Third-Party Integrations
========================

Gravv delivers banking, payout, card, compliance, and custody capabilities
through regulated partner institutions and licensed providers. Provider
credentials are held exclusively in GCP Secret Manager; provider calls are
signed where required (HMAC schemes per provider); and provider webhooks are
ingested through dedicated authenticated endpoints at the API gateway.

Crypto Custody & Blockchain
---------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Dfns
     - Web3
     - MPC wallet custody across eight networks, transaction signing
       (user-action signing with ECDSA P-256), gas fee sponsorship.
   * - Circle
     - Web3, Payees, Transfer, Onramp
     - USDC infrastructure: wire accounts, payouts, cross-currency exchange,
       recipient addresses, onramp completion.
   * - Rhino.fi / AllBridge
     - Web3
     - Cross-chain bridging.
   * - OpenTrade
     - Web3
     - Savings / yield product.
   * - Quidax
     - Integrations, FX
     - Crypto sub-accounts, payment addresses, withdrawals, deposits.
   * - Noah
     - Integrations, Internal Accounts
     - Fiat↔crypto conversion sessions, pay-in sessions, onboarding.

Banking & Virtual Accounts
--------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Bridge
     - Internal Accounts, Payees, Transfer
     - USD/EUR virtual accounts, external accounts, ACH/SEPA rails.
   * - HiFi
     - Internal Accounts, Payees, Transfer, Integrations
     - KYC lifecycle, virtual accounts, offramp transfers, SWIFT.
   * - Erebor
     - Payees, Transfer
     - USD banking, master deposit account.
   * - Sokin
     - Payees, Transfer, Integrations
     - Business onboarding, FX, international transfers, beneficiary
       management.
   * - Duplo
     - Transfer, Integrations, Internal Accounts
     - NGN dedicated virtual accounts, bank transfers, settlements
       (HMAC-SHA512 signed).
   * - Anchor
     - Transfer, Payees routing
     - NGN virtual accounts and transfers.
   * - Austin Capital, Yolat, Lead Bank
     - Internal Accounts, Onramp, Integrations
     - Account provisioning, wallet payouts, virtual accounts.
   * - Virtual IBAN provider
     - Transfer
     - EUR virtual IBAN issuance.

Cross-Border Payouts & Local Rails
----------------------------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Thunes
     - Transfer, Payees
     - Cross-border payouts (HMAC-signed requests, secret webhook path).
   * - Yellow Card
     - Transfer, Payees, Onramp, Integrations
     - African rails: payouts, collections, settlements, rates (HMAC-signed).
   * - Dlocal
     - Transfer, Payees, Integrations
     - African / LatAm payouts, account verification (HMAC-signed).
   * - Fincra
     - Transfer, Payees, Integrations
     - NGN conversions, account verification, transfers.
   * - Balad, Attijariwafa, I&M Bank, NMBZ
     - Transfer, Payees, FX
     - Regional bank rails (Middle East / North & East / Southern Africa).
   * - Flocash, Passpoint, Beam
     - Integrations
     - Mobile-money and bank transfers, RTP transfers, payment accounts.
   * - MoneyGram
     - API gateway
     - Account validation, transfer execution, and status (dedicated
       partner API surface).

Cards
-----

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Coinflow
     - Onramp, Integrations
     - Card charging, tokenization (card-on-file), payment links, 3-D Secure.
   * - Rain
     - Web3, Risk
     - Card issuing; card asset withdrawal; KYC share tokens.

Compliance & Identity
---------------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Sumsub
     - Risk
     - KYC / KYB verification, document collection, liveness, review
       webhooks, applicant share tokens (signed requests).
   * - Stytch
     - Identity, Web apps
     - Passwordless authentication (magic links) for dashboard and admin.

FX Liquidity
------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Standard Bank, ABSA, NMBZ
     - FX (via banking-integrations)
     - Institutional FX rates and trade execution.
   * - Quidax
     - FX
     - Crypto-adjacent rate sourcing.

Operational Tooling
-------------------

.. list-table::
   :header-rows: 1
   :widths: 20 25 55

   * - Provider
     - Used by
     - Role
   * - Slack
     - API gateway, Transfer, Payees, Onramp
     - Operational alerting: payout escalations, manual-processing queues,
       low-balance warnings, gateway alert middleware.

Webhook Ingestion
-----------------

The API gateway exposes dedicated live and sandbox webhook endpoints for:
Bridge, Thunes, Sumsub, Balad, Dlocal, Yellow Card, Fincra, Austin Capital,
Attijariwafa, Coinflow, Flocash, Rain, Circle, Sokin, HiFi, Duplo, Yolat,
Dfns, Quidax, Erebor, and onboarding events. Ingested events are published to
Kafka (``webhooks.inbound.events``) and consumed by the responsible services
(Transfer, Web3, Risk, Identity, Internal Accounts).