Getting started¶

Global Innovations Bank (GIB) is a sponsor bank with a developer-first API. This page is for teams who are starting a program with us. It walks both halves of onboarding: the commercial and compliance review that gets your program approved for live processing, and the technical work that gets your code talking to our platform.

The two tracks run in parallel. Your business, legal, and compliance teams work with GIB's commercial and risk teams on track one; your engineering team works through track two. Most programs reach their first sandbox transaction within days of NDA, while live launch tracks the slower of the two paths.

Overview¶

Five objects do most of the work. Read these in order; one sentence each, full pages linked.

Everything else, Balances, Batches & Files, Returns, Notifications, is built on top of these five.

For the full data model and reading order, see Core Concepts.

Track 1: Commercial and compliance onboarding¶

Before GIB can sponsor live activity for your program, our risk, compliance, and commercial teams need to be satisfied that your business model, controls, and operations meet the Bank's standards. We try to make this transparent: you'll know what we're looking at, why, and where you are in the queue at every step.

We work in phases, prioritizing the items that most often break a deal so neither side spends time on a path that won't close.

Phase 1: Initial review¶

NDA, business overview, and a first look at your program design. We confirm fit at a high level (rails, volumes, customer types) and identify any structural blockers before going deeper.

You provide: a short program description, expected rail mix, expected volumes, target customer profile.

We provide: initial fit confirmation, indication of any structural concerns, a path to the next phase if we proceed.

Phase 2: Diligence and platform introduction¶

The substantive review. Your business, legal, and compliance teams work with our risk and compliance teams; in parallel, your engineering leads get a platform walkthrough so they can size the technical lift.

Documents and information collected (full list in the Onboarding Request & RFI spreadsheet):

• Corporate formation and ownership documents
• Audited financials or recent management accounts
• AML / BSA program (policies, procedures, training records)
• Customer identification program (CIP) and KYC procedures
• Sanctions screening approach and vendor
• Information security program, SOC 2 or equivalent
• Business continuity and disaster recovery plans
• Insurance certificates (E&O, cyber, fidelity bond as applicable)
• Vendor list and material third parties
• Marketing materials and public-facing terms
• Sample customer agreements

Parallel commercial track: pricing discussion, term sheet, draft Master Services Agreement.

Phase 3: Implementation and pre-launch¶

Final policies and SLAs locked, technical integration tested in sandbox, operational runbooks reviewed. We confirm:

• Sandbox testing complete for every rail you'll use at launch
• Webhook endpoints stable and signature verification working
• Reconciliation procedures validated end-to-end
• Production API keys issued, IP allowlists set, monitoring in place
• Operations contacts named on both sides for incident response

Phase 4: Live launch and ongoing compliance¶

You go live in production, typically with a controlled volume ramp. Ongoing compliance is not a one-time check; we run periodic reviews of your program (transactional patterns, complaints, returns rates, sanctions hits, financial condition) and may request updated documents. Our goal is to catch issues early, when they're cheapest to fix.

Who's involved on each side¶

A single point of contact on each side, named at NDA, owns the relationship across all phases.

Estimated timeline¶

Most programs spend 6–12 weeks in phases 1–3 before going live, with the long pole almost always being diligence document collection on your side. Engineering can run sandbox integration in parallel; that often takes 2–6 weeks of focused effort once API keys are issued.

Track 2: Platform and developer onboarding¶

Engineering does not have to wait for commercial and compliance to finish. Once an NDA is in place, we issue sandbox credentials so your team can build and test against the same API surface that runs in production.

Environments¶

GIB runs two fully separated environments. Sandbox uses synthetic data, simulated rail processing, and accelerated state transitions for testing. Production is the real thing.

API keys are environment-specific. A sandbox key cannot call production and vice versa.

Sandbox is safe to break. We rebuild sandbox state on a regular cadence, so don't store anything in sandbox you can't reproduce.

Get your API key¶

Keys are User-specific and created in the dashboard under your User profile. Each key requires:

• One or more allowlisted IP addresses or CIDR blocks. Requests from any other source are rejected with 403 ForbiddenError.
• An optional expiration. We recommend ≤ 90 days for production keys.
• An optional name for dashboard identification.

The full key string is shown once, immediately after creation. We store only a hash; if you lose a key, revoke and re-issue.

For the full security posture (rotation, revocation, compromise response, transport, masking), see Security.

Make your first call¶

Once you have a sandbox key and an allowlisted IP, confirm everything is wired up by calling getSessionInfo. It echoes back the User the key resolves to and your Company ID, and is the safest "is my auth working" probe in the API.

curl¶

curl https://sandbox-base-api.gibank-api.com/api/session/info \
  -H "Authorization: $GIB_API_KEY"

A successful response looks like:

{
  "user": {
    "id": 42,
    "email": "developer@yourfintech.com",
    "company_id": 7,
    "role": "admin"
  },
  "company": {
    "id": 7,
    "name": "Your Fintech, Inc.",
    "environment": "sandbox"
  }
}

Python¶

import os
import requests

resp = requests.get(
    "https://sandbox-base-api.gibank-api.com/api/session/info",
    headers={"Authorization": os.environ["GIB_API_KEY"]},
    timeout=10,
)
resp.raise_for_status()
print(resp.json()["user"]["company_id"])

TypeScript¶

const resp = await fetch(
  "https://sandbox-base-api.gibank-api.com/api/session/info",
  { headers: { Authorization: process.env.GIB_API_KEY ?? "" } },
);
if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
const data = await resp.json();
console.log(data.user.company_id);

If you get a 403 ForbiddenError, your egress IP isn't on the key's allowlist. Add it in the dashboard and try again; changes take effect within ~30 seconds.

SDKs¶

GIB's API is described by an OpenAPI specification (swagger.json) served at the API root. We don't publish pre-built SDK packages; instead, we recommend generating a client locally against the spec using OpenAPI Generator. This keeps the client perfectly in sync with the API and lets you target any language the generator supports.

• Python SDK
• TypeScript SDK

For other languages, see the OpenAPI Generator language list and point the generator at https://sandbox-base-api.gibank-api.com/swagger.json.

Cross-cutting requirements¶

These apply on every rail. Read them once and assume them everywhere.

• Idempotency on every POST. Populate the external_key field in the request body (a UUID is fine) on any request that creates a resource. See Idempotency.
• Webhooks for state changes. Every transaction state transition fires a webhook. See Webhooks for subscription, signature verification, and retry behavior.
• Errors share one shape. Every non-2xx response has the same envelope. See Errors for the schema and full code catalog.
• TLS 1.2 minimum. HTTP requests are rejected.

Where to go next¶

Help and contact¶

Information on this page describes GIB's standard onboarding process and platform behavior at the time of writing. The specific commercial, compliance, and technical requirements applicable to your program will be set out in your program agreement and supporting documents. Nothing on this page constitutes legal, regulatory, or financial advice, and nothing creates a binding commitment to onboard any program; sponsorship decisions are made by GIB at its sole discretion subject to the Bank's policies and applicable law.