01API use cases
Finger Manager APIs can be used to synchronize customer data, operating tasks, workflow results, events, reports, and third-party modules between enterprise systems.
- Customer data synchronization
- Task and workflow synchronization
- Event notifications
- Reports and data export
- Third-party module connections
02Customer data synchronization
Customer data synchronization keeps client identity, ownership, account, KYC, and status data consistent between enterprise systems and Finger Manager.
- Client ID
- Client name or company name
- Contact details
- Assigned team
- Assigned IB
- Account status
- KYC status
- Created time
- Updated time
03Tasks and workflow synchronization
External operating items can be synchronized into Finger Manager as tasks, while Finger Manager handling results can be synchronized back to external systems.
- Onboarding applications
- KYC review
- Deposit review
- Withdrawal review
- Support tickets
- Risk events
- Report tasks
- Permission change requests
04Event notifications
Event notifications let enterprise systems know when important states change inside Finger Manager.
- Client status updated
- KYC status changed
- Task created
- Task completed
- Review approved
- Review rejected
- Risk event generated
- Report generated
- Permission changed
05Reports and data export
Enterprise teams can retrieve selected operating data or report results for internal analysis, management summaries, and system archiving.
- Client statistics
- KYC statistics
- Task handling statistics
- Payment review statistics
- Risk event statistics
- Team workload
- Operation log summaries
06Third-party module connections
When enterprises enable modules from the Module Store, APIs may be used to connect external services or approved third-party modules.
- KYC service integration
- Client analytics tools
- Risk monitoring services
- Reporting systems
- Notification services
- Internal approval systems
07API access permissions
API access should be configured by enterprise administrators or authorized technical staff. The exact access method depends on enabled modules, deployment model, and security configuration.
- API Key
- Access Token
- Enterprise account ID
- Permission scope
- IP allowlist
- Request signature
- Access logs
- Rate limits
08Identity and authentication
Finger Manager API requests must be authenticated. API credentials should be protected carefully and regenerated immediately if exposed.
- Bearer Token
- API Key
- Request signature
- Enterprise access credentials
09Data permission scope
API data access depends on enterprise configuration, module permissions, and API credential permissions. Enterprises should follow the least-privilege principle.
- Read-only client data
- Read-only task status
- Create tasks
- Update task status
- Read reports
- Receive event notifications
- Restrict sensitive fields
- Restrict specific team or business-line data
10Common API categories
Common API categories include customers, KYC, tasks, payment review, risk events, reports, and audit logs.
- Customer API: create, query, update profiles and status, query team assignment and KYC status
- KYC API: query status, create review tasks, update results, submit supplement status, query review records
- Task API: create tasks, query lists and details, update status, assign, close, and add notes
- Payment review API: create review tasks, query status, update results, mark exceptions, query records
- Risk event API: create and query events, update status, submit review, close events, query handling records
- Report API: create report tasks, query status, get results, view export history, query summaries
- Audit log API: query operation logs, permission changes, task handling, login records, and export records
11Webhook events
Webhooks push Finger Manager events to enterprise systems. Receiving systems should verify signatures, check event IDs, and avoid duplicate processing.
- customer.created
- customer.updated
- kyc.status_changed
- task.created
- task.updated
- task.completed
- payment.review_created
- payment.review_updated
- risk.event_created
- risk.event_closed
- report.generated
- permission.changed
12API security suggestions
Enterprises should protect credentials, separate environments, verify webhooks, log access, monitor abnormal requests, and avoid unnecessary sensitive data transmission.
- Do not expose API keys in front-end code
- Set least-privilege permissions
- Use different credentials for production and testing
- Rotate API keys regularly
- Enable IP allowlists
- Verify Webhook signatures
- Record API call logs
- Monitor abnormal requests
- Do not transmit unnecessary sensitive data
13Testing and launch
Before production API integration, enterprises should define goals, permissions, data types, testing, exception handling, Webhook retry behavior, security checks, and monitoring.
- Define integration goals
- Confirm data types
- Confirm API permissions
- Prepare test environment
- Complete integration testing with test data
- Check exception handling
- Verify Webhook retry behavior
- Run security checks
- Switch to production
- Monitor API calls continuously
14API usage boundaries
Finger Manager APIs are only for internal operations management, data synchronization, system integration, and workflow collaboration. Enterprises should use APIs according to their own business, architecture, and applicable laws.
- Not for end-user trading services
- Not for automated investment advice
- Not for trade matching
- Not for customer fund custody
- Not a replacement for enterprise compliance judgment
- Not for bypassing internal permission controls
