MX vs TrueLayer

Hosted flows

1. developerLet a user connect their bank with a drop-in hosted flow — create a session server-side, open the widget, and get back a token for the connected account — without building institution UI myself

   weight 3 · round to MX
   MX✓fullclaimed8/10

   MX docs describe the Connect Widget as a ready-made, embeddable UI that prompts end users to authenticate with their institution credentials, paired with the Platform API for server-side session/member creation, matching the drop-in hosted flow with no custom institution UI needed. Webhooks and member/account tokens (e.g., guid-based member connections) round out the server-to-client flow. missing for 10: explicit mention of a 'connect token' generation endpoint and independent/third-party confirmation of the end-to-end session-create-then-widget-open flow.

   • [claimed-docs] “MX's ready-made UI that can be embedded in your application to aggregate users' account data by prompting end users to connect to their fina…”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”
   • [claimed-docs] “To test OAuth in the Connect Widget when it's embedded in a WebView, you must load the financial institution's OAuth window in the device's …”
   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The evidence pack describes TrueLayer's Data API for reading account/identity/transaction info and lists supported providers, but nowhere documents a drop-in hosted widget with a server-side session creation and token retrieval flow for account-linking (the closest analog, 'payment links', applies only to payments, not data/account linking). Missing for 10: hosted account-linking widget SDK/UI docs, session-creation endpoint for linking, and evidence of a returned account-link token from a widget flow.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”

   proof ↗⚑ flag

Oauth

1. developerConnections to major institutions use bank-hosted OAuth rather than screen-scraped credentials — the platform documents its OAuth coverage and how legacy credential flows are being retired

   weight 2 · round drawn
   MX—none0/10

   Evidence shows MX supports OAuth in its Connect Widget (mx-docs-23) but there is no documentation of overall OAuth coverage across institutions or any stated plan for retiring legacy credential-based (screen-scraped) connections, which is the core of this story.

   • [claimed-docs] “To test OAuth in the Connect Widget when it's embedded in a WebView, you must load the financial institution's OAuth window in the device's …”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The evidence pack covers TrueLayer's Payments, Data, and Verification APIs, SDKs, and a providers endpoint listing supported banks per country, but nothing explicitly documents that connections use bank-hosted OAuth versus screen-scraping, nor any statement about retiring legacy credential-based flows. Without that specific documentation, this axis is unsupported.

   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag

Repair

1. ops leadBroken connections are repairable — expired or revoked links surface as documented statuses, and users can re-authenticate in an update flow without starting over

   weight 2 · round drawn
   MX—none0/10

   The evidence pack covers MX's connectivity products (aggregation, IAV, AOI, microdeposits, webhooks) but never documents connection/member status codes (e.g., expired, revoked, challenged) or a dedicated re-authentication/update flow that lets users fix a broken link without re-onboarding. This is a plausible and expected capability for an account-aggregation platform, but nothing in the pack substantiates it.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer's docs cover consent, mandates, and webhooks for payment status but nowhere document how expired/revoked account-links surface as distinct statuses or how a user re-authenticates via an update flow without restarting; the evidence pack has no reference to reconnection/re-auth UX for broken links.

   ⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   MX✓fullprobed9/10

   MX hosts a working llms.txt at docs.mx.com/llms.txt (confirmed HTTP 200 with structured doc links) and also documents an official MCP server, both explicitly agent-oriented entry points into their docs. Missing for 10: independent third-party confirmation of an AI agent successfully consuming these resources end-to-end.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.mx.com/llms.txt # MX Documentation - [Welcome to the MX Documentation](https://docs.mx.com/index.m…”
   • [probe] “official MCP server documented at https://docs.mx.com/mcp”

   proof ↗⚑ flag

   TrueLayer✓fullprobed9/10

   TrueLayer hosts a verified llms.txt at docs.truelayer.com/llms.txt (probe confirms HTTP 200) with a documented convention that any docs page can be appended with .md for markdown, directly enabling agent-oriented consumption; docs also explicitly cover an MCP integration for AI assistants, reinforcing agent-native design. Missing for 10: no independent third-party confirmation that agents reliably use this in practice beyond TrueLayer's own docs.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.truelayer.com/llms.txt # TrueLayer Documentation > TrueLayer Documentation Append .md to any docu…”
   • [claimed-docs] “Monitor payments and generate reports in Console.”
   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   MX~partialclaimed5/10

   MX is an API-first platform with a documented REST/OpenAPI spec (mx-gh-1, mx-docs-12/26) and webhooks (mx-docs-7/22) that could be driven headlessly from CI, but there is no explicit evidence of a CLI, headless SDK mode, or documented CI/automation workflow — the Connect Widget appears UI-embedded (mx-docs-9, mx-docs-21) which cuts against pure headless use. missing for 10: explicit CI/headless usage docs, a CLI or automation-focused SDK, confirmation that Connect flows can run without embedded UI.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX's ready-made UI that can be embedded in your application to aggregate users' account data by prompting end users to connect to their fina…”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer is API-first with SDKs (Node.js, Python, Java, .NET) and signing libraries, which are inherently usable in headless/automated/CI contexts since there is no GUI dependency for core payment/data operations. However, there is no explicit documentation about CI/CD integration, automated testing pipelines, or headless deployment guidance. Missing for 10: explicit CI/automation documentation, example CI pipeline configs, headless testing guidance, non-interactive auth flow docs for automated environments.

   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [claimed-docs] “They simplify API calls with easy-to-use interfaces, type-hinted methods and abstractions. They also automate request signing for all Paymen…”
   • [github] “Convenient libraries to produce TrueLayer API requests signatures.”
   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round drawn
   MX✓fullprobed7/10

   MX documents an official MCP server at docs.mx.com/mcp, confirmed via probe, indicating a first-party MCP integration point. Missing for 10: detailed setup/config docs excerpt, independent/hands-on confirmation of the MCP server working, and specifics on tool coverage exposed via MCP.

   • [probe] “official MCP server documented at https://docs.mx.com/mcp”

   proof ↗⚑ flag

   TrueLayer✓fullprobed7/10

   TrueLayer documents an official MCP server integration for Claude AI, exposing at least one concrete tool (create-truelayer-payment-link) that lets an agent perform banking/payment operations, and a probe confirms the doc page exists. Missing for 10: broader tool catalog beyond payment-link creation, independent/hands-on verification of the MCP server working, and details on setup/auth for non-Claude MCP clients.

   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round drawn
   MX—none0/10

   MX is a financial data API/SDK platform; no evidence of an official CLI tool for developers or AI-native workflows appears in the evidence pack — only API specs, webhooks, and a widget/UI. Evidence exists of an MCP server and OpenAPI spec, but no CLI is documented.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer is a payments/banking API platform with SDKs, an MCP server for Claude, and signing libraries, but no evidence anywhere in the pack of an official CLI tool for developers or AI-native workflows.

   ⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round drawn
   MX✓fullprobed8/10

   MX exposes a documented Platform API with OpenAPI spec (available via GitHub and Postman import), REST endpoints across account verification, aggregation, statements, and webhooks, plus llms.txt and an MCP endpoint enabling AI-native access. Missing for 10: the official openapi.json isn't directly hosted at expected docs.mx.com paths (probe 404s), and there's no independent third-party corroboration of API robustness beyond MX's own docs.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.mx.com/llms.txt # MX Documentation - [Welcome to the MX Documentation](https://docs.mx.com/index.m…”
   • [probe] “official MCP server documented at https://docs.mx.com/mcp”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”

   proof ↗⚑ flag

   TrueLayer✓fullprobed8/10

   TrueLayer publishes extensive public API documentation covering Payments API v3, Data API, Verification API, webhooks, signing, and SDKs for Node.js/Python/Java/.NET, with a quickstart for making a test payment — clear evidence of a documented, programmatically drivable API for an AI-native or any developer user. Missing for 10: a discoverable machine-readable OpenAPI/Swagger spec (probe found only 404s), so full API surface must be inferred from prose docs rather than a formal schema.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [claimed-docs] “The Payments API v3 uses a pair of ECDSA keys in addition to a bearer token.”
   • [claimed-docs] “They simplify API calls with easy-to-use interfaces, type-hinted methods and abstractions. They also automate request signing for all Paymen…”
   • [claimed-docs] “you'll create a free UK merchant account and complete your first test payment with the Payments API v3”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.truelayer.com/llms.txt # TrueLayer Documentation > TrueLayer Documentation Append .md to any docu…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round drawn
   MX—none0/10

   No evidence of scoped/least-privilege API credential issuance for agents—docs cover data connectivity, webhooks, OpenAPI spec, and even an MCP server reference, but nothing about issuing restricted-scope API keys/tokens for AI agent use.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer's docs describe standard API client credentials, OAuth-style bearer tokens plus ECDSA signing, and an MCP integration for Claude, but nothing describes issuing scoped or least-privilege credentials specifically for an AI agent (e.g., agent-specific API keys, granular permission tiers, or restricted scopes for automated/agentic use). Missing for 10: any mention of agent-specific credential scoping, permission tiers, or least-privilege key issuance beyond generic client_id/secret and bearer tokens.

   • [claimed-docs] “Invite users so they can retrieve your integration's client credentials, access the payments view, or issue refunds.”
   • [claimed-docs] “The Payments API v3 uses a pair of ECDSA keys in addition to a bearer token.”
   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to TrueLayer
   MX~partialclaimed4/10

   MX publishes an official OpenAPI specification (mx-gh-1) and supports importing it into Postman for API exploration (mx-docs-12/26), which enables building typed/generated clients, but there is no evidence of dedicated first-party SDK libraries (e.g., Python, JS, Java) or SDK-specific documentation/examples. missing for 10: named official SDK packages/libraries, language-specific SDK docs, and independent confirmation of SDK usage.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”

   proof ↗⚑ flag

   TrueLayer✓fullclaimed7/10

   TrueLayer explicitly documents official SDKs for Node.js, Python, Java and .NET (truelayer-docs-11) that simplify API calls with typed interfaces and automate request signing (truelayer-docs-24), backed by a public GitHub signing library (truelayer-gh-1). Missing for 10: broader language coverage evidence, independent developer adoption signals (stars, community usage), and versioned changelog/release cadence proof.

   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [claimed-docs] “They simplify API calls with easy-to-use interfaces, type-hinted methods and abstractions. They also automate request signing for all Paymen…”
   • [claimed-docs] “We offer signing libraries in these languages”
   • [github] “Convenient libraries to produce TrueLayer API requests signatures.”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   MX✓fullclaimed8/10

   MX documents a webhooks system that sends HTTPS POST callbacks so developers can subscribe to specific events, clearly supporting webhook-based event subscription. Missing for 10: an exhaustive list of supported event types and independent/hands-on confirmation beyond first-party docs.

   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”

   proof ↗⚑ flag

   TrueLayer✓fullclaimed8/10

   TrueLayer documents webhooks as JSON notifications for Payments API v3 events (e.g. payment status changes), configurable per-app via a webhook URI in Console, with signature verification (Tl-Signature) recommended via signing libraries. This gives a clear, documented subscribe-to-events-via-webhook mechanism usable programmatically by an AI-native integration. Missing for 10: no independent/hands-on corroboration of webhook reliability, and no evidence of webhook management via API (vs Console-only configuration) or filtering/subscription granularity.

   • [claimed-docs] “Webhooks are JSON-format notifications you receive when any event occurs within the Payments API v3.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”
   • [claimed-docs] “You must validate all incoming webhook requests through the `Tl-Signature` that accompanies the webhook.”
   • [claimed-docs] “Each of your apps in Console can have a single webhook URI, which the Payments API sends webhooks to.”
   • [claimed-docs] “We strongly recommend you use our signing libraries to verify the `Tl-Signature` of any webhooks you receive.”

   proof ↗⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round to MX
   MX~partialclaimed5/10

   MX's marketing pages describe personalized financial guidance and a conversational 'ask about your money' experience generated from each consumer's data (mx-docs-14, mx-docs-27), which matches the AI-insights story, and mx-docs-13 references 'data-driven intelligence.' However, these are thin, high-level marketing snippets rather than detailed product docs, and there is no independent/hands-on corroboration or technical documentation of the underlying AI model or insight-generation pipeline. Missing for 10: dedicated technical documentation of the AI/insights feature, concrete examples of generated insights, and independent verification of the claim.

   • [claimed-docs] “Use data-driven intelligence about your customers”
   • [claimed-docs] “Personalized financial guidance generated from each consumer's financial data, surfaced in a relevant and timely experience”
   • [claimed-docs] “Provide an experience where consumers can ask about their money in plain language and act on the answer, with every figure pulled from real …”
   • [claimed-docs] “Access account and transaction history all in one view. Use the data to increase multi-product adoption, and build trust.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   TrueLayer's evidence covers Data/Payments APIs and an MCP integration letting Claude perform banking actions on a user's behalf, but nothing shows TrueLayer itself generating AI insights or suggestions from account/transaction data inside its Console or product surface.

   ⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to TrueLayer
   MX~partialprobed3/10

   MX documents autonomous background behavior — automatic re-aggregation of accounts roughly every 24 hours and webhook callbacks for events — which could underpin background automations, and an MCP endpoint is referenced. However there's no evidence of a user-facing automation/workflow builder or agent-orchestration framework for setting up custom autonomous tasks. Missing for 10: explicit automation/workflow configuration tooling, evidence of AI-agent-driven autonomous task execution beyond scheduled sync, and independent confirmation of the MCP server's automation capabilities.

   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”
   • [probe] “official MCP server documented at https://docs.mx.com/mcp”

   proof ↗⚑ flag

   TrueLayer~partialprobed5/10

   TrueLayer supports payment mandates (VRPs/Direct Debits) that, once authorised, execute automatically in the background without further user authorisation, and webhooks provide event-driven automation; the MCP server integration also lets an AI agent (Claude) trigger banking/payment operations. However, there is no dedicated AI-native automation/scheduling framework—just mandate-based recurring payments plus generic webhooks and a single third-party MCP integration. Missing for 10: a first-party AI-agent automation/orchestration feature, evidence of persistent autonomous background agents beyond mandate execution, and broader multi-step automation tooling.

   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “Once you create a payment on an authorised mandate, it executes immediately without requiring further user authorisation.”
   • [claimed-docs] “Payment mandates belong to one of three types: Sweeping VRPs... Wave 1 VRPs... Direct Debits”
   • [claimed-docs] “After you create a payment mandate and your user has authorised it, you can create a payment on the mandate... it executes immediately.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”
   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

3. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   MX~partialprobed6/10

   MX documents an official MCP server (mx-probe-3) that would let AI agents issue natural-language commands against the platform, and marketing copy (mx-docs-27) describes enabling plain-language financial queries. However, there is no detailed documentation of the NL command set, limits, or hands-on confirmation of how well it works. Missing for 10: detailed MCP tool/command documentation, independent verification of NL command execution, and coverage of edge cases/limitations.

   • [probe] “official MCP server documented at https://docs.mx.com/mcp”
   • [claimed-docs] “Provide an experience where consumers can ask about their money in plain language and act on the answer, with every figure pulled from real …”

   proof ↗⚑ flag

   TrueLayer~partialprobed6/10

   TrueLayer documents an official MCP server integration with Claude AI that lets users invoke banking/payment operations (e.g., 'create-truelayer-payment-link') via natural language, directly enabling AI-native NL command usage. However, evidence only shows one example tool and a single AI assistant integration rather than a broad natural-language command surface across the full API. Missing for 10: evidence of broader NL command coverage across accounts/verification/mandates, independent hands-on confirmation of the MCP server's reliability, and support beyond Claude AI.

   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to MX
   MX~partialprobed5/10

   MX publishes an OpenAPI spec (mx-gh-1) that users can import into Postman to explore requests/responses (mx-docs-12, mx-docs-26), and provides a sandbox test-platform with test institutions (mx-docs-8). However, there is no evidence of an embedded, in-docs interactive API reference with directly runnable examples (e.g., a Swagger/Redoc-style try-it-now console) — probes for a hosted openapi.json on the docs site 404 (mx-probe-2), meaning users must leave the docs and use an external tool like Postman to run calls. Missing for 10: an in-browser interactive explorer with click-to-run examples, and confirmation the OpenAPI spec is directly hosted/interactive on docs.mx.com rather than requiring external import.

   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “We offer four test institutions that you can use”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.mx.com/openapi.json, https://docs.mx.com/swagger.json, https://docs.mx.com/api/openapi.…”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The evidence pack contains only static documentation descriptions (guides, webhook references, SDK mentions) with no mention of an interactive API reference or runnable code examples/try-it-out console. A direct probe for OpenAPI/Swagger specs at standard paths returned 404 across all candidates, indicating no discoverable interactive API explorer.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”
   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.truelayer.com/llms.txt # TrueLayer Documentation > TrueLayer Documentation Append .md to any docu…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to MX
   MX✓fullprobed9/10

   MX explicitly documents downloading its OpenAPI Specification for import into Postman, and a dedicated GitHub repo (mxenabled/openapi) hosts the machine-readable spec. Missing for 10: no evidence of a standard hosted openapi.json endpoint (probe found 404s at common paths), so discovery relies on docs/GitHub rather than a canonical URL.

   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.mx.com/openapi.json, https://docs.mx.com/swagger.json, https://docs.mx.com/api/openapi.…”

   proof ↗⚑ flag

   TrueLayer—none0/10

   A direct probe for OpenAPI/Swagger spec files at common paths (openapi.json, swagger.json, etc.) returned 404 across the board, and no documentation item references a downloadable machine-readable API spec despite extensive API docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to MX
   MX✓fullclaimed7/10

   MX explicitly documents a test platform with four test institutions and OpenAPI spec/Postman import for exercising the API without touching real production financial data, plus dedicated guidance for testing the Connect Widget/OAuth flows. missing for 10: no explicit statement distinguishing a separate 'sandbox' credential set or environment isolation guarantee, and no independent/hands-on confirmation that test data never touches production systems.

   • [claimed-docs] “We offer four test institutions that you can use”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “To test OAuth in the Connect Widget when it's embedded in a WebView, you must load the financial institution's OAuth window in the device's …”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”

   proof ↗⚑ flag

   TrueLayer~partialprobed5/10

   TrueLayer provides a free test/sandbox merchant account for making test payments (truelayer-docs-32, quickstart-make-a-test-payment), which lets a developer or AI agent exercise the Payments API without touching production data. However, there is no explicit documentation of a dedicated sandbox environment concept (separate sandbox base URLs, sandbox-specific credentials, or sandbox banks/test providers) distinct from a 'free account' used for a first test payment, and no confirmation the MCP integration itself can be pointed at a sandbox. Missing for 10: explicit sandbox environment documentation (test-mode endpoints, mock bank providers), confirmation that the MCP server/agent tooling can target sandbox vs production, and independent/hands-on verification of sandbox isolation.

   • [claimed-docs] “you'll create a free UK merchant account and complete your first test payment with the Payments API v3”
   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   MX—none0/10

   Evidence confirms MX publishes an OpenAPI spec (mx-gh-1, mx-docs-12/26) but nowhere documents API versioning conventions or a formal deprecation policy for breaking changes. Missing for 10: documented version numbering scheme, deprecation timeline/notice policy, changelog of breaking changes.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   Evidence confirms TrueLayer exposes a versioned API (Payments API v3) but nowhere documents a deprecation policy, versioning changelog, or sunset schedule for older API versions. Missing for 10: any versioning/deprecation policy page, changelog, migration guide, or sunset timeline evidence.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “The Payments API v3 uses a pair of ECDSA keys in addition to a bearer token.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   MX—none0/10

   The evidence describes per-user/per-account connectivity, aggregation, and identity verification features, but nothing documents bulk or batch operations across many items/accounts/users at once. Missing for 10: any batch API endpoints, bulk data export/import operations, or documentation of multi-item processing at scale.

   ⚑ flag

   TrueLayer—none0/10

   The evidence pack covers single-payment, single-payout, and single-mandate creation flows, webhooks, and MCP tool for one-off payment links, but no documentation of any batch/bulk endpoint for processing many payments, payouts, or accounts in one call. Missing for 10: batch payment/payout creation endpoints, bulk data export or bulk verification APIs, any documented rate/volume-oriented bulk operation.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Send payments to bank accounts. Covers the API, beneficiary management and reconciliation.”
   • [claimed-docs] “Send payouts to bank accounts that have been verified against a user's identity.”
   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round drawn
   MX~partialclaimed4/10

   MX provides webhooks that let subscribers receive event notifications (e.g., aggregation completion) which developers can use to trigger their own downstream actions, but there is no evidence of a native rules/automation engine where users define conditional trigger-action logic within MX itself. missing for 10: a documented rules/automation builder or conditional trigger-action configuration UI, evidence of built-in actions (not just external webhook consumption).

   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”
   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”

   proof ↗⚑ flag

   TrueLayer~partialclaimed4/10

   TrueLayer provides webhooks that notify external systems on payment status events, and payment mandates that execute automatically once authorised (e.g. VRPs, Direct Debits), giving building blocks for event-driven automation. However, there is no evidence of a native rules-engine or condition/action configuration UI where a user defines arbitrary 'if event X then do Y' automations within TrueLayer itself — the actual rule logic must be built by the developer's own system consuming the webhook. Missing for 10: a documented rules/automation engine, in-product trigger-action configuration, and any first-party or independent example of user-defined automation rules beyond webhooks and fixed mandate execution.

   • [claimed-docs] “Webhooks are JSON-format notifications you receive when any event occurs within the Payments API v3.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”
   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “Once you create a payment on an authorised mandate, it executes immediately without requiring further user authorisation.”
   • [claimed-docs] “Payment mandates belong to one of three types: Sweeping VRPs... Wave 1 VRPs... Direct Debits”
   • [claimed-docs] “Each of your apps in Console can have a single webhook URI, which the Payments API sends webhooks to.”

   proof ↗⚑ flag

3. ai-native userSchedule recurring jobs or workflows

   weight 2 · round to TrueLayer
   MX—none0/10

   MX's aggregation happens automatically on a fixed ~24-hour cycle (mx-docs-25) and webhooks push events, but there is no evidence of user-defined recurring job/workflow scheduling, cron-like configuration, or workflow orchestration for AI-native users. missing for 10: user-configurable schedule/frequency controls, workflow/orchestration engine, any AI-native automation scheduling feature.

   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer supports payment mandates (VRPs) that, once authorised, let a payment execute automatically and repeatedly without further user authorisation — a domain-specific form of recurring workflow (docs-15, docs-16, docs-30, docs-31). However there is no evidence of a general-purpose scheduler, cron-like triggers, or workflow orchestration beyond recurring payments themselves. missing for 10: general job/workflow scheduling primitives, evidence of scheduling cadence configuration (daily/weekly/custom), and any non-payment automation use case.

   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “Once you create a payment on an authorised mandate, it executes immediately without requiring further user authorisation.”
   • [claimed-docs] “Payment mandates belong to one of three types: Sweeping VRPs... Wave 1 VRPs... Direct Debits”
   • [claimed-docs] “After you create a payment mandate and your user has authorised it, you can create a payment on the mandate... it executes immediately.”

   proof ↗⚑ flag

Ach details

1. developerObtain verified account and routing numbers (or tokenized equivalents) from a linked account to fund ACH or bank-debit payments without micro-deposits

   weight 3 · round to MX
   MX✓fullclaimed9/10

   MX's Instant Account Verification explicitly retrieves account and routing numbers for demand deposit accounts without micro-deposits, and Tokenized Account Numbers (TANs) provide a secure tokenized alternative for ACH money movement, both documented as distinct from the separate microdeposits verification method. missing for 10: independent/hands-on corroboration beyond first-party docs.

   • [claimed-docs] “you can connect to an end user's financial institution and retrieve account and routing numbers for their demand deposit accounts”
   • [claimed-docs] “With Instant Account Verification, you can connect to an end user's financial institution and retrieve account and routing numbers for their…”
   • [claimed-docs] “Tokenized Account Numbers (TANs) are substitute account numbers used for secure ACH money movement.”
   • [claimed-docs] “Microdeposits is different—it provides an alternate method for verifying account ownership by making small test deposits to an account.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   TrueLayer's documented Payments/Verification/Data APIs operate on UK/EU account identifiers (sort code/account number, IBAN, Direct Debit, Faster Payments, VRPs) and provide identity/name verification, not US-style ACH funding via account/routing numbers or tokenized ACH equivalents. No evidence pack item references ACH, routing numbers, or micro-deposit-free bank-debit tokenization.

   • [claimed-docs] “Verify that a bank account belongs to a given user.”
   • [claimed-docs] “Send payouts to bank accounts that have been verified against a user's identity.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”
   • [claimed-docs] “Payment mandates belong to one of three types: Sweeping VRPs... Wave 1 VRPs... Direct Debits”
   • [claimed-docs] “Store bank account details for future payment initiation. Covers setup, consent and reuse.”

   proof ↗⚑ flag

Balances

1. developerFetch a real-time balance for a connected account before initiating a payment — a documented balance endpoint intended for NSF and risk checks

   weight 3 · round to MX
   MX~partialclaimed6/10

   MX documents a balance product ('Get the available balance for an end user's financial accounts') confirming real-time balance retrieval for connected accounts, which aligns with the story's core ask. However, there is no explicit mention of NSF/risk-check use case, no documented latency/real-time SLA, and no dedicated endpoint spec or code sample shown in evidence. missing for 10: explicit NSF/risk-check framing, real-time performance guarantees, concrete endpoint/request-response example.

   • [claimed-docs] “Get the available balance for an end user’s financial accounts”
   • [claimed-docs] “Get the available balance for an end user's financial accounts”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer's Data API documents reading account balances (truelayer-docs-5, truelayer-docs-28), which could be used before initiating a payment, but there is no documented endpoint or guidance explicitly framed as a pre-payment real-time balance/NSF or risk check tied to the Payments API flow. missing for 10: explicit documentation of a balance-check step integrated into the payment initiation flow, real-time/NSF-specific balance endpoint framing, and independent confirmation of this workflow.

   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”

   proof ↗⚑ flag

Ownership

1. ops leadRetrieve account-holder details — names, addresses, contact data on file at the bank — to match the account owner against my customer

   weight 2 · round to MX
   MX✓fullclaimed8/10

   MX's Account Owner Identification product explicitly retrieves name and address data tied to a financial account, directly enabling ops to match account holder identity against a customer record; this is well documented with first-party docs. Missing for 10: independent/hands-on corroboration beyond MX's own docs, and no explicit mention of retrieving full contact data (phone/email) alongside name/address.

   • [claimed-docs] “you can connect to an end user's financial account to retrieve information such as their name and address”
   • [claimed-docs] “With Account Owner Identification, you can connect to an end user's financial account to retrieve information such as their name and address…”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer's Data API exposes 'identity' data alongside accounts/transactions/balances, and its Verification API explicitly compares identity data (name) against connected account holders — supporting name-based ownership matching. However, the evidence never confirms retrieval of addresses or contact details on file at the bank, only name matching. Missing for 10: explicit documentation of address/contact fields returned by the identity endpoint, and any hands-on confirmation of full account-holder profile retrieval.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”

   proof ↗⚑ flag

Processor tokens

1. developerLinked accounts plug into my payment processor — documented integrations or token exchange that hand verified account credentials to third-party processors and platforms

   weight 2 · round drawn
   MX~partialclaimed6/10

   MX provides Instant Account Verification (account/routing numbers) and Tokenized Account Numbers (TANs) explicitly described as 'substitute account numbers used for secure ACH money movement,' which supports handing verified account credentials to processors for payment initiation, plus a Connect Widget/Platform API for linking accounts. However, evidence does not show explicit named integrations or token-exchange flows with specific third-party payment processors (e.g., Stripe, Plaid-style processor partnerships) beyond MX's own ACH/TAN mechanism. missing for 10: documented named processor/platform integrations or partner list, explicit token-exchange API examples handing credentials to a specific external processor, independent confirmation of processor handoff working in production.

   • [claimed-docs] “you can connect to an end user's financial institution and retrieve account and routing numbers for their demand deposit accounts”
   • [claimed-docs] “With Instant Account Verification, you can connect to an end user's financial institution and retrieve account and routing numbers for their…”
   • [claimed-docs] “Tokenized Account Numbers (TANs) are substitute account numbers used for secure ACH money movement.”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”

   proof ↗⚑ flag

   TrueLayer~partialclaimed6/10

   TrueLayer documents Data API/Verification API flows that verify account ownership and identity, plus Payments API mechanisms (mandates, webhooks, signed requests) that let merchants/platforms initiate verified payments to bank accounts — this covers the core 'linked accounts feed a payment processor' story. However, evidence is entirely first-party docs describing TrueLayer's own APIs as the processor, not clear documentation of handing verified credentials to a distinct third-party processor/platform via token exchange. missing for 10: independent/hands-on confirmation, explicit third-party processor handoff or OAuth token exchange spec, and real-world integration case studies beyond marketing snippets.

   • [claimed-docs] “Verify that a bank account belongs to a given user.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Store bank account details for future payment initiation. Covers setup, consent and reuse.”
   • [claimed-docs] “Send payouts to bank accounts that have been verified against a user's identity.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”
   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “After you create a payment mandate and your user has authorised it, you can create a payment on the mandate... it executes immediately.”
   • [claimed-docs] “Use TrueLayer for payments in your webshop with our plugins for WooCommerce, Shopify and Magento.”

   proof ↗⚑ flag

Agent data

1. ai-native userThe data comes back agent-consumable — clean structured JSON, documented schemas, and enrichment an automated financial workflow can reason over without heuristic parsing

   weight 2 · round to MX
   MX✓fullprobed8/10

   MX publishes a full OpenAPI specification (mx-gh-1, mx-docs-12/26) covering structured request/response payloads across accounts, transactions, balances, identity, and verification endpoints, plus webhooks for event-driven consumption (mx-docs-7/22) and even an official MCP server for agent access (mx-probe-3), directly supporting machine-consumable, schema-documented data for automated workflows. Missing for 10: concrete sample JSON response bodies in the evidence pack and independent third-party corroboration that the schemas are agent-friendly without extra parsing.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [probe] “official MCP server documented at https://docs.mx.com/mcp”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.mx.com/llms.txt # MX Documentation - [Welcome to the MX Documentation](https://docs.mx.com/index.m…”

   proof ↗⚑ flag

   TrueLayer~partialprobed7/10

   TrueLayer's Data API returns structured JSON (identity, accounts, transactions, balances) with a dedicated MCP server letting an AI assistant like Claude perform banking operations directly, and typed SDKs abstract the raw API surface — all strong signals of agent-consumable design. However, a probe found no discoverable OpenAPI/JSON schema (all candidate schema paths 404'd), and no evidence describes transaction enrichment (categorization, merchant normalization) that would let an agent reason without heuristic parsing. Missing for 10: published machine-readable schema/OpenAPI spec, documented data enrichment/categorization features, independent corroboration of agent consumption in practice.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “Webhooks are JSON-format notifications you receive when any event occurs within the Payments API v3.”
   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [claimed-docs] “They simplify API calls with easy-to-use interfaces, type-hinted methods and abstractions. They also automate request signing for all Paymen…”
   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”

   proof ↗⚑ flag

Agent operations

1. ai-native userAn agent can operate the platform — create link sessions, retrieve balances and transactions, and manage connections through the API or an MCP surface with scoped credentials

   weight 3 · round drawn
   MX~partialprobed6/10

   MX exposes a full Platform API (with OpenAPI spec) covering balances, transactions, account aggregation, connect sessions/members, and webhooks, and there is a documented MCP surface at docs.mx.com/mcp confirming an MCP entry point exists. However, the evidence pack lacks detail on MCP tool scoping, credential/permission scoping for agent use, or hands-on confirmation of agent-driven session creation and connection management via MCP. missing for 10: documented MCP tool list/schema, evidence of scoped credentials for agent access, independent/hands-on validation of the MCP surface in agentic workflows.

   • [probe] “official MCP server documented at https://docs.mx.com/mcp”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “Get the available balance for an end user’s financial accounts”
   • [claimed-docs] “connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”

   proof ↗⚑ flag

   TrueLayer~partialprobed6/10

   TrueLayer ships an official MCP server for Claude AI (truelayer-docs-17, probe-3) with at least a documented `create-truelayer-payment-link` tool (truelayer-docs-27), and its APIs separately support account/balance/transaction retrieval (truelayer-docs-5, truelayer-docs-28) and connection management with scoped client credentials and ECDSA-signed requests (truelayer-docs-12, truelayer-docs-21). However, the MCP surface itself is only shown to expose link-session creation, not balance/transaction retrieval or connection management as MCP tools. Missing for 10: explicit MCP tools/endpoints for balance/transaction retrieval and connection management, and documentation of MCP-specific scoped credentials rather than general API auth.

   • [claimed-docs] “By integrating the TrueLayer MCP server with this AI assistant, you'd empower Claude AI to perform a range of banking and payment operations…”
   • [claimed-docs] “create-truelayer-payment-link` - Generate a new payment link for initiating a payment from a bank account to the TrueLayer merchant account”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “The Payments API v3 uses a pair of ECDSA keys in addition to a bearer token.”
   • [claimed-docs] “Invite users so they can retrieve your integration's client credentials, access the payments view, or issue refunds.”
   • [probe] “official MCP server documented at https://docs.truelayer.com/docs/truelayer-mcp-integration-for-claude-ai”

   proof ↗⚑ flag

Consent

1. ops leadEnd users can see and revoke what they've shared — a documented consent surface or portal where a user manages which apps hold access to their bank data

   weight 2 · round drawn
   MX—none0/10

   The evidence pack covers MX's data connectivity products (account verification, aggregation, transaction history) and webhooks, but contains no mention of any end-user-facing consent dashboard, permissions center, or revocation portal where users can view/manage which apps hold access to their bank data. missing for 10: documented consent/permissions portal, revocation flow, any UI or API for end users to view/manage connected app access.

   • [claimed-docs] “MX's ready-made UI that can be embedded in your application to aggregate users' account data by prompting end users to connect to their fina…”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [claimed-docs] “Share your held data with an FDX open finance platform”

   proof ↗⚑ flag

   TrueLayer—none0/10

   No evidence of an end-user-facing consent dashboard or portal for viewing/revoking bank data access; documentation only covers developer-side consent creation (mandates, verification consent) and admin Console user management, not an end-user self-service revocation surface.

   ⚑ flag

Deletion

1. ops leadSever and clean up — a documented way to delete a connection or user and have the platform stop collecting and purge held data

   weight 2 · round drawn
   MX—none0/10

   The evidence pack covers connectivity, aggregation, webhooks, and API testing but contains no documentation of a delete/disconnect flow for members or users, nor any statement about MX stopping data collection or purging held data upon request. This is a fair question for a financial data aggregator handling sensitive consumer data, but no supporting evidence exists.

   ⚑ flag

   TrueLayer—none0/10

   No evidence pack item documents a way to delete a connection/user, revoke consent, stop data collection, or purge held data; documentation covers payments, mandates, webhooks, and MCP integration but nothing about consent revocation or data deletion/erasure workflows.

   ⚑ flag

Scopes

1. developerI request only the data scopes I need — product-scoped consents and documented data-minimization controls, not an all-or-nothing grant

   weight 2 · round to TrueLayer
   MX~partialclaimed4/10

   MX splits data access into distinct products (Instant Account Verification, Account Owner Identification, Account Aggregation, Extended Transaction History, Balance), which implies a developer could integrate only the specific product/data type needed rather than one monolithic grant. However, there is no explicit documentation of a consent-scoping mechanism, a permission UI showing only requested scopes to end users, or stated data-minimization principles/controls. Missing for 10: explicit consent/scope management docs, evidence of end-user-facing scope selection in Connect Widget, and any stated data-minimization policy.

   • [claimed-docs] “you can connect to an end user's financial institution and retrieve account and routing numbers for their demand deposit accounts”
   • [claimed-docs] “you can connect to an end user's financial account to retrieve information such as their name and address”
   • [claimed-docs] “connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions”
   • [claimed-docs] “you can connect to an end user's financial institution and retrieve up to 24 months of data for their accounts and transactions”
   • [claimed-docs] “Get the available balance for an end user’s financial accounts”
   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer offers distinct product APIs (Payments, Data/Account Info, Verification, Payouts) that developers can integrate separately, implying some scoping by product, and Data API notes consent is tied to specific connected accounts a user has approved. However there is no explicit documentation of granular, developer-selectable OAuth scopes or a consent screen showing minimized data requests per call. missing for 10: explicit scope/permission parameters documented in API reference, evidence of a consent UI showing selectable data categories, and independent confirmation that unused scopes aren't granted by default.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Send payouts to bank accounts that have been verified against a user's identity.”

   proof ↗⚑ flag

Refresh

1. developerTrigger an on-demand refresh of a connected account's data through the API when my use case needs now-fresh data, with the refresh semantics documented

   weight 2 · round drawn
   MX—none0/10

   The evidence only shows MX automatically aggregates accounts on a ~24-hour cycle (mx-docs-25) and describes webhooks for event notifications, but there is no documented API endpoint or semantics for a developer-triggered on-demand refresh of a connected account's data.

   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The evidence pack documents TrueLayer's Data API for reading account info, balances, and transactions, but contains no mention of an explicit on-demand refresh endpoint or documented refresh semantics (e.g., cache TTLs, force-refresh parameters, or freshness guarantees). This is a fair axis for an open banking data API, but no supporting evidence exists.

   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag

Webhooks

1. developerData changes arrive as signed webhooks — new transactions, balance updates, connection state changes — so my system stays current without polling

   weight 2 · round to MX
   MX✓fullclaimed8/10

   MX docs confirm webhooks with HTTPS POST callbacks for subscribing to events like transaction/balance/connection changes, and note that account aggregation runs automatically (~every 24h) with webhook notification rather than requiring polling. Missing for 10: explicit documentation of webhook payload signing/verification mechanism and a full enumerated list of event types, plus independent/hands-on corroboration beyond first-party docs.

   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”
   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”

   proof ↗⚑ flag

   TrueLayer~partialclaimed5/10

   TrueLayer documents signed webhooks (Tl-Signature validation) for the Payments API, notifying about payment status changes during authorisation — this covers signed delivery and payment state changes, but the evidence never shows webhooks for the Data API events explicitly named in the story (new transactions, balance updates, connection/consent state changes). Missing for 10: documented webhook events for transaction/balance/connection state changes on the Data/Accounts side, and any confirmation these are pushed rather than requiring polling of the Data API.

   • [claimed-docs] “We strongly recommend you use our signing libraries to verify the `Tl-Signature` of any webhooks you receive.”
   • [claimed-docs] “Webhooks are JSON-format notifications you receive when any event occurs within the Payments API v3.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”
   • [claimed-docs] “You must validate all incoming webhook requests through the `Tl-Signature` that accompanies the webhook.”
   • [claimed-docs] “Each of your apps in Console can have a single webhook URI, which the Payments API sends webhooks to.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag

Coverage

1. founderThe platform documents how many institutions it reaches and where — published coverage numbers and geographies I can check against where my users actually bank

   weight 3 · round to TrueLayer
   MX—none0/10

   The evidence pack covers MX's connectivity products, APIs, and webhooks but contains no published figures on number of institutions reached, geographic coverage, or any coverage map/list a founder could check against their users' banks.

   ⚑ flag

   TrueLayer~partialclaimed5/10

   Docs state payments coverage spans UK and EU and provide a providers endpoint to query which banks are supported per country/segment, giving founders a way to check coverage against their user base. However, there's no published aggregate coverage numbers (e.g., total institutions reached) or a static geography breakdown document — only an API-based lookup. Missing for 10: published institution-count statistics, a documented list/table of supported countries and bank counts, and independent verification of coverage claims.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”

   proof ↗⚑ flag

Status

1. ops leadPer-institution health is visible — documented institution statuses, outage or degradation signals, and error codes that distinguish a bank problem from my problem

   weight 2 · round drawn
   MX—none0/10

   Evidence covers connectivity, aggregation, webhooks, and test institutions, but there is no documented institution status dashboard, outage/degradation signal, or error-code taxonomy distinguishing bank-side failures from client-side issues. Missing for 10: institution health/status page, outage or degradation indicators, and documented error codes for bank vs integration failure.

   ⚑ flag

   TrueLayer—none0/10

   Evidence shows a providers endpoint for bank coverage/support by country (truelayer-docs-10) and generic webhook status events (truelayer-docs-33), but nothing documents per-institution health status, outage/degradation signals, or error codes that distinguish a bank-side failure from an integration-side one — missing for 10: institution status page/API, outage/degradation indicators, and error taxonomy separating bank vs merchant faults.

   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”

   proof ↗⚑ flag

Multi product

1. developerOne link session can power multiple data products — auth, balances, transactions, identity — without forcing the user through separate connection flows per product

   weight 2 · round drawn
   MX✓fullclaimed7/10

   MX's Connect Widget/Platform API model uses a single connection (member) per institution that then exposes multiple products—verification, identity, balances, aggregation, extended history—via the same member without re-prompting the user (mx-docs-21, mx-docs-9, mx-docs-15/16/18/19/20). Webhooks and the 24-hour auto-aggregation cycle (mx-docs-25, mx-docs-7) further support a single persistent connection powering ongoing multi-product data access. missing for 10: no explicit documentation or hands-on confirmation that a single Connect session activates all products simultaneously without separate per-product entitlement/config steps, and no independent developer account of this exact flow.

   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [claimed-docs] “MX's ready-made UI that can be embedded in your application to aggregate users' account data by prompting end users to connect to their fina…”
   • [claimed-docs] “With Instant Account Verification, you can connect to an end user's financial institution and retrieve account and routing numbers for their…”
   • [claimed-docs] “With Account Owner Identification, you can connect to an end user's financial account to retrieve information such as their name and address…”
   • [claimed-docs] “Get the available balance for an end user's financial accounts”
   • [claimed-docs] “With Account Aggregation, connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions.”
   • [claimed-docs] “With Extended Transaction History, you can connect to an end user's financial institution and retrieve up to 24 months of data for their acc…”
   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”

   proof ↗⚑ flag

   TrueLayer✓fullclaimed7/10

   TrueLayer's Data API docs describe a single interface that covers identity, accounts, transactions and balance data across all integrated banks, implying one connection can serve multiple data products rather than separate flows per product ([truelayer-docs-28], [truelayer-docs-5]). Missing for 10: explicit description of the underlying consent/session mechanics (e.g., how one auth link's token scopes map to multiple product calls without re-prompting the user) and independent/hands-on confirmation that no re-authentication is required per product.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Verify that a bank account belongs to a given user.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”

   proof ↗⚑ flag

Quickstart

1. developerGo from signup to my first linked sandbox account fast — self-serve API keys, a runnable quickstart, and client libraries in my language

   weight 2 · round to TrueLayer
   MX~partialprobed4/10

   MX provides developer-facing artifacts like a downloadable OpenAPI spec (importable into Postman), a public GitHub OpenAPI repo, and a test platform with sandbox test institutions, which support quick experimentation. However there's no evidence of a self-serve API key signup flow, a step-by-step quickstart guide, or officially maintained client libraries/SDKs in specific languages. missing for 10: self-serve API key/account signup flow, official quickstart tutorial, language-specific client libraries/SDKs.

   • [claimed-docs] “We offer four test institutions that you can use”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.mx.com/openapi.json, https://docs.mx.com/swagger.json, https://docs.mx.com/api/openapi.…”

   proof ↗⚑ flag

   TrueLayer✓fullclaimed7/10

   TrueLayer docs describe a self-serve quickstart that creates a free UK merchant account and completes a first test payment, plus SDKs for Node.js, Python, Java and .NET and dedicated signing libraries to speed integration. This directly matches the signup-to-first-linked-sandbox-account story, though all evidence is first-party docs with no independent/hands-on corroboration of actual time-to-first-success. Missing for 10: independent developer reports confirming ease/speed of the flow, explicit sandbox-environment terminology (vs 'test payment'), and confirmation that API key generation itself is fully self-serve without sales contact.

   • [claimed-docs] “you'll create a free UK merchant account and complete your first test payment with the Payments API v3”
   • [claimed-docs] “SDKs for Node.js, Python, Java and .NET.”
   • [claimed-docs] “They simplify API calls with easy-to-use interfaces, type-hinted methods and abstractions. They also automate request signing for all Paymen…”
   • [claimed-docs] “We offer signing libraries in these languages”
   • [github] “Convenient libraries to produce TrueLayer API requests signatures.”

   proof ↗⚑ flag

Sandbox

1. developerA sandbox with test institutions and documented test credentials lets me exercise linking, data retrieval, and error states end-to-end before touching a real bank account

   weight 3 · round to MX
   MX~partialclaimed7/10

   MX documents a dedicated test platform with four test institutions and an OpenAPI spec importable into Postman, plus guidance on testing the Connect Widget's OAuth flow end-to-end — directly supporting sandbox-based linking/testing before production use. However, the evidence does not show explicit documented test credentials for each test institution or guidance on simulating specific error states. Missing for 10: documented test credentials per institution, explicit error-state/failure simulation guidance.

   • [claimed-docs] “We offer four test institutions that you can use”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”
   • [claimed-docs] “To test OAuth in the Connect Widget when it's embedded in a WebView, you must load the financial institution's OAuth window in the device's …”

   proof ↗⚑ flag

   TrueLayer~partialclaimed3/10

   Docs reference a quickstart that walks through creating a free account and completing a 'test payment' and a providers endpoint to see supported banks, implying some testing path exists, but there is no explicit mention of a sandbox environment, documented test institutions, or test credentials for exercising the Data API (linking/account retrieval) or specific error-state scenarios end-to-end. Missing for 10: explicit sandbox/test-bank credentials documentation, coverage of Data API linking and retrieval testing, and documented error-state simulation.

   • [claimed-docs] “you'll create a free UK merchant account and complete your first test payment with the Payments API v3”
   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”
   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round drawn
   MX~partialprobed6/10

   MX exposes a full Platform API (with public OpenAPI spec and even an MCP server) covering the same core capabilities as its Connect Widget UI—account verification, aggregation, balances, transaction history, webhooks—so most end-user and data flows are API-accessible. However, there is no explicit documentation confirming full parity between the API and MX's dashboard/admin UI (e.g., configuration, analytics, or account-management screens), so some UI-only functions may not be exposed. Missing for 10: explicit parity statement, evidence covering dashboard/admin functions via API, independent confirmation of no UI-only features.

   • [claimed-docs] “Use the Connect Widget and Platform API to let end users connect to their accounts.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [probe] “official MCP server documented at https://docs.mx.com/mcp”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”

   proof ↗⚑ flag

   TrueLayer~partialprobed6/10

   TrueLayer is API-first: payments, payouts, mandates, data/account access, verification, webhooks and signing are all exposed as core API operations with SDKs, and Console (the UI) appears to largely mirror these merchant operations. However, some Console-only functions (inviting team users, MFA setup, account management, monitoring/reporting dashboards) are described as UI actions with no evidence of an equivalent API/endpoint, and no OpenAPI spec is discoverable (probe 404s), making full programmatic parity unverifiable. missing for 10: API-equivalents for Console user/team management and MFA setup, a public OpenAPI/schema confirming full endpoint parity, and independent confirmation that all UI actions have API counterparts.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Monitor payments and generate reports in Console.”
   • [claimed-docs] “Quickly see your merchant account balances, access balance reports, and configure sweeping.”
   • [claimed-docs] “Invite users so they can retrieve your integration's client credentials, access the payments view, or issue refunds.”
   • [claimed-docs] “After you create an account, add another layer of security with multi-factor authentication (MFA).”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.truelayer.com/openapi.json, https://docs.truelayer.com/swagger.json, https://docs.truel…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to MX
   MX~partialclaimed3/10

   MX supports sharing held data with an FDX open finance platform and exposes an OpenAPI spec, suggesting some open-format data portability for the businesses that integrate with it, but there is no evidence of an end-user-facing 'export all my data and leave' feature or documented full data export/deletion workflow. missing for 10: end-user self-service export tool, documentation of full data export scope/format, evidence of account closure/data portability workflow, independent confirmation of FDX export usage.

   • [claimed-docs] “Share your held data with an FDX open finance platform”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API and its request and response payloads.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to TrueLayer
   MX—none0/10

   MX is a closed commercial fintech API/SaaS product; the only public GitHub repo (mx-gh-1) contains an OpenAPI specification for documentation/integration purposes, not the actual application source code, and no license grants access to MX's implementation source.

   • [github] “This repository contains the OpenAPI specification for the MX Platform API”

   proof ↗⚑ flag

   TrueLayer~partialclaimed2/10

   TrueLayer's core payments/banking product is a closed proprietary SaaS API with no evidence of full source availability, but one auxiliary component—the request-signing library—is published as open source on GitHub. missing for 10: no open license for the actual product/platform source, only a small signing helper library is open.

   • [github] “Convenient libraries to produce TrueLayer API requests signatures.”

   proof ↗⚑ flag

Pay by bank

1. developerInitiate a bank payment from a connected account — a documented pay-by-bank or payment-initiation product with its live geographies stated honestly

   weight 2 · round to TrueLayer
   MX—none0/10

   MX's evidence covers account verification, aggregation, balance, transaction history, and identity data, plus 'Tokenized Account Numbers... for secure ACH money movement' (mx-docs-24), but there is no documented payment-initiation API/product, no description of initiating a bank payment/transfer, and no stated live geographies for such a capability.

   • [claimed-docs] “Tokenized Account Numbers (TANs) are substitute account numbers used for secure ACH money movement.”
   • [claimed-docs] “With Instant Account Verification, you can connect to an end user's financial institution and retrieve account and routing numbers for their…”
   • [claimed-docs] “With Account Aggregation, connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions.”

   proof ↗⚑ flag

   TrueLayer✓fullclaimed8/10

   TrueLayer's Payments API v3 is well documented for initiating pay-by-bank payments from a connected account, with a quickstart to create a test payment, payment links, mandates for recurring payments, and webhooks — and it explicitly states its live geographies as UK and EU (truelayer-docs-1, truelayer-docs-23, truelayer-docs-32, truelayer-docs-10). Missing for 10: independent/hands-on developer confirmation of the payment flow working end-to-end and a fully granular, country-by-country live-market breakdown beyond the UK/EU summary.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Accept Pay by Bank payments. Covers the API, authentication, webhooks and testing.”
   • [claimed-docs] “Generate payment links without a custom integration.”
   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “you'll create a free UK merchant account and complete your first test payment with the Payments API v3”
   • [claimed-docs] “Query the providers endpoint to see which banks are supported in each European country and segment.”
   • [claimed-docs] “webhooks inform you about: when a payment changes to a new status in the authorisation process”

   proof ↗⚑ flag

Recurring

1. developerRecurring bank payments are supported — variable recurring payments, standing consents, or documented recurring debit flows built on the connection

   weight 2 · round to TrueLayer
   MX—none0/10

   MX's evidence covers account aggregation, identity/verification, balances, transaction history and ACH microdeposit verification, plus tokenized account numbers for ACH money movement — but there is no mention of variable recurring payments, standing consents, or any recurring/scheduled debit payment-initiation flow.

   ⚑ flag

   TrueLayer✓fullclaimed8/10

   TrueLayer documents payment mandates explicitly covering Sweeping VRPs, Wave 1 VRPs, and Direct Debits, with dedicated docs on creating a mandate and executing recurring payments on an authorised mandate without further user auth. This directly matches variable recurring payments, standing consents, and recurring debit flows built on the Payments API. Missing for 10: independent/hands-on corroboration beyond first-party docs, and more detail on standing consent lifecycle management (renewal/revocation).

   • [claimed-docs] “Use the following steps to learn how to create a new payment mandate for your user. You'll need this mandate to set up recurring payments.”
   • [claimed-docs] “Once you create a payment on an authorised mandate, it executes immediately without requiring further user authorisation.”
   • [claimed-docs] “Payment mandates belong to one of three types: Sweeping VRPs... Wave 1 VRPs... Direct Debits”
   • [claimed-docs] “After you create a payment mandate and your user has authorised it, you can create a payment on the mandate... it executes immediately.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round drawn
   MX—none0/10

   No evidence in the pack addresses data residency, region selection, or storage location controls for MX's data; all citations concern connectivity, aggregation, and API/testing features. missing for 10: any mention of data residency/region options, compliance certifications tied to geographic storage, or configuration for where data is stored.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer's evidence covers UK/EU payments and data APIs but nowhere mentions user-selectable data residency or region storage controls; the mention of UK/EU scope reflects operational coverage, not a configurable data-residency choice. Missing for 10: any documentation of data residency options, region selection controls, or storage location configurability.

   • [claimed-docs] “The Payments API v3 allows you to make and accept payments and payouts in the UK and EU.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag

2. ai-native userControl data retention and deletion

   weight 2 · round drawn
   MX—none0/10

   The evidence pack contains no mention of data retention periods, deletion policies, or user/data-controller controls over stored financial data; all citations relate to connectivity, aggregation, and API features rather than privacy/data lifecycle controls.

   ⚑ flag

   TrueLayer—none0/10

   No evidence of any data retention or deletion controls (e.g., data export, deletion API, retention policy settings) for AI-native users; evidence pack covers payments, data access APIs, webhooks, and MCP integration but nothing about controlling or deleting stored data.

   ⚑ flag

3. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   MX—none0/10

   No evidence pack item addresses telemetry, usage tracking, analytics opt-out, or data collection controls for AI-native usage; the docs focus entirely on financial data connectivity and APIs. Missing for 10: any mention of telemetry collection, an opt-out mechanism, or privacy settings related to usage tracking.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer is a payments/banking API platform; no evidence in the pack addresses telemetry/usage-tracking opt-out settings for AI-native users interacting with its MCP integration or SDKs. This axis is plausible for a platform with SDKs and an MCP server, but no documentation or feature is cited, so it's 'none' rather than 'na'.

   ⚑ flag

Cashflow

1. finance leadThe platform derives income and cash-flow signals from connected accounts — recurring streams, payroll detection, or documented income verification products built on the same data

   weight 2 · round drawn
   MX—none0/10

   MX's evidence covers account aggregation, balances, identity/ownership verification, and general 'data intelligence' or 'personalized guidance' claims, but nothing documents a specific income/cash-flow signal product — no mention of recurring-income detection, payroll detection, or a named income verification offering built on transaction data.

   ⚑ flag

   TrueLayer—none0/10

   TrueLayer's Data API covers identity, accounts, balances and raw transaction history, but no evidence describes derived income/cash-flow signals such as recurring stream detection, payroll detection, or a dedicated income verification product built on the data.

   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”
   • [claimed-docs] “We compare the identity data to the account holder's name for all the connected account(s) the user has given consent for.”

   proof ↗⚑ flag

Enrichment

1. developerRaw bank transactions come back enriched — cleaned merchant names, categories, and logos — documented as a capability of the platform, not left as an exercise for me

   weight 2 · round drawn
   MX—none0/10

   The evidence pack covers connectivity, verification, aggregation, webhooks, and testing tools, but never documents transaction enrichment specifics like cleaned merchant names, categorization, or logos — only vague references to 'data-driven intelligence' and 'account and transaction history in one view.' Since enrichment is a fair and expected capability for a financial-data-aggregation platform, but no concrete documentation of merchant cleansing/categories/logos appears, this is 'none' rather than 'na'.

   • [claimed-docs] “Use data-driven intelligence about your customers”
   • [claimed-docs] “Access account and transaction history all in one view. Use the data to increase multi-product adoption, and build trust.”
   • [claimed-docs] “connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions”
   • [claimed-docs] “With Account Aggregation, connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions.”

   proof ↗⚑ flag

   TrueLayer—none0/10

   The Data API is documented as returning identity, accounts, transactions and balance data (truelayer-docs-28), but no evidence describes merchant name cleaning, categorization, or logo enrichment as a documented capability. Missing for 10: any mention of transaction enrichment, merchant name normalization, category tagging, or logo/icon data in the docs.

   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag

Transactions

1. developerPull transaction history for a connected account through the API — paginated, with documented history depth and a sync pattern for fetching only what changed

   weight 3 · round to MX
   MX~partialclaimed7/10

   MX clearly documents transaction history depth (90 days standard via Account Aggregation, up to 24 months via Extended Transaction History) and provides a sync mechanism via webhooks plus automatic ~24hr re-aggregation of connected accounts, backed by a public OpenAPI spec for the Platform API. However, the evidence never explicitly documents pagination parameters/behavior for the transactions endpoint itself, and the webhook-based sync isn't described as an incremental 'only what changed' diff pattern (e.g., no mention of delta/cursor tokens). Missing for 10: explicit pagination documentation for transaction list endpoints, explicit incremental/delta sync mechanism beyond generic webhooks/24h refresh.

   • [claimed-docs] “connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions”
   • [claimed-docs] “you can connect to an end user's financial institution and retrieve up to 24 months of data for their accounts and transactions”
   • [claimed-docs] “With Account Aggregation, connect to end users' financial institutions and retrieve 90 days of data for their accounts and transactions.”
   • [claimed-docs] “With Extended Transaction History, you can connect to an end user's financial institution and retrieve up to 24 months of data for their acc…”
   • [claimed-docs] “MX automatically aggregates each `member` approximately every 24 hours.”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice. This enables you to subscribe to certain events”
   • [claimed-docs] “MX provides webhooks that send HTTPS POST callback requests to the URL of your choice.”
   • [github] “This repository contains the OpenAPI specification for the MX Platform API”
   • [claimed-docs] “You can download our OpenAPI Specification and import it into Postman to learn more about our API”

   proof ↗⚑ flag

   TrueLayer~partialclaimed3/10

   Docs confirm a Data API that reads account, balance and transaction history via a single interface (truelayer-docs-5, truelayer-docs-28), but there is no evidence of pagination mechanics, documented history depth/lookback window, or an incremental sync pattern (e.g., delta/cursor endpoints) for fetching only changed transactions. missing for 10: pagination details, documented transaction history depth/limits, incremental/delta sync mechanism.

   • [claimed-docs] “Read account information, balances and transaction history from a user's bank.”
   • [claimed-docs] “Access identity, accounts, transactions and balance data for all integrated banks with a single interface.”

   proof ↗⚑ flag