Skip to main content

Bank Export API

Summary​

Two operations generate bank-ready CSV files for Frozen Payroll runs. Neither executes payment or receives bank acknowledgement.

Audience​

Frontend and backend developers, QA and support engineers, architects, security reviewers, and implementation partners.

Reference Content​

Authentication: bearer context is expected for business APIs; service-local enforcement Requires confirmation. Authorization: no endpoint-specific Payroll Service role policy is confirmed. Maturity: Direct and Compatibility.

OperationMethod and public routePurposeAuthenticationTenant contextRequest typeResponse typeSuccessMaturitySource path
Native bank exportGET /payroll/runs/{runId:guid}/bank-exportGenerate a bank-ready CSV for a Frozen run.Bearer context expected; service-local enforcement Requires confirmationForwarded or explicit tenant context; exact missing-context mapping Requires confirmationRoute and query parametersCSV file (text/csv)200Directmicroservices/src/payroll-service/Api/PayrollOutputEndpoints.cs
Compatibility bank exportGET /api/payroll/bank-exportGenerate the monolith-shaped bank CSV for a Frozen period.Bearer expected by the compatibility contract; downstream enforcement Requires confirmationForwarded tenant context expected; no tenant query parameterQuery parametersCSV file (text/csv)200Compatibilitymicroservices/src/payroll-service/Api/PayrollCompatEndpoints.cs

Native bank export​

  • API family / maturity: Bank Export API; Direct
  • Authentication / authorization: Bearer context expected; service-local enforcement Requires confirmation. No endpoint-specific role policy is confirmed.
  • Tenant context: Forwarded or explicit tenant context; exact missing-context mapping Requires confirmation.
  • Route parameters: Required GUID runId.
  • Query parameters: Optional tenantId.
  • Request body / type: None; Route and query parameters.
  • Validation: Only checks stated in the error mapping below are confirmed; model-binding failures are framework behavior and not specified as a stable contract.
  • Response body / type: CSV file (text/csv).
  • Success / error responses: 200; 404 {message} when missing; 409 {message} when run is not Frozen.
  • Business behavior: Generate a bank-ready CSV for a Frozen run.
  • State and input implications: Read-only. No input projection changes.
  • Audit and event implications: Persists bank-export audit. No event produced.
  • Compatibility notes: Native Payroll contract.
  • Safe example: GET /payroll/runs/{runId:guid}/bank-export → 200 CSV attachment; editable run → 409 {"message":"Export requires a frozen payroll."}
  • Example error: {"message":"Request could not be completed."} (illustrative safe wording)

Compatibility bank export​

  • API family / maturity: Bank Export API; Compatibility
  • Authentication / authorization: Bearer expected by the compatibility contract; downstream enforcement Requires confirmation. No endpoint-specific role policy is confirmed.
  • Tenant context: Forwarded tenant context expected; no tenant query parameter.
  • Route parameters: None.
  • Query parameters: Required month, year.
  • Request body / type: None; Query parameters.
  • Validation: Only checks stated in the error mapping below are confirmed; model-binding failures are framework behavior and not specified as a stable contract.
  • Response body / type: CSV file (text/csv).
  • Success / error responses: 200; 404 raw text when no Frozen run exists.
  • Business behavior: Generate the monolith-shaped bank CSV for a Frozen period.
  • State and input implications: Read-only. No input projection changes.
  • Audit and event implications: No separate compatibility audit row is added by this method. No event produced.
  • Compatibility notes: Monolith-shaped compatibility contract.
  • Safe example: GET /api/payroll/bank-export?month=7&year=2026 → 200 CSV attachment; missing Frozen run → 404 raw text
  • Example error: "Request could not be completed." (illustrative raw compatibility wording)

Family-level findings​

Files contain sensitive payment categories that are not shown here. Authentication/authorization scope, encryption, custody, retention, maker-checker approval, payment transmission, acknowledgement, rejection, settlement, and reconciliation Require confirmation or are Not implemented.

Source References​

  • microservices/src/payroll-service/Api/PayrollOutputEndpoints.cs
  • microservices/src/payroll-service/Application/PayrollOutputsService.cs
  • microservices/src/payroll-service/Api/PayrollCompatEndpoints.cs
  • microservices/src/payroll-service/Application/PayrollCompatService.cs

See Also​

Keywords​

  • Payroll API
  • Bank Export API

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-15
  • Review cycle: Quarterly