Notes
Symitar in Platform
>
Notes
openapi: 3.0.1
info:
title: Symitar in Platform API - Notes
version: v1
description: API to interact with Symitar in Platform
contact:
name: Picard
url: https://www.jackhenry.com/
email: DC-Picard-Product@jackhenry.com
servers:
- url: https://platform.banno.com
description: Production Endpoint
components:
securitySchemes:
OpenIDEnterprise:
type: openIdConnect
openIdConnectUrl: https://login.jackhenry.com/.well-known/openid-configuration
description: "Jack Henry Enterprise Authentication. \n\n ### Supported Flows\n \n #### 1. Authorization Code Flow\n * **Use Case:** Person-at-keyboard logins (FI or JH Employees).\n * **Security:** Supports/recommends PKCE (S256). Supports Pushed Authorization Requests (PAR), and DPoP token binding.\n * **Client Auth:** Supports/recommends `client_assertion` (Private Key JWT), also supports `client_secret`.\n \n #### 2. Client Credentials Flow\n * **Use Case:** System services and machine-to-machine integrations.\n * **Security:** Supports DPoP token binding.\n * **Client Auth:** **Requires** `client_assertion` (Private Key JWT).\n"
OpenIDConsumer:
type: openIdConnect
openIdConnectUrl: https://digital.garden-fi.com/.well-known/openid-configuration
description: "Jack Henry Consumer Authentication. \n\n> **WARNING: FI-SPECIFIC ROUTING**\n> The authorization server is currently pointing to our **Sandbox Environment** (`digital.garden-fi.com`) so you can test this documentation. In production code, this domain **must** be replaced with the specific Financial Institution's domain.\n> Example: Replace `{API-ENVIRONMENT}` in `https://{API-ENVIRONMENT}/.well-known/openid-configuration` with `digital.garden-fi.com` for the Garden financial institution.\n\n### Supported Flows\n\n#### 1. Authorization Code Flow\n* **Use Case:** Person-at-keyboard logins (customer or member of FI).\n* **Security:** Supports/recommends PKCE (S256). Supports Pushed Authorization Requests (PAR), and DPoP token binding.\n* **Client Auth:** Supports `client_secret`.\n"
tags:
- name: Notes
description: Account, share, and loan note/comment operations
paths:
/a/api/picard/v1/{InstitutionUniversalId}/notes-search:
post:
operationId: searchNotes
tags:
- Notes
summary: Search Notes
description: |
Search for notes/comments on an account, share, or loan.
Sensitive identifiers (`accountNumber`, `shareId`, `loanId`) are
passed in the request body instead of the URL path.
- Supply only `accountNumber` to retrieve **account-level** notes.
- Add `shareId` to retrieve **share-level** notes.
- Add `loanId` to retrieve **loan-level** notes.
- At most one of `shareId` or `loanId` may be provided.
- The service pages through SymXchange note results and returns all
matching notes for the requested scope.
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
description: |
Request body for `POST /notes-search`. Supply `accountNumber` and
optionally one of `shareId` or `loanId` to scope the search.
If neither `shareId` nor `loanId` is provided, account-level notes
are returned. Providing both is a 400 error.
required:
- accountNumber
properties:
accountNumber:
type: string
description: |
10-digit account number.
example: 0000379758
shareId:
type: string
description: |
Share ID. When provided, share-level notes are returned. Mutually exclusive with `loanId`.
example: '0000'
loanId:
type: string
description: |
Loan ID. When provided, loan-level notes are returned. Mutually exclusive with `shareId`.
example: '0001'
responses:
'200':
description: Successful response
content:
application/json:
schema:
type: array
items:
type: object
description: A note/comment record on an account, share, or loan.
properties:
locator:
type: integer
description: Unique identifier for the note within its parent
example: 1
code:
type: integer
description: Note category/type code
example: 10
enterDate:
type: string
description: Date the note was entered (YYYY-MM-DD)
example: '2026-01-15'
enterTime:
type: integer
description: Time the note was entered (HHMM format)
example: 1430
expirationDate:
type: string
description: When the note expires
id:
type: string
description: Identifier of the user/process that created the note
example: TELLER01
idType:
type: integer
description: Type of the id field
recordChangeDate:
type: string
description: Last modification date
text:
type: string
description: |
Note text. Multiple text lines from Symitar are aggregated into a single space-separated string.
example: Member called about account balance. Verified identity via security questions.
user:
allOf:
- type: object
description: |
Symitar system user (teller, employee, etc.). Retrieved via the
SymXchange `getUserSelectFields` operation on the User CRUD service.
This is **not** a credit union member — see the `Member` schema for
member information.
When embedded in a `Note`, only `number` is guaranteed to be present.
The remaining fields are populated when the user record is available
in the cache.
required:
- number
properties:
number:
type: integer
description: Symitar user number
example: 42
name:
type: string
description: Full name of the user
example: Jean-Luc Picard
email:
type: string
description: Email address
example: jlpicard@example.com
phone:
type: string
description: Phone number
example: 555-0100
extension:
type: string
description: Phone extension
jobTitle:
type: string
description: Job title
example: Branch Manager
jobFunction:
type: string
description: Job function
deptName:
type: string
description: Department name
example: Operations
location:
type: string
description: Location
managersName:
type: string
description: Manager's name
assignedBranch:
type: integer
description: Assigned branch number
example: 1
type:
type: integer
description: User type code
onlineAccess:
type: integer
description: Online access flag
activeMode:
type: integer
description: Active mode flag
lastLogonDate:
type: string
description: Last logon date (YYYY-MM-DD)
example: '2026-03-09'
lastLogonTime:
type: integer
description: Last logon time (HHMM format)
example: 1430
secondaryId:
type: string
description: Secondary identifier
directory:
type: string
description: Directory path
recordChangeDate:
type: string
description: Record change date (YYYY-MM-DD)
securityCodes:
type: array
description: List of enabled security codes for the user.
items:
type: object
properties:
code:
type: integer
description: Security code identifier
description:
type: string
description: Human-readable security code description
description: |
The user who created the note. Always contains at least `number`. When the user record is available in the cache the remaining fields (name, email, etc.) are populated.
voidFlag:
type: integer
description: Whether the note has been voided (0 = active, 1 = voided)
example: 0
voidedBy:
type: integer
description: User ID who voided the note
example: 0
'400':
description: Bad request — missing accountNumber, or both shareId and loanId provided
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
/a/api/picard/v1/{InstitutionUniversalId}/notes:
post:
operationId: createNote
tags:
- Notes
summary: Create Note
description: |
Create a new note/comment on an account, share, or loan.
- Supply only `accountNumber` to create an **account-level** note.
- Add `shareId` to create a **share-level** note.
- Add `loanId` to create a **loan-level** note.
- At most one of `shareId` or `loanId` may be provided.
- `text` is required — a plain string that the service automatically
splits into lines of up to 40 characters (maximum 50 lines after splitting).
- The note code is automatically set to `0` (Free Form Text).
parameters:
- name: InstitutionUniversalId
in: path
description: A unique identifier to establish the identity of an Institution/Environment/Brand combination
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
type: object
description: |
Request body for `POST /notes`. Supply `accountNumber` and
optionally one of `shareId` or `loanId` to scope the note.
If neither is provided, an account-level note is created.
Providing both is a 400 error.
`text` is a plain string. Newline characters split the payload into
multiple notes. Each note is split into lines of up to 40 characters
for Symitar (maximum 50 lines per note after splitting). The note code
is automatically set to `0` (Free Form Text).
required:
- accountNumber
- text
properties:
accountNumber:
type: string
description: |
10-digit account number.
example: 0000379758
shareId:
type: string
description: |
Share ID. When provided, a share-level note is created. Mutually exclusive with `loanId`.
example: '0000'
loanId:
type: string
description: |
Loan ID. When provided, a loan-level note is created. Mutually exclusive with `shareId`.
example: '0001'
expirationDate:
type: string
description: |
Optional expiration date for the note (YYYY-MM-DD).
example: '2026-12-31'
text:
type: string
description: |
Note text content. Newline characters split the payload into multiple notes. Each note is split into lines of up to 40 characters for Symitar and must not exceed 50 lines after splitting.
example: Member called about account balance. Verified identity via security questions.
responses:
'200':
description: Note created successfully
content:
application/json:
schema:
type: object
description: Response from creating a note. Contains the locator of the newly created note.
properties:
locator:
type: integer
description: |
The locator (unique identifier) of the newly created note within its parent (account, share, or loan).
example: 99
'400':
description: Bad request — missing accountNumber or text, or both shareId and loanId provided
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
'401':
description: Although the HTTP standard specifies "unauthorized", semantically this response means "unauthenticated". That is, the client must authenticate itself to get the requested response.
'403':
description: The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource. Unlike 401, the clients identity is known to the server.
'500':
description: An unexpected internal server error occurred while processing the request.
content:
application/problem+json:
schema:
type: object
required:
- type
- title
- details
properties:
type:
description: A string path which uniquely classifies the domain of the error.
type: string
nullable: false
example: jackhenry/operation-failed
title:
description: A end-user readable string title of the error type.
nullable: false
type: string
details:
description: An array of end-user readable strings which provide additional details for the error message.
type: array
nullable: false
items:
type: string
data:
type: object
description: |
Additional data that could be useful to a developer or for handing the error programmatically. The schema for the data in this object is intentionally left undefined.
nullable: true
examples:
internalServerError:
summary: Internal server error
value:
type: general/internal-server-error
title: Internal server error
details:
- Unexpected internal server error
Did this page help you?
Why was this page helpful?
Why wasn't this page helpful?
Thank you for your feedback!
Last updated Tue Sep 15 2026