Wishbone API

Let cardholders turn loyalty and credit card reward points into contributions to university athletic foundations. Server-to-server REST, one API key, one response envelope.

Base URL (sandbox)

https://sandbox.api.getwishbone.io

Authentication

X-Wishbone-API-Key: wbk_test_…

Schema

/openapi.json

Your first call

curl "https://sandbox.api.getwishbone.io/v1/schools?state=TN" \
  -H "X-Wishbone-API-Key: wbk_test_YOUR_KEY_ID:YOUR_SECRET"

The hosted API environments are not serving yet, so the call above will not return data today. The reference and schema are generated from the shipped application code and are accurate — see environment status.

Quickstart →API Reference Get an API key

Bank / Issuer endpoints

The full surface your backend talks to. There is a separate cardholder portal API used by the Wishbone-hosted portal, which you do not need to implement.

POST/v1/accounts/linkLink a Cardholder GET/v1/accounts/linkedList Linked Accounts GET/v1/accounts/{wishbone_user_id}Get Single Linked Account DELETE/v1/accounts/{wishbone_user_id}Unlink a Cardholder POST/v1/donations/requestSubmit Donation Request GET/v1/donations/{donation_id}Get Donation Status GET/v1/schoolsList Schools GET/v1/schools/{school_id}Get School Detail POST/v1/embed/tokenGenerate Embed Token

Start here

Authentication

API keys for your backend, bearer tokens for the cardholder portal, and what never belongs in a mobile binary.

Errors & rate limits

Every error code, 400 vs 422, and why the HTTP status is always the real status.

Webhooks

Signature verification, the retry schedule, and deduplicating on a stable delivery ID.

Architecture

What happens between your 202 and the webhook, and how idempotency works end to end.

Mobile SDK

Put the donation flow in your app without shipping a Wishbone secret.

Compliance

Funds flow, tax receipts, and what cardholder data Wishbone does and does not store.