Introduction

Welcome to the LAW API documentation.

This documentation is designed to help our partners integrate seamlessly with the BMG Money ecosystem. The LAW API is built on RESTful principles, ensuring a predictable and standard interface for interacting with our resources.

Key Features

REST Architecture: Resource-oriented URLs and standard HTTP methods.
Secure: All communication is encrypted via HTTPS.
JSON Standard: Requests and responses are formatted in JSON.
Predictable: Standardized HTTP response codes and envelope wrappers.

Environments

We provide two environments to assist with your development lifecycle:

Environment	Base URL	Description
Sandbox	`https://sandbox.bmgmoney.com`	Use this for development and testing. No real money or data is moved here.
Production	`https://api.bmgmoney.com`	Live environment. Requests here affect real user accounts.

Note: You must replace the base URL in your requests depending on which environment you are targeting.

Protocol & Standards

HTTPS Only

To ensure the privacy and security of data, the LAW API requires HTTPS for all communication. Any requests made over plain HTTP will be rejected.

Request Headers

For all API requests, please ensure you include the following headers:

{
  "Content-Type": "application/json",
  "Accept": "application/json"
}

Response Format

All fields are serialized in camelCase.

Success

Successful responses return the resource directly — there is no wrapper envelope:

[
  {
    "id": 40,
    "targetUrl": "https://api.partner.com/v1/webhooks",
    "events": ["file"]
  }
]

Creation endpoints return the created resource identifier (201 Created):

{ "id": 40 }

Errors

Business and processing errors return a standard error structure:

Field	Type	Description
`title`	String	A short, human-readable summary of the error type.
`statusCode`	Integer	The HTTP status code associated with the error.
`timestamp`	Datetime	When the error occurred.
`errors`	Array of String	Detailed error messages.

{
  "title": "Validation Failed",
  "statusCode": 400,
  "timestamp": "2026-01-22T15:30:00Z",
  "errors": [
    "A non-empty CSV file is required."
  ]
}

Malformed request bodies (structural validation) return 400 with the offending fields listed:

{
  "data": null,
  "success": false,
  "errors": [
    { "entityId": null, "errorMessage": "The provided SSN format is incorrect.", "errorCode": null }
  ]
}

Support

If you run into issues or have questions regarding the integration, please contact our implementation team at contact@bmgmoney.com.

Authentication