Welcome to the central developer portal for XYO Financial's API specifications, SDK libraries, and enterprise integration guides. Engineered for Tier-1 financial institutions, national payment switches, and global card issuers, XYO provides deterministic, low-latency transaction narrative parsing, merchant disambiguation, geolocation resolution, and neural categorization.

XYO supports flexible deployment architectures aligned with regional data residency, regulatory mandates (OCC 2023-17, PRA SS2/21, DORA, China PIPL), and high-throughput requirements:

• Basic SaaS Plan (SMEs & Fintechs)
  Multi-tenant cloud infrastructure with global edge routing and TLS 1.3 termination for rapid deployment.
• Partial On-Premises (High-Throughput Hybrid)
  Hybrid topology combining localized transaction tokenization, caching proxies, and dedicated low-latency secure tunnels.
• Complete On-Premises & Air-Gapped (G-SIFIs, Central Banks & Sovereign Clouds)
  Fully air-gapped, zero-telemetry deployment within your private VPC or bare-metal infrastructure (Kubernetes, OpenShift, Docker). Guarantees 100% data sovereignty with zero PII egress (compliant with GDPR, GLBA, PCI-DSS v4.0 Level 1, and HKMA/PIPL).

All XYO client libraries are generated deterministically from our canonical OpenAPI specification and wrapped in ergonomic, idiomatic interfaces. Each SDK provides thread-safe operations, connection pooling, automated retry logic with exponential backoff, and full mock integration test suites.

For architectural standards, deterministic code generation mechanics, and benchmarking, refer to the SDK Architecture Guide.

Every official SDK provides type-safe access to XYO's core enrichment engine through three canonical operations:

1. Real-Time Single Enrichment (enrichTransaction)
   Synchronous enrichment for authorization streams and real-time payment settlement (P99 < 10ms). Returns merchant name, normalized branding/logos, confidence scores, MCC codes, and geolocation.

2. Asynchronous Bulk Enrichment (enrichTransactions)
   High-throughput asynchronous batch submission for settlement files, core banking feeds, and nightly ledger processing. Returns a cryptographically tracked batch ID and downloadable archive link.

3. Batch Status Polling (getEnrichmentStatus)
   Deterministic job lifecycle tracking (READY, PENDING, FAILED) to retrieve completed enrichment archives with built-in checksum verification.

Our OpenAPI specifications serve as the single source of truth across all platforms and integrations:

• Specs Repository
  Central repository for API contracts, schema validation tools, and contract-testing fixtures.
• OpenAPI 3.0.3 Specification
  Hardened schema featuring comprehensive banking fixtures (ISO 8583 / ISO 20022 transaction narratives) and strict RFC 7807 problem details.
• Postman Collection
  Production-ready collection configured with Bearer and mTLS authentication profiles, parameter sets, and payload templates.

• 🔐 Encryption & Cryptographic Standards
  All data in transit is enforced via TLS 1.3 with Perfect Forward Secrecy (PFS); data at rest is encrypted using AES-256-GCM under FIPS 140-3 validated key management.

• 🔑 Authentication & Access Control
  Dual-mode enterprise authorization supporting Mutual TLS (mTLS x509 certificates) and cryptographically provisioned Bearer tokens (Authorization: Bearer <token>) with automated rotation policies.

• ⚠️ Error Semantics & Resilience
  Standardized RFC 7807 Problem Details (application/problem+json) across all HTTP status codes, coupled with idempotent request handling (X-Idempotency-Key) and distributed trace correlation (X-Correlation-ID).

• 📜 Regulatory Compliance & Data Sovereignty
  Full alignment with PCI-DSS v4.0, SOC 2 Type II, ISO/IEC 27001, UK/EU GDPR & DORA, US GLBA / OCC 2023-17, Saudi SAMA CSF & PDPL, and China PIPL / DSL. Structured operational logging and distributed tracing are used, but zero raw customer transaction data or PII is ever logged (enforced via masking/redaction) to prevent cross-border data leakage.

For detailed regulatory frameworks across UK, US, Germany, China, and Saudi Arabia, see the Global Compliance & Data Sovereignty Guide.

• Client SDKs: Distributed under the open-source Apache License, Version 2.0.
• Enterprise Appliance & Core Engine: Proprietary software licensed under the XYO Financial Master Services Agreement (MSA) and Enterprise Evaluation Agreement.

Copyright © 2026 Syniol Limited. All rights reserved.