Banking / SoR connector

Overview

Banks already have a system of record. This connector hands Novus the trigger events that should kick off customer outreach (payment reminder, appointment confirmation, renewal nudge, collections sequence) and ships every delivery transition back via outbound webhooks. You don't move your data; you bridge it.

Nothing in the API is bank-specific — every payload field is generic enough that any LOS / LMS / CMS / AAS platform (T24, FLEXCUBE, Temenos, Mambu, in-house Java or .NET, etc.) can adopt it without schema work on either side. Map your domain events onto the thin eventType / contact / payloadenvelope once and the rest of the pipeline (idempotency, policy gate, delivery webhooks) works the same way for every partner.

Authentication

Inbound (your → Novus)

Bearer ApiKey. Workspace-scoped, rotates from the Novus admin console. Format:

Authorization: Bearer 1nc_<your-workspace-key>

Outbound (Novus → you)

HMAC-SHA256 over the canonical body, hex-encoded in the X-Novus-Signatureheader. Your endpoint verifies with the shared webhook secret you supply at subscription time. We sign every retry the same way, so HMAC verification is replay-safe.

Trigger events

POST /v1/events/trigger with an event envelope. The eventTypemust match a workflow name in your workspace — the matching workflow becomes the execution graph.

POST https://api.novusflow.tech/v1/events/trigger
Authorization: Bearer 1nc_<key>
Idempotency-Key: invoice-42-overdue-3d
Content-Type: application/json

{
  "eventType": "invoice_overdue",
  "contact": {
    "phone": "+628123456789",
    "email": "[email protected]",
    "metadata": { "tenant_account_id": "ACC-7891" }
  },
  "payload": {
    "invoice_id": "INV-42",
    "amount_idr": 1250000,
    "due_date": "2026-05-29"
  },
  "policy": { "permittedHoursStart": "08:00", "permittedHoursEnd": "20:00" }
}

Replays within 24 h with the same Idempotency-Key return the original run id — safe to retry on any 5xx or network failure on your side.

Outbound webhooks

Register subscriptions for any delivery_attempt transition you want to mirror back into your SoR. Common picks:

• delivery.queued — show "reminder scheduled" in your CMS UI.
• delivery.sent / delivery.delivered — close the loop on the source ticket.
• delivery.failed / delivery.dead_lettered — flip the contact's reachability flag.

Each event carries the original trigger envelope (triggerEventId) so you can correlate without storing the Novus run id.

Policy & compliance

For Indonesian banking deployments the platform enforces these regimes by default at the workspace level:

• POJK 6/2022 — consumer protection; permitted-hours window applied to every dispatch.
• SE OJK 19/2023 — digital channels; max-attempts cap per window (default 21 / 7 days).
• UU PDP 27/2022 — personal data; per-contact do-not-contact list overrides any campaign.

Defaults are 10:00–17:00 WIB · 21 attempts · 7-day window. Each event can override via the optional policy field.

Supported core banking stacks