficiency:** Our automated systems perform the routine, low-risk tasks of navigating, gathering, and organizing information as directed by you.
2. **Human Supervision for Accountability:** A trained human agent supervises a fleet of these automated sessions. The system is designed to automatically pause and escalate to the human agent for review and explicit approval under specific conditions:
* Errors or Unexpected Events: If the system encounters an error or an unexpected change in the bank portal.
* High-Risk Actions: Before any high-risk action, such as initiating a payment or modifying account details, the system requires explicit approval from a human agent.
3. **Final Authority Rests with Humans:** Our human agents have the final say. They can intervene, correct, or cancel any action at any time. No critical decision is ever made solely by an automated system.
# Security & Governance
Source: https://docs.waycore.com/security/data-privacy
In this section we cover everything you need to know about Waycore's security posture, roadmap and fundamental mode of operations.
## Our Commitment at a Glance
TLS 1.2+ in transit; AES-256 at rest with cloud-provider KMS isolation.
You create a dedicated bank user for Waycore; identical to hiring a treasury assistant, fully auditable and revocable.
Every planning, approval, and execution step is logged, tamper-evident, and attributable in both Waycore and your bank.
SOC 2 Type I (target Q2 2026) → Type II → ISO 27001 readiness.
## The Waycore Execution Model
Waycore does not request banking credentials and does not impersonate operators. Instead, you provision Waycore as its own user in your bank, granting only the permissions required for your automations.
Think of this as **hiring a treasury assistant** with:
* Strictly scoped entitlements
* Full auditability
* Zero ability to exceed policy
* Instant revocation
**Operator Impact**
* Nothing circumvents existing bank controls.
* All actions require workflow-level approvals inside Waycore.
* Every action is attributable both in Waycore and your bank.
***
## Data We Collect & Why
* Delegated access tokens / bank user credentials you explicitly generate.
* Transaction metadata needed to plan, schedule, and validate execution.
* Workflow definitions & approvals to enforce policy.
* Operational logs (IP, user ID, API usage) for security, debugging, and compliance.
***
## Credential Handling & Delegated Access
Because Waycore is created as its own bank user:
**No shared secrets**
You issue credentials directly in your bank, not in Waycore.
**Encrypted at rest**
All delegated credentials are encrypted under a dedicated KMS key.
**Short-lived sessions**
Execution sessions rotate automatically according to bank policy.
**Instant revocation**
Remove the bank user or revoke the credential → immediate loss of access.
***
## Execution Safety: Approvals & Policies
Waycore enforces a three-tier safety model:
**1. Workflow approval gates**
* Role-based approval
* Threshold and policy enforcement
* Optional multi-step approvals
**2. Bank-level enforcement**
All execution remains bound by your bank's security model.
**3. Immutable audit trail**
Every planning, approval, execution, and confirmation step is logged and tamper-evident.
***
## Data Encryption & Storage
* **In transit:** All external traffic is forced over HTTPS. We allow only TLS 1.2+ with forward-secret cipher suites.
* **At rest:** Customer data lives on server-side–encrypted storage, protected with AES-256 keys managed by our cloud provider’s state of the art key-management service; backups and snapshots inherit the same encryption.
* **Back‑ups:** Encrypted, geo‑redundant, with automated integrity checks and a 30‑day retention.
***
## Access Controls & Monitoring
* **Least privilege & RBAC:** IAM roles are scoped to the minimum set of resources and rotated quarterly.
* **Multi‑factor authentication:** Required for all console and GitHub access; SSO for all employees.
* **Audit logging:** Every action in our production environment is captured in a tamper-evident ledger. Logs are immutable, retained for 12 months, and continuously analyzed for anomalies.
***
## Secure Development & Pen Testing
* **CI/CD security gates:** Every build must clear static analysis in SonarQube and automated dependency-vulnerability scanning; pipelines halt on any critical finding.
* **Secrets management:** Source code contains no secrets; runtime credentials are injected from our cloud secrets vault.
* **External penetration tests:** Conducted twice per year; summary reports available to customers under NDA starting July 2025.
***
## Compliance Roadmap
Complete
In progress
Planned
***
## Incident Response
We operate a 24×7 on-call rotation and commit to notify affected customers within 24 hours of confirming a breach of customer data. Monthly tabletop exercises ensure readiness. Our full Incident Response Plan is available on request.
***
## Your Controls
* **Granular permissions:** Disable analytics, revoke bank tokens or delete data in one click (Settings → Privacy).
* **Right to be forgotten:** We will delete all personal data within 30 days of request or account closure.
* **Audit logs export:** Enterprise plans can export six months of access logs via API.
***
Security is never "done." If you spot something we can improve, drop us a note; responsible researchers earn thanks and swag.
# Trust Center
Source: https://docs.waycore.com/security/trust-center
# Vulnerability Disclosure
Source: https://docs.waycore.com/security/vulnerability-disclosure
How to report security issues to Waycore.
If you believe you've found a security vulnerability in Waycore, please email **[security@waycore.com](mailto:security@waycore.com)**.
Helpful details to include:
* A description of the issue and its impact
* Steps to reproduce
* The affected endpoint or component
* Your name or handle if you'd like to be credited
## Scope
In scope: `*.waycore.com` and Waycore's public APIs.
Out of scope: third-party services, social engineering, physical attacks, denial-of-service testing, and findings from automated scanners without demonstrated impact.
## Safe Harbor
We won't pursue legal action against researchers acting in good faith who avoid privacy violations and service disruption, and who give us reasonable time to investigate before public disclosure.
## Bug Bounty
Waycore does not currently operate a paid bug bounty program.
# Support
Source: https://docs.waycore.com/support
How to reach Waycore for help.
For product questions, integration help, or operational issues, email **[hello@waycore.com](mailto:hello@waycore.com)**.
Existing customers can also reach us via email or their dedicated Slack channel.
We respond during European business hours, Monday to Friday.
For security reports, see [Vulnerability Disclosure](/security/vulnerability-disclosure).
**Book a call:** for sales and general inquiries, you can book a call from [waycore.com/about](https://waycore.com/about).
# Transactions
Source: https://docs.waycore.com/transactions
Browse historical transactions and sync incremental changes
A **Transaction** represents a single line item on a bank account as reported by the institution. Transactions are read-only and are populated automatically during connection syncs.
## Status lifecycle
| Status | Meaning |
| ----------- | ---------------------------------------------------------------------------------- |
| `pending` | Authorised but not yet settled. Amount or details may still change. |
| `posted` | Fully settled. |
| `reversed` | Previously posted transaction that was reversed. |
| `cancelled` | Pending item that was voided before settlement. |
| `unknown` | The bank provided a state that does not yet map cleanly to a richer public status. |
The current public implementation mainly emits `pending` and `posted`; the remaining values are reserved for broader coverage.
## Two ways to read transactions
### Historical browse — `GET /v1/transactions`
Use this endpoint for backfills, date-range queries, and reconciliation views. It supports filtering by `accountId`, `connectionId`, `entityId`, `status`, `rail`, `postedDateGte`, and `postedDateLt`. Results are cursor-paginated and can be sorted by `postedDate` or `updatedAt`.
List cursors are valid only for the same query and sort order. They are not interchangeable with sync cursors.
### Incremental sync — `GET /v1/transactions/sync`
Use this endpoint to maintain a current mirror of transactions over time. The sync stream returns change events ordered by the server's sync cursor ascending, not by `postedDate` or raw `updatedAt`.
This is **not** the endpoint for fetching existing transactions, and it does **not** return your transaction history. The first call (without a cursor) returns **zero events by design** — it only establishes your stream head. Load historical data from `GET /v1/transactions`, then use sync for changes from that point on.
### No-gap bootstrap
1. Call `GET /v1/transactions/sync` **without** a cursor. This returns **no events** — its only purpose is to establish the stream head.
2. Save the returned `nextCursor` as your stream head.
3. Backfill historical data from `GET /v1/transactions`.
4. Resume polling `GET /v1/transactions/sync` from the saved cursor.
5. If `hasMore` is `true`, call again immediately with the returned `nextCursor`.
Duplicates between the backfill and later sync pages are expected. Reconcile by stable `transaction.id`.
Persist `nextCursor` only after the full page has been durably applied. If a sync call is retried, reuse the same cursor.
### Empty responses are normal
A sync call that returns zero events means nothing has changed in that stream since your cursor — keep the same cursor and poll again later. Sync **does** deliver transactions: once data is created or changes, it arrives as `added` and `modified` events on the next poll. A zero-event response simply means there is nothing new since your cursor; it does **not** mean the connection has no transactions. Use `GET /v1/transactions` to read transactions that already exist (your historical set), and sync to stay up to date from there. If you expect changes but consistently see zero events, confirm you are polling with the cursor you saved and the **same** stream-defining filters you bootstrapped with (see below).
## Sync event types
| Event type | How to handle it |
| ---------- | -------------------------------------------------------------- |
| `added` | Upsert the embedded transaction by `transaction.id`. |
| `modified` | Upsert the embedded transaction by `transaction.id`. |
| `removed` | Delete the referenced transaction id from your current mirror. |
`removed` currently represents transaction deletions. Account visibility changes without transaction mutations are intentionally out of scope for the current sync stream.
## Cursor and retry rules
* Sync cursors are valid only for the same stream-defining filters: `accountId`, `connectionId`, and `entityId`. If you bootstrap with one of these filters, keep polling with the same filter value.
* Sparse `fields=` selections do **not** change stream membership and are not part of cursor compatibility.
* Sync cursors expire after 90 days.
* `invalid_cursor` means the cursor is malformed or does not match the filter set. Changing the filters between bootstrap and polling returns this error — it does **not** silently fall back to zero events. Rebootstrap with the original filters.
* `cursor_expired` means you need to rebootstrap from scratch.
* If rate limited, honor `Retry-After` when present and retry with the same cursor.
## Key fields and rails
* **`amount`** — Signed decimal string. Positive = inflow, negative = outflow.
* **`entryType`** — `credit` or `debit`, as reported by the bank.
* **`rail`** — Payment rail such as `internalTransfer`, `card`, `ach`, `pix`, `caEft`, `auNpp`, `auBecsDirectEntry`, `auRtgs`, `sepaCredit`, `sepaDebit`, `wire`, `swift`, `fasterPayments`, `check`, `cash`, `crypto`, `other`, or `unknown`.
* **`paymentReference`** — Remittance reference for reconciliation (e.g. invoice number).
* **`bankReference`** — Bank-assigned operational tracking ID.
* **`counterpartyName`** / **`counterpartyAccountMasked`** — Available on many rail types.
Waycore can notify you through the [`transactions.sync_available`](/webhooks) webhook when fresh data is ready, so you do not need to poll blindly. Treat that webhook as a prompt to call `GET /v1/transactions/sync`, not as a replacement for the sync stream itself.
## Endpoints
## Required scopes
| Scope | Used by |
| ------------------- | --------------- |
| `transactions:read` | List, sync, get |
# Transfers
Source: https://docs.waycore.com/transfers
Create, track, and retry bank transfers
A **Transfer** represents a requested movement of funds through a connected bank account. It is a write-side API object, unlike a [Transaction](/transactions), which is an observed bank record after the fact.
Transfer access is subject to your API key scopes, the connected bank's capabilities, and the delegated user's bank-side permissions.
All external transfers require end-user approval in the bank portal. Waycore initiates the bank-side flow, then the transfer moves to `pending_bank_approval` until the end user completes approval. Internal transfer approval requirements depend on the bank, account setup, and delegated-user permissions.
## Supported rails
| Rail | Use case |
| ---------- | -------------------------------------------------------------------------------------------------- |
| `internal` | Move funds between connected accounts at the same institution or platform-supported internal rail. |
| `ach` | US domestic ACH. |
| `wire` | US domestic wire. |
| `swift` | International wire via SWIFT. |
| `fednow` | US instant payment via FedNow. |
| `rtp` | US instant payment via RTP. |
| `sepa` | SEPA payments. |
| `local` | Local domestic rails not represented by a more specific enum value. |
The requested rail is sent as `transferType`. For external transfers, the destination account identity is described separately by `destination.paymentIdentifier.scheme`, such as `us_ach`, `uk_sort_code_account_number`, `ca_eft`, `au_bsb_account_number`, or `iban`.
## Creating transfers
Create transfers with `POST /v1/transfers`. The endpoint returns `202 Accepted` with a `Transfer` object.
Use an `Idempotency-Key` header when creating or retrying a transfer so retries are safe. If the same request is replayed, Waycore may return the original response with `Idempotent-Replayed: true`. If the same idempotency key is reused with a materially different request, the API returns `409 Conflict`.
Internal transfer request:
```json theme={null}
{
"type": "internal",
"amount": {
"type": "money",
"value": "1250.00",
"currency": "USD"
},
"sourceAccountId": "11111111-2222-3333-4444-555555555555",
"destination": {
"type": "account",
"accountId": "66666666-7777-8888-9999-000000000000"
},
"transferType": "internal",
"clientReference": "payroll-funding-2026-05-28"
}
```
External transfer request:
```json theme={null}
{
"type": "external",
"amount": {
"type": "money",
"value": "1250.00",
"currency": "USD"
},
"sourceAccountId": "11111111-2222-3333-4444-555555555555",
"destination": {
"accountHolderName": "Acme Payroll LLC",
"recipientType": "business",
"paymentIdentifier": {
"scheme": "us_ach",
"countryCode": "US",
"details": {
"routingNumber": "011000015",
"accountNumber": "000123456789"
}
}
},
"transferType": "ach",
"clientReference": "payroll-funding-2026-05-28"
}
```
## Transfer lifecycle
| Status | Meaning |
| ----------------------- | ---------------------------------------------------------------------------------- |
| `queued` | The transfer has been accepted and is waiting to execute. |
| `executing` | Waycore is executing the transfer through the bank. |
| `pending_bank_approval` | The bank flow has been initiated and the end user must approve in the bank portal. |
| `completed` | Execution completed successfully. |
| `failed` | Execution failed before completion. See `failureReason`. |
| `returned` | The bank or downstream rail returned the payment after execution. |
| `cancelled` | The transfer was cancelled. |
| `unknown` | The bank state does not yet map cleanly to a more specific public status. |
`requestedAmount` is the amount requested by the caller. `executedAmount` is populated once the actual amount sent is known.
## Listing and retrying
Use `GET /v1/transfers` to list transfers ordered by `createdAt desc, id desc`. You can filter by `status`, `accountId`, `createdAtFrom`, and `createdAtTo`, and paginate with `cursor`.
Use `GET /v1/transfers/{id}` to retrieve the latest known state for one transfer.
Use `POST /v1/transfers/{id}/retry` to retry a failed or retryable transfer. Retry requests support the same `Idempotency-Key` header as create requests. A retry returns `202 Accepted` with the updated transfer.
If a transfer is not retryable, the API returns `409 Conflict`.
## Failure reasons
When a transfer is `failed`, `returned`, or `cancelled`, `failureReason` may include:
* `insufficient_funds`
* `invalid_destination`
* `unsupported_transfer_type`
* `provider_rejected`
* `provider_unavailable`
* `timed_out`
* `unknown`
## Endpoints
## Required scopes
| Scope | Used by |
| ----------------- | -------------------------- |
| `transfers:write` | Create and retry transfers |
| `transfers:read` | List and get transfers |
# Webhooks
Source: https://docs.waycore.com/webhooks
Receive real-time event notifications
Webhooks let you subscribe to events instead of polling the API. When a subscribed event occurs, Waycore sends an HTTP `POST` to your registered URL with a signed JSON payload.
Today, webhooks are an operational signal layer, not a complete replay feed. In particular, `transactions.sync_available` tells you to call `GET /v1/transactions/sync`; it is not itself a transaction reconciliation stream.
## Registering an endpoint
Create a webhook registration with `POST /v1/webhooks`, specifying the delivery URL and the event types you want to receive. The response includes a signing `secret` — store it securely, as it is only shown in full once.
Alternatively, you can register a webhook manually using the [Waycore Console](https://console.waycore.com).
## Verifying deliveries
Every delivery includes a `Waycore-Signature` header in the format:
```text theme={null}
t=,v1=
```
`v1` is the HMAC-SHA256 of:
```text theme={null}
.
```
Always verify the signature against the raw request body before processing the event.
## Event types
| Event | Status today | Notes |
| ----------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `connection.status_changed` | Emitted | Fired when a connection changes status. |
| `account.created` | Reserved | Not currently emitted by production-facing flows. |
| `account.updated` | Reserved | Not currently emitted by production-facing flows. |
| `transactions.sync_available` | Emitted | Indicates fresh transaction data is ready. Call `GET /v1/transactions/sync`. Deliveries are currently connection-scoped, so `accountId` is currently `null`. |
| `transfer.status_changed` | Reserved | Reserved for future transfer status notifications. |
| `test` | Explicitly triggerable | Can be queued through the API when the webhook is active and subscribed to `test`. |
## Event envelope
Every delivery shares the same outer structure:
```json theme={null}
{
"id": "evt_abc123",
"type": "transactions.sync_available",
"createdAt": "2026-03-04T12:00:00Z",
"data": { ... }
}
```
Use `id` as an idempotency key. Your endpoint may receive the same event more than once.
## Retry behavior
Waycore retries unacknowledged deliveries with exponential backoff when the endpoint returns a non-2xx response or times out. Return a `2xx` response as quickly as possible and process the event asynchronously.
## Testing a webhook
Use `POST /v1/webhooks/{webhookId}/test` to queue a synthetic `test` event for a single registration. The webhook must be active and already subscribed to the `test` event type.
## Managing registrations
## Required scopes
| Scope | Used by |
| ---------------- | ------------------------------------ |
| `webhooks:write` | Create, update, delete, trigger test |
| `webhooks:read` | List, get |