API and Webhooks: The Same Trust Chain, Outside the App

A number that’s trustworthy inside an app and unverifiable the moment it leaves it isn’t actually trustworthy: it’s just trustworthy-looking while someone is watching. Rexfin’s programmatic surface is built on one rule: anything a figure can prove on screen, it proves identically once it’s pulled through the API, a webhook, or a structured export. Nothing gets laundered into looking cleaner on the way out.

What every number carries on the way out

Every value the API or a webhook emits comes wrapped in the same envelope: its currency and unit scale, whether it’s an actual or a modelled figure, and, critically, a citation handle if and only if it’s an actual. A modelled projection is never emitted with a citation attached, because it never earns one inside the app either. If a caller’s access token isn’t scoped to the underlying source document, the citation simply doesn’t resolve: a fail-closed “restricted” response, not a stripped-down version of the real thing. The schema itself makes the actual-versus-modelled distinction unavoidable: an integrating developer can’t accidentally write code that treats a forecast as if it were a filed figure, because the field that would carry proof simply isn’t there.

A documented, versioned REST API

The REST layer is an OpenAPI-described, versioned read surface: statements, individual cells, named scenarios, the current verifier verdict for a model, and the diff between one version and the last. It’s read-mostly by design: nothing in this surface lets an external caller write a cell or a driver back into your model, because that authority stays inside the app where the audit trail tracks who changed what. Access runs through OAuth/OIDC and scoped tokens, and every token’s effective reach is capped at the narrower of what the token was granted and what the requesting person’s own access controls allow: a token can never see more than the human issuing it could see, and losing access mid-session cuts the token off immediately rather than at its next renewal.

Webhooks: told, not polled

Instead of hammering the API on a schedule, a subscriber registers for the events that matter: a period closing, a board pack finishing, a version being published, or the verifier gate passing or failing on an export attempt. Every delivery is signed, so a receiver can confirm it actually came from Rexfin, and delivered at least once with a stable event ID, so a duplicate is detectable rather than silently processed twice. A subscriber endpoint that’s down gets retried with backoff, not an infinite hammering, and past deliveries stay listed and replayable if you need to re-pull one. A verifier.failed webhook, in particular, is the same “this model cannot be trusted to export” signal the app shows internally, carried out to whatever downstream pipeline needs to know about it, without anyone having to check the UI first.

Structured exports that only leave when the model ties out

Beyond the human-readable board pack, Rexfin can produce machine-consumable exports (iXBRL tagged to the same taxonomy the statements use, plus flat JSON and CSV) for downstream ingestion by a regulator, an exchange filing system, or a consolidation pipeline. These exports are gated exactly the way the board pack is gated: an unbalanced, unreconciled model cannot produce one. A structured export of a model that doesn’t tie out is precisely the failure this whole discipline exists to prevent, so the gate applies here too, not just to the document a human reads.

Who this is for

This is for teams that already have a BI stack, a consolidation system, or an internal pipeline and want Rexfin’s numbers to flow into it without anyone re-typing a board pack into a spreadsheet, and for anyone who needs a downstream system to know the moment a model reconciles or fails to. If your integration plan currently involves someone exporting a PDF and re-keying it, the API replaces that with a documented contract that carries the same guarantees the app does.

For the agent-facing side of this same surface, see how MCP access extends the same rules to AI copilots, or start from the product tour hub for the full picture.