Prerequisites

Check the infrastructure, dependencies, authentication, and file-format requirements your environment needs before you deploy Matcher for reconciliation.

Before deploying Matcher, ensure that your environment meets the requirements described on this page. These prerequisites define the baseline for running reconciliation reliably in development and production environments.

System requirements

---

Infrastructure

The values below are platform-validated operational starting points, not product-enforced minimums. Adjust them for your transaction volume and retention needs.

Component	Validated starting point / scaling guidance	Purpose
CPU	2 cores / 4+ cores	Matching and scoring logic is CPU-intensive
Memory	2 GB / 4+ GB	In-memory processing of transaction batches
Storage	10 GB / 50+ GB	Persistent storage for transactions and audit logs

Dependencies

The local Compose stack is the platform-validated dependency baseline. It pins:

• PostgreSQL 17: Primary data store for reconciliation contexts, transactions, matches, and audit logs.
• Valkey 8: Redis-compatible service used for caching, duplicate detection, distributed locking, and idempotency control.
• RabbitMQ 4.1.3: Message broker for asynchronous processing across bounded contexts.

Runtime

The following versions are the platform-validated tooling baseline, not a product support matrix:

• Go 1.26+ (only required when building from source)
• Docker 24+ and Docker Compose 2.20+ for containerized deployments
• Kubernetes 1.28+ for production-grade deployments using Helm

Optional: reconciling Midaz data

---

Matcher pairs naturally with Midaz Ledger, but there is no live connector between them — Matcher has no MIDAZ_API_URL and opens no connection to Midaz. Reconciling Midaz data is entirely optional; Matcher works as a stand-alone product reconciling any data sources.

When to reconcile Midaz data

Reconcile ledger data from Midaz if:

• You use Midaz as your ledger system
• You want to reconcile Midaz postings against external sources (bank statements, gateway reports)

When Midaz is not involved

Matcher works independently when:

• Reconciling between external systems (banks, ERPs, payment processors)
• Using a different ledger system
• Importing ledger data via CSV/JSON/XML files

How it works

Matcher reconciles Midaz data the same way it ingests any source — by import, not a live query:

1. Export the ledger data for the period you want to reconcile.
2. Import that export into a Matcher context as a source of type LEDGER.
3. Import the counterparty data (bank statement or gateway report) as the other side.
4. Matcher matches the two sides using your match rules.

See the Matcher and Midaz guide for the full flow.

Authentication

---

Matcher uses lib-auth for authentication and authorization, consistent with the rest of the Lerian ecosystem.

Authentication flow

1. The client obtains a JWT from the identity provider
2. The token is sent in the Authorization: Bearer *** header.
3. Matcher validates the token via lib-auth
4. Tenant identity and permissions are extracted from token claims

Required permissions

Access to Matcher features is controlled through fine-grained permissions:

Permission	Description
contexts:create	Create reconciliation contexts
contexts:read	View context configuration
rules:create	Create and update match rules
imports:create	Upload transaction files
match-runs:run	Execute matching jobs
exceptions:read	View exceptions
exceptions:resolve	Resolve exceptions
reports:read	Access reports and audit views

Single-tenant mode

MULTI_TENANT_ENABLED controls this mode. Its default is false, which makes Matcher use the default tenant below. Authentication state or a missing JWT tenant claim does not switch Matcher into single-tenant mode.

# Default tenant configuration (single-tenant mode)
DEFAULT_TENANT_ID=11111111-1111-1111-1111-111111111111
DEFAULT_TENANT_SLUG=default

Generic import formats

---

Matcher’s generic importers accept CSV, JSON, and XML. Built-in parsers also support CAMT.053, CNAB 240/400, OFX, several acquirer formats, and receivables formats. See the import format catalog for the complete inventory.

Each generic format has specific structural requirements for successful ingestion.

CSV (comma-separated values)

Commonly used for bank statements and exports.

Requirements:

• Header row is required
• UTF-8 encoding
• Comma delimiter (configurable)
• Quoted fields for values containing delimiters

Example:

transaction_id,amount,currency,date,reference
TXN-001,1000.00,USD,2024-01-15,Invoice payment
TXN-002,-250.50,USD,2024-01-16,Refund

JSON (javascript object notation)

Recommended for API-based integrations.

Requirements:

• Valid JSON array of transaction objects
• UTF-8 encoding
• Consistent field names across records

Example:

[
  {
    "transaction_id": "TXN-001",
    "amount": 1000.0,
    "currency": "USD",
    "date": "2024-01-15",
    "reference": "Invoice payment"
  }
]

XML (extensible markup language)

Common in enterprise and banking integrations.

Requirements:

• Single root element
• UTF-8 encoding
• Consistent element structure

Example:

<?xml version="1.0" encoding="UTF-8"?>
<transactions>
 <transaction>
 <transaction_id>TXN-001</transaction_id>
 <amount>1000.00</amount>
 <currency>USD</currency>
 <date>2024-01-15</date>
 <reference>Invoice payment</reference>
 </transaction>
</transactions>

File size limits

Limit	Default	Configuration
Maximum upload file size	1 GiB	INGESTION_MAX_UPLOAD_BYTES at bootstrap or Systemplane at runtime (1 MiB to 8 GiB)
Maximum buffered request body	100 MiB	HTTP_BODY_LIMIT_BYTES (non-upload requests)

Network requirements

---

Inbound access

Matcher exposes a REST API that must be reachable by clients:

Port	Protocol	Purpose
4018	HTTP/HTTPS	API server (default :4018; serves HTTPS when TLS is configured)

Outbound access

Matcher must be able to reach the following services:

Service	Purpose	Required
PostgreSQL	Data persistence	Yes
Redis	Caching and coordination	Yes
RabbitMQ	Messaging	Yes
S3-compatible object storage	Exports and archival	When the export worker is enabled (enabled by default)
Auth service	Token validation	If authentication is enabled
JIRA	Exception routing	Optional
Custom webhooks	Event notifications	Optional

TLS configuration

For production environments, configure TLS:

SERVER_TLS_CERT_FILE=/path/to/cert.pem
SERVER_TLS_KEY_FILE=/path/to/key.pem

Environment checklist

---

Before proceeding with installation, confirm that:

• Infrastructure is ready: PostgreSQL, Redis, and RabbitMQ are running and accessible; S3-compatible object storage is also ready when the export worker is enabled (the default)
• Authentication is configured: Auth service is available, or auth is explicitly disabled
• Network access is validated: Required inbound and outbound connectivity is in place
• Credentials are available: Database credentials and API tokens are configured
• Sample data is prepared: Transaction files are ready for testing (see Quick Start)

Next steps

---

Installation

Deploy Matcher using Docker or Kubernetes.

Quick start

Run your first reconciliation.