Arbiter — API Documentation

Pick a domain. Each domain has its own Swagger UI page with only the security scheme it actually uses.

Banking Tool Domains — shared base auth: API-key headers (X-Agent-Id, X-Principal-Id, X-Trust-Tier)

Deposits API key
Open / list / balance / details / transactions / yield calc / closure. One public discovery endpoint.
Loans API key
Eligibility / submit / status / amortization / payment / modification / underwriting verdict.
Payments API key
ACH / Fedwire / RTP. Counterparty validation, status, cancel, history, arrival ETA.
Cards Bearer JWT
Issue / freeze / unfreeze / spend limits / transactions / dispute / tokenize. Auth differs: Bearer JWT.
Cross-Border API key
SWIFT wires / corridor remittances / FX / OFAC-screened / Reg E §1073 disclosures.
Clearing & Settlement API key (TIER_1)
Net positions, schedules, liquidity, funding gap, maturity ladder. Internal use only.
Guardrails & Audit API key
Proactive guardrail check + audit-trail readback. Every Java-layer call is auto-audited.
Admin (CRUD) API key (TIER_1 for deletes)
Update + delete handles per entity. Includes purge_test_data and post_card_transaction.
E2E Orchestration API key (TIER_1)
run_e2e_scenario (42-step new-user journey) + seed_demo_customer (rich customer w/ cards + transfers).

Standalone APIs — separate auth, separate Swagger UI

Insights OAuth 2.0
Bank-wide health metrics. OAuth 2.0 client_credentials grant — POST /insights/v1/oauth/token to mint a Bearer.

Other surfaces

Visual Test Dashboard
60+ pre-built test cards across every domain, plus the E2E scenario runner with per-step transcript.
Tool Catalog (JSON)
Programmatic discovery — every tool grouped by domain with example payloads.
Health Check
Liveness probe.
Why one Swagger UI per domain? Each domain has its own auth model (API-key headers, Bearer JWT, or OAuth 2.0). Putting them all in one Swagger UI confuses the parser and the human reader — every endpoint shows three lock icons even when only one applies. Per-domain pages declare exactly one security scheme so the Authorize dialog asks for only what's needed.

Raw OpenAPI specs are at /v3/api-docs/{group}. The default ungrouped Swagger UI is still served at /swagger-ui-default.html for debugging.