Chariot mailbox API

openapi: 3.0.0
info:
  title: Chariot FDX Accounts mailbox API
  version: '6.0'
  description: Financial Data Exchange (FDX) v6 compatible API for read-only access to Chariot bank account data. Implements the FDX v6 standard for account information, transactions, and statements.
  contact:
    name: Chariot Development Team
    url: https://givechariot.com/contact
    email: developers@givechariot.com
servers:
- url: https://api.givechariot.com/fdx/v6
  description: Production
- url: https://devapi.givechariot.com/fdx/v6
  description: Staging
security:
- oauth2: []
tags:
- name: mailbox
paths:
  /v1/mailbox/upload_url:
    post:
      summary: Get a Batch Upload URL
      description: 'Returns a presigned URL for uploading a mailbox batch.


        A batch is a ZIP file containing TIFF images and a CSV index file.

        The CSV must conform to the [Batch Format](/v2026-01-15/guides/lockbox-providers/batch-format) specification.


        The `location_id` must match the format `po_<number>` (e.g., `po_543`).

        The returned URL is a presigned S3 URL valid for 15 minutes. Upload the batch ZIP file using an HTTP PUT request to this URL.


        See the [Mail Uploads guide](/v2026-01-15/guides/lockbox-providers/mail-uploads) for details on the upload and rescan process.'
      operationId: getMailboxUploadUrl
      tags:
      - mailbox
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - location_id
              properties:
                location_id:
                  type: string
                  description: The identifier of the PO box or lockbox location. Must match the format `po_<number>`.
                  example: po_543
      responses:
        '200':
          description: Successfully generated a presigned upload URL.
          content:
            application/json:
              schema:
                type: object
                properties:
                  url:
                    type: string
                    description: The presigned URL to upload the batch ZIP file to via HTTP PUT. Expires after 15 minutes.
                    example: https://storage.example.com/upload?token=abc123
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/AuthenticationError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /v1/lockboxes/fulfill_request:
    post:
      summary: Fulfill a Lockbox Request
      description: 'Notifies Chariot that a new PO box has been provisioned by the lockbox provider.


        The `request_id` is a one-time unique value generated by Chariot for each PO box request.


        See the [Provisioning guide](/v2026-01-15/guides/lockbox-providers/provisioning) for the full provisioning flow.'
      operationId: provisionMailbox
      tags:
      - mailbox
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - request_id
              - location_id
              - address
              properties:
                request_id:
                  type: string
                  description: The unique request identifier originally provided by Chariot when the PO box was requested.
                  example: '123456789'
                location_id:
                  type: string
                  description: The identifier of the newly provisioned PO box.
                  example: po_9876
                address:
                  $ref: '#/components/schemas/Address'
      responses:
        '200':
          description: Indicates the PO box has been successfully provisioned.
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/AuthenticationError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  schemas:
    Address:
      type: object
      required:
      - city
      - country
      - line1
      - postal_code
      - state
      properties:
        city:
          type: string
          description: 'City, district, suburb, town, or village. Maximum length: 255 characters.'
          example: New York
        country:
          type: string
          description: Two-letter country code (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2)
          example: US
        line1:
          type: string
          description: 'Address line 1 (e.g. street, PO Box, or company name). Maximum length: 255 characters.'
          example: 123 Main St.
        line2:
          type: string
          description: 'Address line 2 (e.g. apartment, suite, unit, or building). Maximum length: 255 characters.'
        postal_code:
          type: string
          description: 'ZIP or postal code. Maximum length: 40 characters.'
          example: '12345'
        state:
          type: string
          description: State, county, province, or region
          example: NY
    ProblemDetails:
      type: object
      description: RFC 7807 problem-details error (media type application/problem+json). The `status` field is an integer HTTP status code.
      required:
      - type
      - title
      - status
      - detail
      properties:
        type:
          type: string
          description: A URI reference identifying the problem type.
          example: about:blank
        title:
          type: string
          description: A short, human-readable summary of the problem type.
          example: API Error
        status:
          type: integer
          description: The HTTP status code for this error.
          example: 400
        detail:
          type: string
          description: A human-readable explanation specific to this occurrence.
          example: The request is invalid or contains invalid parameters.
      example:
        type: about:blank
        title: API Error
        status: 400
        detail: The request is invalid or contains invalid parameters.
  responses:
    BadRequestError:
      description: The request is invalid or contains invalid parameters
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          examples:
            BadRequest:
              value:
                type: about:blank
                title: API Error
                status: 400
                detail: The request is invalid or contains invalid parameters.
    InternalServerError:
      description: Internal Server Error
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          examples:
            InternalServerError:
              value:
                type: about:blank
                title: API Error
                status: 500
                detail: The server encountered an error processing your request.
    ForbiddenError:
      description: Access denied
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          examples:
            Forbidden:
              value:
                type: about:blank
                title: API Error
                status: 403
                detail: You do not have permission to access this resource.
    AuthenticationError:
      description: Unauthorized. The request is missing the security (OAuth2 Bearer token) requirements and the server is unable to verify the identify of the caller.
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ProblemDetails'
          examples:
            Unauthorized:
              value:
                type: about:blank
                title: API Error
                status: 401
                detail: Authentication credentials were missing or invalid.
  headers:
    X-Request-Id:
      description: The unique identifier for the request
      schema:
        type: string
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 Bearer token. A client may hold both scopes, but each FDX authorization must contain exactly one — they are mutually exclusive per authorization. An authorization containing both will be rejected. See the Authentication page for token exchange details.
      flows:
        authorizationCode:
          authorizationUrl: https://dashboard.givechariot.com/oauth/authorize
          tokenUrl: https://api.givechariot.com/auth/oauth/token
          scopes:
            read:bank_accounts: Read access to bank account data
            sync:connected_accounts: Sync access to connected account data