Integration Checklist

The checklist below is intended to provide a comprehensive view of the capabilities available through the Lorum API and the endpoints that may be relevant to your integration.

You are not expected to implement every endpoint or flow listed. The functionality you choose to integrate will depend on your specific use case and how you intend to use the platform.

For certification, we'll review and validate the endpoints, flows, and webhooks that you have actually implemented. The purpose of the certification process is to confirm that the functionality you plan to use in production has been properly built, tested, and exercised in the sandbox environment.

1️⃣ Prerequisites

• Define your API integration use case - a clear description of what you are building and the purpose it will serve.

• Store credentials securely - client ID and client secret must be stored in environment variables, a secrets manager, or another secure storage mechanism. never hardcoded in source code or configuration files. → Authenticating to the API

• Cache and reuse access tokens - access tokens are valid for 3 hours and should be cached and reused for the duration of their validity period. Do not request a new token for every API call. → Get a bearer token

• Use idempotency keys on all POST & retries requests - every POST and retry request must include an Idempotency-Key header. → Idempotency docs

• Verify idempotent behaviour - submit the same request multiple times using the same idempotency key and confirm that Lorum returns the original response without creating duplicate resources.

• Enable webhooks in organisation settings before starting - for each webhook type you intend to consume, provide logs showing that the event was received and that a 2xx response was returned to Lorum. → Webhooks

2️⃣ Managing customers

• Create a business customer - Add Business. Submit the request and HTTP 201 response including the returned customer ID.

• Create an individual customer - Add Individual. Submit the request and HTTP 201 response including the returned customer ID.

• Get a customer - Get Customer. Confirm the response returns the correct customer details.

• Update a customer - Update Customer. Confirm customer details can be updated and the response reflects the changes correctly.

• List customers - List Customers. Confirm your integration can retrieve and filter your customer list.

• Add a shareholder to a business - Add Shareholder. Submit the request and HTTP 201 response including the returned shareholder ID.

• List shareholders for a business - List Shareholders. Confirm shareholder records are retrievable for business customers.

• Get a shareholder - Get Shareholder. Confirm individual shareholder records are retrievable.

• Update a shareholder - Update Shareholder. Confirm shareholder details can be updated and the response reflects the changes correctly.

3️⃣ Currency onboarding

• Upload customer documents - Upload Document. Upload required customer documentation to Lorum. Include both the request and the HTTP 201 response in your logs.

• Link a document to a customer - Link Document. Associate an uploaded document with a specific customer record.

• Get a document - Get Document. Confirm the uploaded document is retrievable and the response includes the correct status.

• List documents - List Documents. Confirm all documents associated with a customer are returned correctly.

• Unlink a document from a customer. - Unlink Document. Unlink a document from a customer.

• Onboard a customer for a specific currency - Onboard Customer. Trigger onboarding for a customer for the selected currency (EUR, GBP, AED, USD).

• Check onboarding status - Get Customer Onboarding Status. Check whether a customer has been successfully onboarded for a specific currency. Handle both the 200 (onboarded) and 404 (not yet onboarded) responses correctly.

• onboarding_completed webhook - your integration must wait for this event before proceeding to account creation. → Docs
  The only exception is onboarding for AED, which is instant and does not rely on the onboarding_completed webhook.

4️⃣ Managing virtual accounts

• Create an account - Create Account. Create a virtual account for a customer. Include the Idempotency-Key header in your request log to ensure safe retries.

• Get an account - Get Account. Retrieve account details and confirm the response includes account status and balances.

• Update account data - Update Account. Confirm account name or external ID can be updated and the response reflects the changes.

• List a customer's accounts - List a Customer's Accounts. Confirm all accounts for a given customer are returned correctly.

• List all accounts for organisation - List All Accounts. Confirm organisation-wide account visibility works correctly.

• Get an account's balance history - Get Balance History. Confirm balance changes over time are returned correctly.

• Get account confirmation letter - Get Account Confirmation Letter. Confirm the letter is generated and returned correctly for an open account.

• account_opened webhook - surface the virtual account to users only after this event is received. → Docs

• account_updated webhook - Docs

5️⃣ Making payments

• Estimate the fee for a payment - Estimate Payment Fee. Calculate the applicable fee for a payment before creating it and confirm your integration correctly handles real-time fee deduction.
  Fees are automatically collected from the available balance of the transaction account at the time the payment is processed, as described here. This can also be configured to collect fees from the primary account instead.

• Initiate an outbound payment - Create Outbound Payment. Create an outbound payment request. Include the Idempotency-Key header and capture the returned transaction ID.

• Get a transaction - Get a Transaction. Retrieve transaction details and validate validate all possible transaction states where applicable.

• Get transaction confirmation letter - Get Transaction Confirmation Letter. Confirm that a confirmation letter can be generated for transactions in submitted or executed state.

• List transactions for an account - List Transactions. Validate pagination handling by ensuring your integration processes pages.next and retrieves subsequent pages.

• Get all transactions across accounts - Get All Transactions. Confirm organisation-wide transaction visibility works correctly.

• Link a document to a transaction - Link Document to Transaction. Confirm a supporting document can be attached to a transaction.

• Get linked documents for a transaction - Get Linked Documents. Confirm linked documents are retrievable for a given transaction.

• outbound_local_payment_created webhook - Docs

• outbound_local_payment_submitted webhook - Docs

• outbound_local_payment_executed webhook - Docs

• outbound_local_payment_failed webhook - confirm failure_reason is captured. → Docs

• outbound_local_payment_returned webhook - confirm returned_reason is captured. → Docs

• inbound_local_payment_settled webhook - Docs

• fee_debited webhook - confirm the fee is linked to the originating transaction via fee_target.reference. → Docs
  This webhook is only applicable when fees are collected from the primary account.

6️⃣ Making internal transfers

• Initiate an internal transfer - Move Funds Between Accounts. Create an internal transfer between two accounts. Include the Idempotency-Key header and capture the returned transaction ID.

• Get a transaction - Get a Transaction. Retrieve transfer details and confirm both outbound and inbound direction of the transfer are visible.

• List transactions for an account - List Transactions. Confirm both directions appear when listing transactions for the remitter and beneficiary accounts.

• Get all transactions across accounts - Get All Transactions. Validate that both directions are visible at an organisation level.

• internal_transfer_created webhook - Docs

• internal_transfer_settled webhook - Docs

• inbound_internal_transfer_settled webhook - Docs

• internal_transfer_failed webhook - confirm failure_reason is captured. → Docs

7️⃣ Making foreign exchange

• Get an exchange quote - Get Exchange Quote. Confirm your integration retrieves a rate before initiating a foreign exchange and handles the quote fields correctly.

• Initiate an exchange transfer - Create a Currency Exchange. Create a currency exchange transaction. Include the Idempotency-Key header and capture the returned transaction ID.

• Get a transaction - Get a Transaction. Retrieve transaction details and confirm rate, currency, and counterpart_currency are included in the response.

• List transactions for an account - List Transactions. Confirm that FX transactions appear correctly when listing transactions for both the remitter and beneficiary accounts.

• outbound_exchange_transfer_created webhook - Triggered when an FX is created.confirm rate, currency, and counterpart_currency are captured. → Docs

• outbound_exchange_transfer_executed webhook - Docs

• inbound_exchange_transfer_settled webhook - Docs

• outbound_exchange_transfer_failed webhook - confirm failure_reason is captured. → Docs

8️⃣ Submission

Include the timestamp and timezone of your tests alongside:

• API request and response logs for all relevant endpoints within your integration scope (sensitive data masked)
• Webhook logs confirming receipt and a 2xx response for each event
• A short written overview of your API integration use-case, token management and idempotency approach