Copy page

Finxact

Messages

Fetches Finxact msgRq (Message Request) records — the API-access audit trail Finxact Core writes for every request against the platform — and, by default, joins each request with its correlated msgRs (Message Response). Use this input to feed your SIEM, monitor administrator and service-account activity, correlate authentication events with downstream data changes, and satisfy compliance/audit requirements.

Sync Type: Incremental

Prerequisites

• A provisioned Finxact tenant with access to the Finxact Console.
  • Production: https://console.finxact.io
  • Sandbox: https://console-sandbox-server.dev-<pool>.finxact.io (e.g. dev-10).
• An API client registered under the tenant with a role that grants read access to the msgRq (and, when Fetch Responses is enabled, msgRs) resources.
• The tenant subdomain (e.g. acmebank) and, for non-production tenants, the environment pool suffix (e.g. dev-10).
• The Monad worker's egress IP address must be added to the Finxact tenant's IP allowlist (or reachable via the required VPN). Finxact enforces network-level access control on the core-banking API — see Networking below.

Obtain credentials in the Finxact Console

1. Sign in to the Finxact Console at https://console.finxact.io (production) or https://console-sandbox-server.dev-<pool>.finxact.io (sandbox).
2. Navigate to Settings → API Clients.
3. Create a new API client (or select an existing one dedicated to Monad).
4. Assign the client a role that grants read permission on the msgRq and msgRs resources.
5. Copy the generated Client ID and Secret — the secret is shown once at creation time.
6. Note the tenant subdomain (e.g. acmebank) and, for non-production, the environment pool (e.g. dev-10). Together they form the base URL: https://<tenant>.<pool>.finxact.io (sandbox) or https://<tenant>.finxact.io (production).

Configuration

Settings

Setting	Type	Required	Description
Tenant	string	Yes	Finxact tenant subdomain (e.g. acmebank). Forms the base URL host.
Environment Pool	string	No	Environment pool suffix (e.g. dev-10 for sandbox). Leave empty for production.
User Roles	array of strings	Yes	At least one role must grant read access to msgRq (and msgRs when Fetch Responses is on).
Client ID	string	Yes	Tenant API client_id, sent as the client_id HTTP header.
Backfill Start Time	string	No	ISO-8601 timestamp for the first sync (e.g. 2024-01-01T00:00:00Z). Leave empty to start from now (no historical backfill). Subsequent syncs are incremental and ignore this value.
Fetch Responses	bool	No	When true, for each msgRq record the input embeds the message response payload as msgRs on the emitted record.
Use Synthetic Data	bool	No	Generate synthetic demo records instead of connecting to Finxact. Useful for pipeline testing.

Secrets

Secret	Type	Required	Description
Client Secret	string	Yes	Tenant API client secret, sent as the secret HTTP header.

Networking

Finxact enforces network-level access control on the core-banking API. If the Monad worker cannot reach the tenant, or its egress IP is not on the allowlist, requests fail with HTTP 403 Forbidden. To resolve:

1. Identify the Monad worker's egress IP.
   • For Monad SaaS: see Monad egress IP addresses.
   • For self-hosted deployments: use your own cluster's outbound IP.
2. Add that IP to your Finxact tenant's allowlist via the Finxact Console (or coordinate with your Finxact deployment engineer).
3. If your tenant sits behind a required VPN, ensure the Monad worker is on the VPN.

Troubleshooting

finxact authentication failed — verify client_id/secret and that the configured user role has read access to msgRq (HTTP 401) The client_id / secret are wrong, or the role listed in User Roles does not grant read on msgRq/msgRs. Regenerate credentials in the Finxact Console and confirm the assigned role covers both resources.

finxact rejected the request at the network layer — the Monad runner egress IP is likely not on the tenant's allowlist or the required VPN is not connected (HTTP 403) Finxact's edge is refusing the connection before authentication runs. Confirm the Monad worker's egress IP is allowlisted at the tenant and that any required VPN is connected. See Networking.

No records returned despite recent API activity The initial backfill window may be too narrow. Set Backfill Start Time further back on the first sync, or verify recent activity in the Finxact Console. Note that logDtm — not wall-clock time — drives the cursor, so records with a logDtm earlier than the initial window are skipped.

Records emitted without msgRs even though Fetch Responses is on The individual GET /model/v1/msgRs/{_Id} call returned 404 (or another error) and was skipped gracefully. This is normal for msgRq entries whose response was never persisted (partial writes, retention windows). Check the worker logs for finxact msgRs fetch failed warnings for detail.

finxact 429 or repeated finxact 5xx errors Retryable — the input surfaces these so the framework retries on the next scheduled run. Persistent 429s indicate the tenant's contracted throughput is being exceeded; disable Fetch Responses, lower Page Size, reduce sync frequency, or coordinate an increase with your Finxact account team.

Related Articles

• Finxact — Message request (msgRq)
• Finxact — Authentication
• Finxact — Pagination, ordering, and limits
• Finxact — Core and model API endpoints
• Finxact — API response codes