> ## Documentation Index
> Fetch the complete documentation index at: https://banking.nextedge.consulting/llms.txt
> Use this file to discover all available pages before exploring further.

# Mobile-facing API product

> Required users, features, journeys and release boundaries for Mobile-facing API product.

**Proposed application. New-project implementation has not started.**

## Users and responsibility

Client mobile team; verified customer; bank API operators. No native app implementation is included in this documentation task. Authentication protocol, device binding, attestation, deep links and proof contracts require explicit security design; never put static server/provider secrets into a client.

## Required workspaces and features

1. Institution/product discovery with safe public/private separation.
2. Enrollment, proof, token/session/device lifecycle and recovery contracts.
3. Account/card/loan reads with cursor and freshness semantics.
4. Quote, instruction, status, cancellation-eligibility and idempotency.
5. Secure downloads, notifications and version/deprecation support.

Each workspace needs list/search/filter → detail → permitted action → result → return. Include loading, empty, invalid-input, permission-denied, outage, stale-conflict and unknown-result states. Administrative and financial write actions must be distinguished.

## Application flow diagram

```mermaid theme={null}
flowchart TD
  START["APP start"] --> GATE{"Application, identity and offering readiness"}
  GATE -->|No| STOP["Stop: resolve evidence or eligibility"]
  GATE -->|Yes| N0
  N0["Mobile client obtains permitted session"] --> N1
  N1["discovers eligible product"] --> N2
  N2["retrieves quote"] --> N3
  N3["completes bound proof"] --> N4
  N4["sends one operation key"] --> N5
  N5["polls status or consumes approved notification"] --> N6
  N6["reconciles UI after connectivity loss"] --> RESULT{"Outcome verification"}
  RESULT -->|Yes| DONE["Record outcome, audit and return"]
  RESULT -->|Pending or unknown| HOLD["Keep original reference; reconcile status"]
  HOLD --> REVIEW["Authorised resolution; no blind retry"]
```

## Complete representative journey

Mobile client obtains permitted session → discovers eligible product → retrieves quote → completes bound proof → sends one operation key → polls status or consumes approved notification → reconciles UI after connectivity loss.

Record the institution, programme/product version, actor/duty, request/operation reference, business date and authoritative outcome. Mobile/ATM channels need equivalent status semantics without copying web-specific navigation or cookie assumptions.

## Exception scenarios

App reinstall; stolen device; duplicate retry offline; stale quote; background refresh cannot extend sensitive authority; compromised callback.

Test successful actions and server denials independently. Closing the screen or cancelling a network request does not reverse a financial operation. Verify original operation status before offering a new instruction.

## Module dependencies and readiness

Relevant module IDs: B02, B04–B09, B11–B22, B27–B30, B32. Select only the institution's permitted subset from the [module register](/banking/module-register). All product policy and permissions stay in shared services. A channel cannot widen limits or convert stored test data into executed banking. Shared controls include [B34 action approvals/limits](/banking/modules/b34) and [B35 customer digital identity](/banking/modules/b35). The mobile contract does not bypass web-equivalent authority/proof.

Prove tenant isolation, exact calculations, concurrent access, idempotency, source outages, audit redaction and recovery. Confirm keyboard/accessibility for web clients and certified-device usability for ATM. Production availability requires completion of the [release gates](/banking/delivery-plan).

## Required implementation inputs

Agree the named user duties, first-release features, deployment boundary and external contracts for this application. ATM hardware and mobile security need their own contract packets. Follow the [decision order](/banking/decisions); Implementation approval and production release are separate recorded milestones.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.