Holds
Symitar in Platform
>
Holds
openapi: 3.0.1
info:
title: Symitar in Platform API - Holds
version: v1
description: API to interact with Symitar in Platform
contact:
name: Picard
url: https://www.jackhenry.com/
email: DC-Picard-Product@jackhenry.com
servers:
- url: https://platform.banno.com
description: Production Endpoint
components:
securitySchemes:
OpenIDEnterprise:
type: openIdConnect
openIdConnectUrl: https://login.jackhenry.com/.well-known/openid-configuration
description: "Jack Henry Enterprise Authentication. \n\n ### Supported Flows\n \n #### 1. Authorization Code Flow\n * **Use Case:** Person-at-keyboard logins (FI or JH Employees).\n * **Security:** Supports/recommends PKCE (S256). Supports Pushed Authorization Requests (PAR), and DPoP token binding.\n * **Client Auth:** Supports/recommends `client_assertion` (Private Key JWT), also supports `client_secret`.\n \n #### 2. Client Credentials Flow\n * **Use Case:** System services and machine-to-machine integrations.\n * **Security:** Supports DPoP token binding.\n * **Client Auth:** **Requires** `client_assertion` (Private Key JWT).\n"
OpenIDConsumer:
type: openIdConnect
openIdConnectUrl: https://digital.garden-fi.com/.well-known/openid-configuration
description: "Jack Henry Consumer Authentication. \n\n> **WARNING: FI-SPECIFIC ROUTING**\n> The authorization server is currently pointing to our **Sandbox Environment** (`digital.garden-fi.com`) so you can test this documentation. In production code, this domain **must** be replaced with the specific Financial Institution's domain.\n> Example: Replace `{API-ENVIRONMENT}` in `https://{API-ENVIRONMENT}/.well-known/openid-configuration` with `digital.garden-fi.com` for the Garden financial institution.\n\n### Supported Flows\n\n#### 1. Authorization Code Flow\n* **Use Case:** Person-at-keyboard logins (customer or member of FI).\n* **Security:** Supports/recommends PKCE (S256). Supports Pushed Authorization Requests (PAR), and DPoP token binding.\n* **Client Auth:** Supports `client_secret`.\n"
tags:
- name: Holds
description: Account hold operations
paths:
/a/api/picard/v1/{InstitutionUniversalId}/holds-search:
post:
operationId: searchHolds
tags:
- Holds
summary: Search Holds
description: |
Search for holds on a share or loan account. Sensitive identifiers
(`accountNumber`, `shareId`, `loanId`) are passed in the request body
instead of the URL path.
Supply `accountNumber` **and** exactly one of `shareId` or `loanId`.
Returns all holds on the specified account.
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
description: |
Request body for `POST /holds-search`. Supply `accountNumber` and
exactly one of `shareId` or `loanId`. Providing zero or both is a
400 error.
required:
- accountNumber
properties:
accountNumber:
type: string
description: |
10-digit account number. Use the `accountNumber` field from a `ShareInfo` or `LoanInfo` response.
example: 0000379758
shareId:
type: string
description: |
Share ID. Provide this to search holds on a share account. Mutually exclusive with `loanId`.
nullable: true
example: '0000'
loanId:
type: string
description: |
Loan ID. Provide this to search holds on a loan account. Mutually exclusive with `shareId`.
nullable: true
example: '0001'
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: array
items:
type: object
description: A hold on a share or loan account
required:
- locator
- amount
- type
- availableBalance
- ledgerBalance
properties:
locator:
type: integer
description: Unique identifier for the hold record
example: 42
amount:
type: string
description: Dollar amount of the hold
example: '250.00'
type:
type: integer
description: Hold type code
example: 1
typeName:
type: string
description: |
Human-readable name for the hold type code. Derived from a predefined map (e.g. 0 = "General Purpose", 1 = "Check Hold", 2 = "Certified Draft", etc.). Omitted when the type code is not recognized.
nullable: true
example: Check Hold
effectiveDate:
type: string
description: Date the hold takes effect (YYYY-MM-DD)
nullable: true
example: '2026-02-01'
expirationDate:
type: string
description: Date the hold expires (YYYY-MM-DD)
nullable: true
example: '2026-03-01'
expirationTime:
type: integer
description: Time of day the hold expires
nullable: true
holdCreationDate:
type: string
description: Date the hold was created (YYYY-MM-DD)
nullable: true
example: '2026-02-01'
holdCreationTime:
type: string
description: Time of day the hold was created
nullable: true
example: '14:30'
availableBalance:
type: string
description: Available balance at time of hold
example: '1000.00'
ledgerBalance:
type: string
description: Ledger balance at time of hold
example: '1250.00'
feeCode:
type: integer
description: Associated fee code
nullable: true
feeDescription:
type: string
description: Description of the fee
nullable: true
payeeName:
type: string
description: Name of the payee
nullable: true
example: CHECK HOLD
memberBranch:
type: string
description: Branch associated with the member
nullable: true
matchDate:
type: string
description: Date for matching purposes
nullable: true
matchTime:
type: integer
description: Time for matching purposes
nullable: true
reference1:
type: string
description: Free-form reference field 1
nullable: true
reference2:
type: string
description: Free-form reference field 2
nullable: true
reference3:
type: string
description: Free-form reference field 3
nullable: true
reference4:
type: string
description: Free-form reference field 4
nullable: true
stopPayCode:
type: integer
description: Stop payment code
nullable: true
achRecurringStop:
type: integer
description: ACH recurring stop flag
nullable: true
transactionType:
type: integer
description: Transaction type code
nullable: true
recordChangeDate:
type: string
description: Last modification date
nullable: true
'400':
description: Bad request — missing accountNumber, or invalid shareId/loanId combination
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
/a/api/picard/v1/{InstitutionUniversalId}/holds:
post:
operationId: createHold
tags:
- Holds
summary: Create Hold
description: |
Create a new hold on a share or loan account. This maps directly to
the SymXchange `createShareHold` / `createLoanHold` SOAP operations.
All 22 hold types are supported — general-purpose holds, check holds,
stop payments, pledge holds, ACH stops, wire holds, etc. The `type`
field determines the hold's purpose and which other fields are
meaningful.
### Hold Type Reference
| Code | Type Name | Category |
|------|-----------|----------|
| 0 | General Purpose | General |
| 1 | Check Hold | General |
| 2 | Certified Draft | Stop Payment |
| 3 | Stop Draft | Stop Payment |
| 4 | Signature Auth Hold | General |
| 5 | Pledge Hold | General |
| 6 | Stop ACH | Stop Payment |
| 7 | Stop Draft Verbal | Stop Payment |
| 8 | Stop ACH Verbal | Stop Payment |
| 9 | Revoke ACH | Stop Payment |
| 10 | Merchant Verification | General |
| 11 | Merchant Verification - Info | General |
| 12 | Uncollected Fee | General |
| 13 | Loan Draft | General |
| 14 | Bill Payment | General |
| 15 | Bill Payment - Info | General |
| 16 | Unauthorized ACH Stop | Stop Payment |
| 17 | ACH Origination | General |
| 18 | ACH DNE | General |
| 19 | PIN Auth Hold | General |
| 20 | Business Block ACH Debit | General |
| 21 | Wire Hold | General |
### Creating a Stop Draft (type 3)
```json
{
"accountNumber": "0000379758",
"shareId": "0000",
"type": 3,
"amount": "250.00",
"effectiveDate": "2026-03-17",
"expirationDate": "2026-09-17",
"reference1": "0000000123",
"payeeName": "ACME Corp",
"stopPayCode": 0
}
```
- `reference1`: draft number (10-digit, leading zeros)
- `reference2`: draft number high range (omit for single draft)
- `payeeName`: payee name (informational)
- `amount`: stop specific amount (`"0"` = any amount)
- `stopPayCode`: stop reason code (`0` = Unknown/None Provided)
- `reference3`: free-text stop reason (when `stopPayCode` = Other)
### Creating a Stop ACH (type 6)
```json
{
"accountNumber": "0000379758",
"shareId": "0000",
"type": 6,
"amount": "0",
"effectiveDate": "2026-03-17",
"expirationDate": "2026-09-17",
"reference1": "0012938291",
"reference2": "DEBIT",
"payeeName": "Lithopress",
"achRecurringStop": 1
}
```
- `reference1`: company ID (blank = all companies)
- `reference2`: `"DEBIT"`, `"CREDIT"`, or blank (all)
- `payeeName`: company name (`"ALL"` = all companies)
- `amount`: stop specific amount (`"0"` = any amount)
- `achRecurringStop`: `0` = single stop, `1` = recurring
### Creating a Revoke ACH (type 9)
Same fields as Stop ACH, but **do not set `expirationDate`** — the
hold remains in effect until manually removed.
### Creating a Certified Draft (type 2)
```json
{
"accountNumber": "0000379758",
"shareId": "0000",
"type": 2,
"amount": "500.00",
"effectiveDate": "2026-03-17",
"expirationDate": "2026-06-17",
"reference1": "0000000456",
"payeeName": "John Doe"
}
```
- `reference1`: draft number
- `payeeName`: payee name
- `amount`: draft amount
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
description: |
Request body for `POST /holds`. Creates a new ShareHold or LoanHold
record in SymXchange. Supply `accountNumber` and exactly one of
`shareId` or `loanId`. The `type` field determines the kind of hold
(see the hold type reference in the endpoint description).
All 22 hold types (0–21) are valid. Which optional fields are
meaningful depends on the type — see the endpoint description for
examples of creating stop payments, certified drafts, and ACH stops.
required:
- accountNumber
- type
properties:
accountNumber:
type: string
description: |
10-digit account number.
example: 0000379758
shareId:
type: string
description: |
Share ID. Provide this to create a hold on a share account. Mutually exclusive with `loanId`.
nullable: true
example: '0000'
loanId:
type: string
description: |
Loan ID. Provide this to create a hold on a loan account. Mutually exclusive with `shareId`.
nullable: true
example: '0001'
type:
type: integer
description: |
Hold type code (0–21). See the hold type reference table on the endpoint description.
example: 3
amount:
type: string
description: |
Dollar amount of the hold. For stop payments, `"0"` means "any amount".
example: '250.00'
effectiveDate:
type: string
description: |
Date the hold takes effect (YYYY-MM-DD). Defaults to today if omitted.
example: '2026-03-17'
expirationDate:
type: string
description: |
Date the hold expires (YYYY-MM-DD). Should **not** be set for Revoke ACH (type 9) or Unauthorized ACH Stop (type 16) — those remain in effect until manually removed.
example: '2026-09-17'
expirationTime:
type: integer
description: |
Time portion of the expiration (HHMM format).
feeCode:
type: integer
description: |
Fee code associated with the hold.
payeeName:
type: string
description: |
Payee name (for draft stops) or company name (for ACH stops). Use `"ALL"` to stop all ACH transactions regardless of company.
example: ACME Corp
memberBranch:
type: string
description: |
Branch number (0000–9999). Only applicable when Member Branch Support is enabled for the institution.
reference1:
type: string
description: |
Type-specific reference field 1. Draft number for stop draft types (10-digit, leading zeros). Company ID for ACH stop types.
example: '0000000123'
reference2:
type: string
description: |
Type-specific reference field 2. Draft number high range for stop draft range stops. `"DEBIT"` or `"CREDIT"` for ACH stop scope (blank = both).
reference3:
type: string
description: |
Type-specific reference field 3. Free-text stop reason when `stopPayCode` indicates "Other" (types 3, 7).
reference4:
type: string
description: Free-form reference field 4.
stopPayCode:
type: integer
description: |
Stop reason code (types 3, 7 only). 0 = Unknown/None Provided.
achRecurringStop:
type: integer
description: |
ACH recurring stop flag (types 6, 8 only). 0 = single stop, 1 = recurring stop.
transactionType:
type: integer
description: Transaction type code.
responses:
'200':
description: Hold created successfully
content:
application/json:
schema:
type: object
description: Response from creating a hold. Contains the locator of the newly created hold.
properties:
locator:
type: integer
description: |
The locator (unique identifier) of the newly created hold within its parent share or loan.
example: 101
'400':
description: Bad request — missing accountNumber, invalid shareId/loanId combination, or invalid hold type
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
patch:
operationId: updateHold
tags:
- Holds
summary: Update Hold
description: |
Update an existing hold on a share or loan account. This maps to the
SymXchange `updateShareHoldByID` / `updateLoanHoldByID` SOAP operations.
Supply the hold's `locator` along with `accountNumber` and exactly one
of `shareId` or `loanId`. All writable hold fields are sent to
SymXchange; Symitar only modifies fields that differ from the current
record.
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/merge-patch+json:
schema:
type: object
description: |
Request body for `PATCH /holds`. Updates an existing ShareHold or
LoanHold record in SymXchange. Supply `accountNumber`, `locator`,
and exactly one of `shareId` or `loanId`.
All writable hold fields are sent to SymXchange — Symitar only
modifies fields whose values differ from the current record.
required:
- accountNumber
- locator
properties:
accountNumber:
type: string
description: 10-digit account number.
example: 0000379758
shareId:
type: string
description: |
Share ID. Provide this to update a hold on a share account. Mutually exclusive with `loanId`.
nullable: true
example: '0000'
loanId:
type: string
description: |
Loan ID. Provide this to update a hold on a loan account. Mutually exclusive with `shareId`.
nullable: true
example: '0001'
locator:
type: integer
description: |
Locator (unique identifier) of the hold to update.
example: 101
type:
type: integer
description: |
Hold type code (0–21).
example: 3
amount:
type: string
description: |
Dollar amount of the hold. For stop payments, `"0"` means "any amount".
example: '500.00'
effectiveDate:
type: string
description: Date the hold takes effect (YYYY-MM-DD).
example: '2026-03-17'
expirationDate:
type: string
description: Date the hold expires (YYYY-MM-DD).
example: '2026-12-31'
expirationTime:
type: integer
description: Time portion of the expiration (HHMM format).
feeCode:
type: integer
description: Fee code associated with the hold.
payeeName:
type: string
description: Payee name or company name.
example: ACME Corp
memberBranch:
type: string
description: Branch number (0000–9999).
reference1:
type: string
description: Type-specific reference field 1.
reference2:
type: string
description: Type-specific reference field 2.
reference3:
type: string
description: Type-specific reference field 3.
reference4:
type: string
description: Type-specific reference field 4.
stopPayCode:
type: integer
description: Stop reason code (types 3, 7 only).
achRecurringStop:
type: integer
description: ACH recurring stop flag (types 6, 8 only).
transactionType:
type: integer
description: Transaction type code.
responses:
'200':
description: Hold updated successfully
'400':
description: Bad request — missing required fields or invalid shareId/loanId combination
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
delete:
operationId: deleteHold
tags:
- Holds
summary: Delete Hold
description: |
Delete (release) an existing hold on a share or loan account. This maps
to the SymXchange `deleteShareHold` / `deleteLoanHold` SOAP operations.
Supply the hold's `locator` along with `accountNumber` and exactly one
of `shareId` or `loanId`.
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
description: |
Request body for `DELETE /holds`. Deletes (releases) an existing
ShareHold or LoanHold record. Supply `accountNumber`, `locator`,
and exactly one of `shareId` or `loanId`.
required:
- accountNumber
- locator
properties:
accountNumber:
type: string
description: 10-digit account number.
example: 0000379758
shareId:
type: string
description: |
Share ID. Provide this to delete a hold on a share account. Mutually exclusive with `loanId`.
nullable: true
example: '0000'
loanId:
type: string
description: |
Loan ID. Provide this to delete a hold on a loan account. Mutually exclusive with `shareId`.
nullable: true
example: '0001'
locator:
type: integer
description: |
Locator (unique identifier) of the hold to delete.
example: 101
responses:
'200':
description: Hold deleted successfully
'400':
description: Bad request — missing required fields or invalid shareId/loanId combination
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'404':
description: The server can not find the requested resource. In an API, this can also mean that the endpoint is valid but the resource itself does not exist. Servers may also send this response instead of 403 to hide the existence of a resource from an unauthorized client.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
Did this page help you?
Why was this page helpful?
Why wasn't this page helpful?
Thank you for your feedback!
Last updated Tue Sep 15 2026