Financial Services · Managed platform (MuleSoft)

API Security & Integration

Connect core and mainframe systems to fintech partners through governed, secured APIs

Book a demonstration Request a technical briefing Factsheet

Overview

What you are buying

Moraph licenses, implements and runs MuleSoft's Anypoint Platform as the controlled layer between your core and mainframe systems and the fintech apps, partners and channels that need their data. We build and operate the integrations, apply security policies to every API, and monitor traffic and failures as a managed service. Your organization decides which data is exposed, to whom, and on what terms.

The problem it solves

Core banking and mainframe systems were built for batch files and terminal sessions, not for dozens of partners calling in at once. Over time institutions add point-to-point connections, shared credentials and file drops for each new fintech, card program or digital channel, each built differently. Security teams cannot say with confidence which partner can reach which data, failures surface as customer complaints, and every new partner restarts the same work.

Point-to-point connections to the core multiply with every new partner
Partner access relies on shared credentials and inconsistent controls
No single view of who called what, when, and with what result
Mainframe skills are scarce, so each change takes longer than the business expects

Who uses it

Integration and enterprise architecture teams at banks and credit unions
Information security officers responsible for third-party and API access
Digital banking and partnership teams onboarding fintech partners
Core and mainframe application owners
Internal audit and examiners reviewing third-party connectivity

Requirements it supports

Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))FTC Safeguards Rule (16 CFR Part 314) for non-bank financial institutionsFFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations bookletFFIEC Authentication and Access to Financial Institution Services and Systems (2021)Interagency Guidance on Third-Party Relationships: Risk Management (2023)NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

MuleSoft provides the Anypoint Platform, Moraph builds and runs your integrations on it, and your organization owns the systems, the data and every decision about who may access them.

Area	Moraph	MuleSoft	Your organization
Licensing	Resells the subscription and tracks capacity and renewals with you	Sets licence terms, editions and capacity measures	Agrees scope and signs the order
Platform availability	Monitors service health and tells you about disruptions that affect your APIs	Operates the Anypoint control plane and its hosted runtimes under its own service commitments	Operates any self-hosted runtimes and the network they run on, unless Moraph runs them by agreement
Integration build	Designs, builds and tests APIs and integrations to an agreed specification	Provides the runtime, connectors and design tools	Approves specifications and provides access to core and mainframe test systems
Security policies	Applies and maintains authentication, rate-limiting and threat-protection policies on each API	Provides the policy enforcement capabilities	Sets the security standards and approves exceptions
Partner access	Registers partner applications and issues credentials once approved	Provides client application management	Approves each partner, its scope and its contract
Monitoring and alerts	Watches traffic, errors and latency, and triages alerts	Provides monitoring and logging capabilities	Receives escalations and decides on business impact
Incident response	Investigates integration failures and restores service on the integration layer	Resolves platform defects and outages	Leads incidents that affect customers and handles notifications to regulators or customers
Changes	Deploys changes through a reviewed, tested release process	Delivers platform releases	Approves changes and production releases
Runtime updates	Plans and applies runtime and connector upgrades and tests integrations against them	Publishes runtime versions and support timelines	Agrees maintenance windows
Core and mainframe systems	Builds against the interfaces your teams expose	No role	Owns, operates and changes core and mainframe systems

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of MuleSoft itself, which belongs to its vendor.

Step 1

Onboarding tracker

During onboarding, Moraph tracks each setup task and connection migration with an owner on each side.

Task	Moraph owner	Client owner	Status
Environments and single sign-on	Integration engineer	IT identity team	Done
Security policy baseline approved	Integration engineer	Security officer	Done
Account inquiry system API	Integration engineer	Core banking manager	In test
Mainframe MQ test access	Integration engineer	Mainframe team	Waiting on access
Partner migration: Example Fintech A (fictional)	Integration engineer	Partnership manager	Scheduled

Step 2
Security baseline review
Each API is checked against the policy standard for its data classification, and gaps are shown before release.
API Security & Integration · Policy reviewSample data
Member balance API v2 · Confidential data
Authentication
OAuth 2.0 token enforcement
Rate limit
Per partner, as approved
Threat protection
JSON threat protection on
IP allowlist
Not applied
Exceptions
None
Required for this classification
- Token enforcement with your authorization server
- Per-partner rate limit
- IP allowlist or a documented exception
Apply missing policyRequest exception
Each API is checked against the policy standard for its data classification, and gaps are shown before release.
Step 3
Partner access request
A partner gets access only after its business owner and your security officer approve the scope.
API Security & Integration · Access request AR-0318Sample data
Example Fintech B (fictional) · Account inquiry and transfers
1. Request submitted with contract referencePartnership manager
2. Scope limited to read balances and initiate internal transfersAPI owner
3. Third-party due diligence confirmed completeVendor management
4. Access approved with per-partner rate limitSecurity officer
5. Client application registered and credentials issuedMoraph integration engineer
6. Access added to the next quarterly reviewMoraph integration engineer
A partner gets access only after its business owner and your security officer approve the scope.

Step 4

Change requests

Every change is tested and approved before Moraph releases it to production.

Request	Change	Tests	Approval	Status
CR-2207	Add transaction history endpoint	Passed	Approved	Released
CR-2211	Raise rate limit for mobile banking	Passed	Approved	Scheduled
CR-2214	Runtime upgrade to supported version	2 failures to review	Pending	In test
CR-2219	Retire statement API v1	Not started	Pending	Planned

Step 5
Alert triage
Moraph triages alerts, restores service on the integration layer and escalates to the owners of the systems involved.
API Security & Integration · Incident IN-0907Sample data
Rising errors on account inquiry API
1. Error-rate alert raised on account inquiry APIMonitoring
2. Errors traced to timeouts from the core interfaceMoraph integration engineer
3. Core banking manager notifiedMoraph integration engineer
4. Core interface restarted by core teamCore banking manager
5. Error rate back to normal; partners informed by API ownerAPI owner
6. Incident review added to monthly service reviewMoraph integration engineer
Moraph triages alerts, restores service on the integration layer and escalates to the owners of the systems involved.
Step 6
Monthly service review
Each month Moraph reports on the service: what was delivered, what broke, and what is coming.
API Security & Integration · Service reviewSample data
Monthly service review · Fictional sample month
Changes released
7
Alerts triaged
23
Incidents
1, resolved
Partner applications active
12
Policy exceptions open
1, expires next month
Runtime versions
1 upgrade planned
Coming up
- Quarterly partner access review
- Runtime upgrade window to agree
- Two partners to migrate from file drops
Download packSchedule meeting
Each month Moraph reports on the service: what was delivered, what broke, and what is coming.

Workflows

The principal workflows

Design
Each API starts as a specification agreed with your architects and security team: what data it exposes, which systems it calls, who may use it and which policies apply.
- Business need and data scope agreed with the API owner
- Specification written and published in Anypoint Exchange
- Security team reviews data classification and required policies
- Target systems and interfaces confirmed with core and mainframe owners
- Specification approved before build begins
Build
Moraph builds the integration in Mule, connecting to core and mainframe interfaces such as message queues, transaction gateways and fixed-width files, and transforming their data into the agreed API format.
- Integration built to the approved specification
- Fixed-width and copybook-based records mapped with DataWeave
- Automated tests run against your test systems
- Security policies applied in API Manager
- Release reviewed and approved by your team
Connect partners
Partners and internal apps get access only through a registered client application with approved scope, rather than shared credentials or direct connections to the core.
- Partner request submitted with business owner and contract reference
- Security and API owner approve the scope
- Client application registered and credentials issued
- Rate limits and allowed operations set for the partner
- Access recorded for periodic review
Operate
Moraph monitors traffic, errors and latency on every API, triages alerts, and handles changes and runtime upgrades through a logged process.
- Dashboards and alerts configured per API
- Alerts triaged and escalated by severity
- Failures investigated and service restored on the integration layer
- Changes released through the approved pipeline
- Monthly service review with your integration owner

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Integration architect

Enterprise architect, integration lead, head of digital architecture

Sets the design standards for APIs and integrations and makes sure new work fits them.

Sees

All API specifications, versions and their consumers
Integration dashboards across environments
Change requests and release history

Does

Approves API specifications before build
Sets naming, versioning and layering standards
Reviews designs that touch core and mainframe systems
Prioritizes the integration backlog with Moraph
Approves production releases where your process requires it

Cannot

Approve partner access without the security officer
Change security policies on their own authority

Approvals: Approves specifications and releases; partner access and policy exceptions also need the security officer.
Notified about: Specifications waiting for approval, releases scheduled, and incidents affecting integrations.

API owner

Digital banking product owner, partnership manager, payments product manager

Answers for a business-facing API: who uses it, what data it exposes, and whether it meets the partner's needs.

Sees

Their APIs, their consumers and usage
Errors and response times for their APIs
Partner access requests for their APIs

Does

Defines the business need and data scope
Sponsors partner access requests
Reviews usage with partners
Requests changes and new versions

Cannot

Grant partner access without security approval
Deploy changes to production
See APIs owned by other teams unless granted

Approvals: Partner access to their APIs is approved by them and by the information security officer.
Notified about: Access requests for their APIs, incidents and error spikes on their APIs, and version retirements.

Information security officer

CISO, information security officer, IT risk manager

Makes sure every API and partner connection meets your security standards and third-party risk process.

Sees

Policies applied to every API
Registered partner applications and their scope
Security events such as blocked requests and authentication failures
Policy exceptions and their expiry

Does

Sets required policies by data classification
Approves or rejects partner access
Approves and reviews policy exceptions
Certifies periodic access reviews
Directs response to security events

Cannot

Deploy integrations or change runtime configuration directly
Approve an exception they requested themselves

Approvals: Approves partner access, policy changes and exceptions.
Notified about: Access requests, policy exceptions coming up for renewal, security events above the threshold you set, and access reviews due.

Core and mainframe owner

Core banking manager, mainframe systems manager, application owner

Owns the systems the APIs call and protects their stability.

Sees

Integrations that call their systems
Traffic volumes and error rates against their systems
Changes scheduled that affect their systems

Does

Provides interface definitions and test access
Approves changes that touch their systems
Agrees capacity limits for traffic to their systems
Takes part in incident response when their systems are affected

Cannot

Register partners or issue credentials
Change gateway policies

Approvals: Approves integration changes that call their systems.
Notified about: Changes affecting their systems, incidents involving their interfaces, and traffic approaching agreed limits.

Auditor or examiner (read-only)

Internal auditor, IT auditor, regulatory examiner (under temporary access)

Reviews who could access what through the APIs and how changes were controlled.

Sees

Partner applications, scopes and approval records
Policies on each API and their change history
Release records within the scope granted

Does

Reads records within their scope
Exports reports they have been given access to

Cannot

Change, approve or delete anything
See message contents or credentials
Keep access after it expires

Approvals: Their access is approved by the information security officer, with a scope and an end date.
Notified about: Nothing by default.

Moraph integration engineer

Moraph managed-service engineer, MuleSoft developer, platform operations

Builds, deploys and operates your integrations under change and access approvals your organization gives.

Sees

Integration code, configuration and deployment settings
Monitoring, logs and alerts, with sensitive fields masked where configured
Change requests and approvals

Does

Builds and tests integrations to approved specifications
Applies policies approved by your security officer
Registers partner applications once approved
Triages alerts and restores service on the integration layer
Plans and applies runtime upgrades
Prepares the monthly service review

Cannot

Approve partner access, policy exceptions or production releases
Change core or mainframe systems
Deploy to production without an approved change, except to restore service under your incident process

Approvals: Production changes are approved by your integration architect or change board; access and policy changes by your security officer.
Notified about: Alerts, failed deployments, platform service notices, and change requests raised.

Permissions at a glance

Action	Architect	API owner	Security	Core owner	Auditor	Moraph eng
Approve an API specification	Approves	View only	View only	View only	No access	No access
Build and test integrations	View only	No access	No access	No access	No access	Full
Approve a production release	Approves	No access	No access	Approves	No access	No access
Deploy to production	No access	No access	No access	No access	No access	Full
Change security policies	No access	No access	Approves	No access	No access	Full
Approve partner access	No access	Approves	Approves	No access	No access	No access
Register partner applications	No access	No access	No access	No access	No access	Full
View monitoring dashboards	View only	Own work only	View only	Own work only	No access	Full
View partner scopes and approvals	View only	Own work only	Full	No access	View only	View only
View change and release history	View only	Own work only	View only	Own work only	View only	View only
Manage platform users and roles	No access	No access	Approves	No access	No access	Full

Full
Own work only
Approves
View only
No access

How access is controlled

Separation is built into the service: Moraph engineers build and deploy, but production releases, partner access and policy exceptions are approved by named people at your organization.
Roles are set up with you during onboarding and can be limited by business line, API or environment, so teams see only what they are responsible for.
Every partner approval, policy change and release is recorded with who approved it, and access reviews cover both partner applications and platform users, including Moraph accounts.
Staff sign in through your identity provider. Auditors and examiners get temporary read-only access with a defined scope and an end date.

Features

What it does

Managed API gateway

Every partner and channel call passes through Anypoint policies Moraph configures, rather than reaching core systems directly.

Authentication policies

Anypoint enforces OAuth 2.0 tokens or client ID and secret on each API, validated against your identity provider where configured.

Rate limiting and throttling

Limits per partner and per API protect core systems from more traffic than they can take.

Threat protection

JSON and XML threat protection and IP allowlists applied to APIs according to their exposure.

Mainframe and core connectivity

Integrations reach core and mainframe systems through the interfaces they already expose, such as IBM MQ, transaction gateways, databases and file transfers.

Copybook data mapping

DataWeave maps COBOL copybook and fixed-width records to the JSON or XML your partners expect, and back.

API catalog

Specifications, versions and documentation for every API kept in Anypoint Exchange, so teams reuse what exists.

Partner access control

Each partner uses its own registered client application with approved scope, which can be suspended without affecting others.

Monitoring and alerting

Traffic, error rates and response times per API and partner, with alerts that Moraph triages.

Release pipeline

Changes are built, tested and promoted through environments with your approval before production.

Layered API design

System, process and experience APIs keep core interfaces stable while partner-facing APIs change.

Access and change records

Partner approvals, policy changes and releases recorded so you can show examiners who could reach what, and when it changed.

Integrations

How it connects to your systems

Connects to	How	What flows
Core banking	Account, customer and transaction services through the interfaces your core exposes, such as APIs, databases, message queues or files.	Both ways: requests and responses within each API's approved scope.
Mainframe applications	COBOL applications reached through IBM MQ, transaction gateways or file transfer, as your mainframe team allows.	Both ways: copybook-format records mapped to and from API formats.
Fintech partners and digital channels	Partner apps, mobile and online banking call published APIs with their own registered credentials.	In: partner requests. Out: responses within approved scope.
Identity provider	Platform users sign in through your identity provider, and OAuth tokens can be issued and validated by your authorization server.	In: user identity, groups and token validation.
Security monitoring	API logs and security events forwarded to your security information and event management tool.	Out: access logs, policy violations and authentication failures.
Secure file transfer	Batch files exchanged with partners where APIs are not suitable, including through Moraph's Secure File Transfer service.	Both ways: scheduled files.
Service management	Incidents and change requests tracked in your service management tool or Moraph's service desk.	Both ways: tickets, approvals and status.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Platform users sign in through your identity provider, so your password and multi-factor policies apply.

Least-privilege partner access

Each partner has its own credentials and scope, approved by your security officer and reviewed periodically.

Controlled administrator access

Moraph engineers use named accounts with role-based access, and production changes require your approval.

Audit trail

Partner approvals, policy changes, deployments and administrator actions are logged with the person and time.

Encryption and keys

Traffic is encrypted in transit, and configuration and service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Tested releases

Every integration change passes automated tests and a security review before release, under Moraph's SOC 2 Type II and ISO/IEC 27001 audited controls.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operations

API traffic and errors

For integration architect, API owners and Moraph engineers

Calls, error rates and response times per API and partner over time.

Break down by: API, Partner, Environment, Period
Delivered as: Anypoint Monitoring dashboards; monthly service review
Used for: Spotting problems before customers do and planning capacity.

Incident log

For integration architect and IT operations

Each integration incident with its cause, systems affected, time to restore on the integration layer and follow-up actions.

Break down by: API, Severity, Cause, Period
Delivered as: Service desk; monthly service review
Used for: Learning from failures and showing how incidents were handled.

Load on core systems

For core and mainframe owners

Traffic reaching each core and mainframe interface against the limits agreed with its owner.

Break down by: Target system, API, Partner, Hour of day
Delivered as: Dashboard; CSV export
Used for: Protecting core systems and agreeing limits for new partners.

Security and access

Partner access register

For information security officer, vendor management and auditors

Every partner application with its owner, scope, approval, contract reference and last activity.

Break down by: Partner, API, Approver, Last activity
Delivered as: PDF and CSV, on the review schedule you set
Used for: Certifying third-party access and removing what is no longer needed.

Policy coverage

For information security officer

The security policies applied to each API against the standard for its data classification, with exceptions and their expiry dates.

Break down by: API, Classification, Policy, Exception status
Delivered as: PDF; monthly service review
Used for: Confirming every API meets your standard and exceptions are time-limited.

Security events

For information security officer and security operations

Blocked requests, authentication failures and rate-limit breaches by API and source.

Break down by: API, Partner, Event type, Period
Delivered as: Forwarded to your security monitoring tool; summary in the monthly service review
Used for: Investigating misuse and tuning policies.

Platform user access review

For information security officer

Every platform user, including Moraph engineers, with role, environment and last sign-in.

Break down by: Role, Environment, Account type, Last sign-in
Delivered as: CSV and PDF, on the review schedule you set
Used for: Periodic certification of administrative access.

Change and service

Change and release history

For integration architect, change board and auditors

Every change to integrations and policies with the request, tests, approver and release date.

Break down by: API, Change type, Approver, Period
Delivered as: Service desk export; PDF
Used for: Evidencing that production changes were tested and approved.

API catalog and versions

For architects and API owners

Published APIs, their versions, consumers and any versions scheduled for retirement.

Break down by: API, Version, Consumer, Status
Delivered as: Anypoint Exchange; CSV export
Used for: Planning reuse and partner migrations to new versions.

Monthly service review

For integration architect and IT management

Moraph's work in the month: builds delivered, changes released, alerts triaged, incidents, runtime upgrades and upcoming work.

Break down by: Work type, Status, Period
Delivered as: PDF; monthly review meeting
Used for: Overseeing Moraph as a service provider and setting priorities.

Exports, access and evidence

Operational dashboards come from Anypoint Monitoring as configured by Moraph; service reports are prepared by Moraph from its service records.
Access, policy and change reports can be exported to PDF or CSV for your third-party risk, security and audit processes.
Logs and security events can be forwarded to your own security monitoring and data platforms, subject to the retention set in your licence.
Reports respect each viewer's role: API owners see their own APIs, the security officer sees all access, and auditors get read-only access within a defined scope.
Message contents are not included in reports by default; sensitive fields are masked in logs where configured.

Deployment

Where and how it runs

MuleSoft-hosted runtimes

Integrations run on MuleSoft's hosted runtime in the region your licence provides, operated by Moraph.

Runtimes in your environment

Where data must stay in your data center or cloud account, runtimes run in your environment and Moraph operates them by agreement.

Your existing licence

Where you already license MuleSoft, Moraph takes over build and operation, subject to the vendor's terms.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Connectivity assessment

We inventory existing connections to your core and mainframe, the partners using them and how they authenticate, and agree which to move first.

Licensing and platform setup

Moraph arranges the MuleSoft subscription or works with yours, sets up environments, single sign-on, roles and the deployment model for runtimes.

Security baseline

Your security officer approves the policy set for each data classification, which becomes the standard every API is checked against.

Core and mainframe interfaces

System APIs are built over the interfaces your core and mainframe teams expose. We need interface definitions, test access and a contact on each team.

Partner migration

Existing partner connections are moved to registered applications with approved scope, partner by partner, with each partner's cutover agreed in advance.

Handover to service

Monitoring, alerting, escalation contacts and the change process are agreed, and the service moves to ongoing operation with a monthly service review.

Limitations

What it does not do

Worth knowing before you evaluate it.

Moraph is not the vendor. MuleSoft owns and operates the Anypoint Platform, and its own service commitments, roadmap and outages apply.
Licences are subject to MuleSoft's terms, including capacity measures that may limit the number of integrations or the traffic they carry.
Moraph does not change or operate your core or mainframe systems. Integrations use the interfaces your teams expose and are limited by their capacity.
Decisions about which data is exposed and which partners may access it are your organization's, as is due diligence on each partner.
The service is not a replacement for your web application firewall, network security or fraud controls.
Moraph restores service on the integration layer; failures in core systems, networks or partner systems are resolved by their owners.
Customer and regulator notifications after an incident remain your organization's responsibility.
Platform features available depend on the MuleSoft edition and add-ons you license.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

List your current connections to the core and mainframe and see which would move first
Review the proposed security policy standard with your security officer
Walk through a partner access request from submission to registered application
Ask how a copybook-based mainframe record would be exposed as an API
Review the responsibilities table against your own teams and change process
Ask to see a sample monthly service review and incident record

Questions

Frequently asked questions

Do we need to change our core or mainframe systems?

Usually not. Integrations use the interfaces your systems already expose. Where a new interface is needed, your core or mainframe team builds it and Moraph connects to it.

Can we keep our existing MuleSoft licence?

Yes, where the vendor's terms allow. Moraph can take over build and operation of integrations on a platform you already license.

Who decides which partners get access?

Your organization. Each partner's access is approved by the API owner and your security officer before Moraph registers it.

Does Moraph see our customer data?

Moraph engineers work with integration configuration and monitoring. Logs can mask sensitive fields, and access to message contents follows your access policy and is logged.

How is it priced?

The platform subscription follows MuleSoft's licensing, and Moraph's build work and managed service are priced separately. See Working with Moraph for what drives a quotation.

Can examiners review partner access?

Yes. The partner access register, policy coverage and change history can be exported, or examiners can be given temporary read-only access with a defined scope and end date.

Next steps

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: API Security & Integration guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: API Security & Integration support guide.

API Security & Integration

What you are buying

The problem it solves

Who uses it

Requirements it supports

Who is responsible for what

A short walkthrough

Onboarding tracker

Security baseline review

Partner access request

Change requests

Alert triage

Monthly service review

The principal workflows

Design

Build

Connect partners

Operate

Who does what in the product

Integration architect

Sees

Does

Cannot

API owner

Sees

Does

Cannot

Information security officer

Sees

Does

Cannot

Core and mainframe owner

Sees

Does

Cannot

Auditor or examiner (read-only)

Sees

Does

Cannot

Moraph integration engineer

Sees

Does

Cannot

Permissions at a glance

How access is controlled

What it does

Managed API gateway

Authentication policies

Rate limiting and throttling

Threat protection

Mainframe and core connectivity

Copybook data mapping

API catalog

Partner access control

Monitoring and alerting

Release pipeline

Layered API design

Access and change records

How it connects to your systems

How your data is protected

Single sign-on

Least-privilege partner access

Controlled administrator access

Audit trail

Encryption and keys

Tested releases

What you can report on

Operations

API traffic and errors

Incident log

Load on core systems

Security and access

Partner access register

Policy coverage

Security events

Platform user access review

Change and service

Change and release history

API catalog and versions

Monthly service review