---
name: iblai-connect-fis
description: "Read and write FIS Code Connect data through the FIS Code Connect APIs and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with FIS Code Connect data, or to set up an FIS Code Connect MCP connection on ibl.ai."
metadata:
  kind: guide
---

# FIS Code Connect connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/fis — not part of the iblai/vibe repository. Checked against FIS' documentation on October 20, 2026; test it against your own FIS Code Connect setup before you rely on it.

FIS provides core banking, payments, card, wealth and capital-markets systems to financial institutions. Code Connect is its API marketplace, the central access point to APIs across FIS solutions.

## Auth & conventions

- **API:** FIS Code Connect APIs (REST). Catalog of FIS APIs in categories including Banking and Wealth, Payments, Cards, Networks, Intelligence (risk and fraud), Institutional and Wholesale, and Corporate. Each API's reference lives in the Code Connect catalog.
- **Base URL:** https://api-gw-uat.fisglobal.com (UAT host; production and B2B hosts are listed in the Developer Toolkit)
- **Access:** Partner or license program. Register on Code Connect for Mock Sandbox keys (stubbed responses). Readiness/Test keys with live data need approval from your FIS account manager; production is for FIS clients and approved partners.
- **Auth:** OAuth 2.0 bearer token from consumer key and secret; mTLS client certificate (api-gw2 endpoints). Generate an access token from the app's consumer key and secret and send Authorization: Bearer. Each request also needs a uuid header. mTLS endpoints require a client certificate from a trusted CA.
- **Limits:** Clients must cache access tokens for at least 20 minutes and should not set token expiry beyond 24 hours; do not request a token per call. No rate limits published on the public toolkit pages.
- Keep FIS Code Connect credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Banking and wealth data** — Banking and Wealth category APIs; available resources depend on which FIS core the institution runs. See the catalog reference.
- **Loans** — Digital banking APIs for personal loans, mortgages and HELOC.
- **Payments** — Payments category: bill pay, P2P and cross-border.
- **Cards** — Card creation, management and cardless cash APIs.
- **Risk and fraud insights** — Intelligence category: consumer insights and real-time risk and fraud.

## Writes

- **Payments** — Bill pay, P2P and cross-border payment APIs move money. **Confirm with the user first.**
- **Cards** — Card creation and management APIs issue or change live cards. **Confirm with the user first.**
- **Loan applications** — Digital banking loan APIs; confirm write operations per API in the catalog.

## Expose it to an ibl.ai agent (MCP)

FIS did not publish an MCP server of its own when this skill was checked. Host a small MCP server that wraps the calls above, then register it below.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - For an API key or service credential use `auth_type=token` with `auth_scope=platform` for one key across the organization, or scope it to a single agent for one key per agent.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "Pull the current balance and last 10 transactions for this member's checking account"
- "Check the status of yesterday's cross-border payment batch"
- "Block the debit card reported lost by this customer"
- "Summarize the real-time fraud alerts raised on this account this week"

## Guardrails

- Core banking APIs carry GLBA nonpublic personal information (accounts, balances, loans). Card APIs handle PCI cardholder data.
- Request the narrowest FIS Code Connect scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- FIS Code Connect API Marketplace: https://codeconnect.fisglobal.com/
- Code Connect Developer Toolkit: https://codeconnect.fisglobal.com/developerToolkit/9B9381972AEF4729BBF4299AD72A2371
- This connector on ibl.ai: https://ibl.ai/developer/connectors/fis
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections