Get started

Generate your authentication token to access the COS Swagger and COS Explorer

HTTPS request components

How do I generate an access token?

Sample call for an access token in cURL

curl --location --request POST 'https://idptest.crbcos.com/connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=[your id here]' \
--data-urlencode 'client_secret=[your secret here]' \
--data-urlencode 'audience=https://api.crbcos.com/'

Using Postman to get an access token

Postman is an application that you can use to practice and test API calls. To start using our APIs in Postman, contact our Integration Team to get credentials.

Authenticate

After you receive credentials, create an HTTP request in Postman to get an access token.

1. Go to My Workspace -> New -> HTTP Request.

2. Give the new request a relevant name such as Get access token.

3. Select POST from the API method dropdown and enter https://idptest.crbcos.com/connect/token

4. Select Body and click x-www-form-urlencoded.

5. Fill in these details

   Key	Value
   grant_type	client_credentials
   scope	scope provided from the Integration Team
   client_id	client_id provided from the Integration Team
   client_secret	client_secret provided from the Integration Team

6. Click Send.

   An access token is returned. Copy the token and use it to make API calls.

Requesting Tokens Using Explorer

The access token is copied to your clipboard and ready for use in the Test APIs.

Go into the Explorer, click the arrow down next your login, and click Copy Access Token.

Successful authentication and access token returned

When you've successfully authenticated, an access_token will be returned to you. This access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

Sample response from cURL request

1
2
3
4
5
{
    "access_token": "xxxxx",
    "expires_in": 86400,
    "token_type": "Bearer"
}

Presenting Tokens

Presenting Tokens in the Request Header

In the header of each API request, the access token obtained should be included as follows:

Authorization: Bearer [your token here]

Sample call for wire payment in cURL

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
curl --location --request POST 'https://sandbox.crbcos.com/Wires/v1/payments' \
--header 'Authorization: Bearer your token here' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-raw '{
  "accountNumber": "2255685659",
  "businessFunctionCode": "CTR",
  "receiverRoutingNumber": "021000021",
  "beneficiaryFi": {
    "idCode": "F",
    "identifier": "021000021",
    "name": "JP Morgan Chase"
  },
  "beneficiary": {
    "idCode": "D",
    "identifier": "123456789",
    "name": "Peter Griffin"
  },
  "beneficiaryReference": "XYZ123",
  "amount": 10000,
  "purpose": "payment"
}'

Presenting Tokens in Swagger

In the top of the swagger screen, paste the token from the clipboard into the token field and click Explore. The token is now activated.

Generate your authentication token to access the P2C Swagger

Note: See below for instructions on Authenticating directly to the P2C Swagger sites.

HTTP request components

Sample call for an access token in cURL

curl --location --request POST 'https://oauthtest.crbnj.net/connect/token' \ 
--header 'Content-Type: application/x-www-form-urlencoded' \ 
-d 'grant_type=client_credentials' \ 
-d 'scope=relevant scope' \ 
-d 'client_id={xxx}' \ 
-d 'client_secret={xxx}'

Sample call for an access token in Postman

Successful authentication and access token returned

When you've successfully authenticated, an access_token will be returned to you. This access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

Response attributes

{
"access_token": {access token},
"expires_in": 3600,
"token_type": "Bearer",
"scope": "relevant-scope",
}

Sample Postman access token return

If the authentication is successful, the Status code is OK.

Authenticating directly to the P2C Swagger sites

1. In your browser, open https://pushtopaystaging.crbnj.net (for Push API collection); or https://pullfromcardapistg.crbcloud.com (for Pull API collection).

2. Open an API branch, for example, Transactions.
   
   

3. Click on an API endpoint, for example, GET /api/transaction.
   
   

4. In the upper-right portion of the endpoint display, click the red-encircled exclamation point (!).

5. Select the crbapi checkbox.
   
   

6. Click the Authorize button.
   
   

URLs for our sandbox and production environments

Sandbox URL: https://oauthtest.crbnj.net/connect/token

Production URL: https://oauth.crbnj.net/connect/token

Troubleshooting

You can test the authorization and authentication into our systems with this endpoint, GET /api/SignupCard/TestOauth. If the authentication token is valid, it will return a 200. If the authentication token isn't valid, it will return a 401.

If you can't get a bearer token and you haven't received one in the past:

• Confirm the URL.

• Check that the client_id and client_secret are typed correctly. They are case sensitive.

• Check your client_id and client_secret against the one you received.

• Make sure there are no network or allowlist issues.

Contact our Integration Team if your account is locked as a result of 3 incorrect log in attempts.

Generate your authentication token to access the Arix Swagger

Sample access token request in cURL

1
2
3
4
5
6
curl --location --request POST 'https://oauthtest.crbnj.net/connect/token' \ 
--header 'Content-Type: application/x-www-form-urlencoded' \ 
-d 'grant_type=client_credentials' \ 
-d 'scope=relevant scope' \ 
-d 'client_id={xxx}' \ 
-d 'client_secret={xxx}'

Sample access token request in Postman

Successful authentication and access token returned

When you've successfully authenticated, an access_token will be returned to you. The access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

Sample access token returned in Postman

If the authentication is successful, the Status code is OK.

Sandbox URL: https://oauthtest.crbnj.net/connect/token

Troubleshooting

You can test the authorization and authentication into our systems with this endpoint,
GET /api/SignupCard/TestOauth.

If the authentication token is valid, it will return a 200. If the authentication token isn't valid, it will return a 401.

If you unable to get a bearer token and you haven't received one in the past:

• Confirm the URL.

• Check that the client_id and client_secret are typed correctly. They are case sensitive.

• Check your client_id and client_secret against the one you received.

• Make sure there are no network or allowlist issues.

Contact our Integration Team if your account is locked as a result of 3 incorrect log in attempts.

COS is a collection of REST APIs that let you design and manage unique financial products. COS is designed to be an API driven banking core with no legacy systems getting in the way. We give you the same tools to build your product that we use internally.

We have a full sandbox to explore the API. The sandbox is a completely isolated environment, so feel free to experiment. When you're ready to move to production, we will provision you production credentials and give you access to the live environment.

• ACH

  https://sandbox.crbcos.com/ach/swagger/ui/index#/

• Wires

  https://sandbox.crbcos.com/wires/swagger/ui/index#/

• Core

  https://sandbox.crbcos.com/core/swagger/ui/index#/

• Webhooks

  https://sandbox.crbcos.com/webhooks/swagger/ui/index#/

• RTP

  https://sandbox.crbcos.com/rtp/swagger/ui/index#/

• Card Management

  https://sandbox.crbcos.com/cardmanagement/swagger/ui/index#/

Status Page

To see a list of upcoming releases, monitor current API status, view incident reports, or get notified of scheduled maintenance, visit our status page and subscribe to alerts.

Push-to-Card has its own collection of APIs that require a separate authentication key and integration.

• Push API collection

• Push batch transaction API collection

• Pull API collection

Status Page

To see a list of upcoming releases, monitor current API status, view incident reports, or get notified of scheduled maintenance, visit our status page and subscribe to alerts.

Arix includes a robust set of API calls to allow you to create, update, and manage your loans.

You can use cURL from the command line or a service such as Postman in our sandbox to test the API calls.

• The base URL for Loan origination API calls to the Arix Sandbox environment is https://arixapisandbox.crbnj.net

• The full API Swagger reference documentation is available at this URL https://arixapisandbox.crbnj.net/swagger-ui.

• The base URL for Sandbox of Application Decisioning is https://lendingsandbox.crbcos.com/preapproval/v1

• The Swagger link for Hooks is https://lendingsandbox.crbcos.com/hooks/swagger/index.html

Status Page

To see a list of upcoming releases, monitor current API status, view incident reports, or get notified of scheduled maintenance, visit our status page and subscribe to alerts.