Discovery

Use Discovery and Fetcher to detect external data sources, inspect their schemas, and pull transactions into Matcher automatically.

Discovery automates data source detection and extraction through Fetcher. Instead of manually uploading files, Discovery connects to external systems, identifies available data, and extracts transactions directly into Matcher.

What Discovery solves

---

Manual file uploads create friction at every step. Teams export files, transfer them, monitor for failures, and re-upload when something goes wrong. This process is time-consuming, error-prone, and breaks when data volume grows.

Discovery replaces the manual pipeline. It connects to external systems through Fetcher, detects available data sources automatically, and pulls transactions into Matcher on demand. When a new data source appears — a new bank connection, a new payment processor — Discovery finds it without reconfiguration.

How Discovery works

---

Discovery runs on Fetcher’s extraction engine, which Matcher hosts in-process; Fetcher is not a remote service. The embedded engine manages connections to external databases and runs extractions locally. Discovery exposes those connections and coordinates the extraction process, handing results directly to Ingestion.

The workflow has seven steps:

1. Check status — Confirm Discovery and its embedded engine are available.
2. Browse connections — See all data sources the embedded engine has access to.
3. Inspect a connection — Review the schema to understand what fields are available.
4. Test a connection — Validate the connection before committing to an extraction.
5. Create an extraction — Request that Matcher pull data from a specific source.
6. Monitor progress — Track extraction status as data flows in.
7. Refresh connections — Rescan when new data sources are added.

Discovery workflow

---

Check Discovery status

Verify that Discovery and the embedded Fetcher engine are operational before starting.

curl -X GET "https://api.matcher.example.com/v1/discovery/status" \
  -H "Authorization: Bearer $TOKEN"

API Reference: Get Discovery status

Browse connections

List all data sources available through the embedded Fetcher engine.

curl -X GET "https://api.matcher.example.com/v1/discovery/connections" \
  -H "Authorization: Bearer $TOKEN"

The response lists each connection with its name, type (database, API, file store), and current status.

API Reference: List connections

Get a connection

Retrieve a single discovered Fetcher connection by its internal identifier:

curl -X GET "https://api.matcher.example.com/v1/discovery/connections/{connectionId}" \
  -H "Authorization: Bearer $TOKEN"

GET /v1/discovery/connections/{connectionId} returns the full ConnectionResponse (name, type, status, and metadata) for one connection — useful when you already hold a connectionId (for example from a source binding’s query rail) and want its current details without listing every connection.

API Reference: Get discovery connection

Inspect a connection

Review the schema of a specific connection to understand what data fields are available before extracting.

curl -X GET "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/schema" \
  -H "Authorization: Bearer $TOKEN"

Use schema inspection to confirm that required fields — transaction IDs, amounts, dates, references — exist before building field mappings.

API Reference: Get connection schema

Test a connection

Validate that Matcher can reach and read from a connection before creating an extraction.

curl -X POST "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/test" \
  -H "Authorization: Bearer $TOKEN"

A successful test confirms connectivity and read access. Always test before creating an extraction — especially for new or recently modified connections.

API Reference: Test connection

Create an extraction

Request that Matcher pull transaction data from a specific connection into the current context.

curl -X POST "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/extractions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "tables": {
      "transactions": {}
    },
    "startDate": "2026-06-01",
    "endDate": "2026-06-30"
  }'

The response returns an extraction ID. Use it to monitor progress.

API Reference: Create extraction

Monitor extraction progress

Track the status of an active extraction by polling its status with GET.

curl -X GET "https://api.matcher.example.com/v1/discovery/extractions/{extractionId}" \
  -H "Authorization: Bearer $TOKEN"

Extraction status transitions from PENDING → SUBMITTED → EXTRACTING → COMPLETE (or FAILED/CANCELLED). The response carries the extraction status, an errorMessage when it failed, and the linked ingestionJobId once the extraction bridges into ingestion.

API Reference: Get extraction

Refresh available connections

When new data sources are registered with the embedded engine, trigger a refresh so Discovery picks them up.

curl -X POST "https://api.matcher.example.com/v1/discovery/refresh" \
  -H "Authorization: Bearer $TOKEN"

API Reference: Refresh connections

List connector types

List the connector (datasource) types the engine registry has registered for this deployment. Each entry carries a backend-derived category (database or rest). The registry is live—only connectors registered at boot appear. Aggregator vendors (Pluggy/Belvo) are excluded; provision those through the aggregator-connections surface below.

curl -X GET "https://api.matcher.example.com/v1/discovery/connector-types" \
  -H "Authorization: Bearer $TOKEN"

Response

{
  "types": [
    { "type": "POSTGRESQL", "category": "database" },
    { "type": "MYSQL", "category": "database" }
  ]
}

Aggregator connections (Open Finance)

---

Open-Finance data-aggregator connections (Pluggy or Belvo) let Matcher pull transactions from bank aggregators. Credential material (clientId/secret) is sealed on write and never returned—every read is secret-free by construction.

Create an aggregator connection

curl -X POST "https://api.matcher.example.com/v1/discovery/aggregator-connections" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "configName": "pluggy-main",
    "baseUrl": "https://api.pluggy.ai",
    "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
    "clientId": "...",
    "secret": "..."
  }'

All six fields are required. vendor is one of pluggy or belvo. configName is the tenant-scoped name the webhook token-mint endpoint binds to. Returns 201 with a secret-free connection.

Response

{
  "vendor": "pluggy",
  "configName": "pluggy-main",
  "baseUrl": "https://api.pluggy.ai",
  "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab"
}

List, get, update, and delete

# List (cursor-paginated, secret-free)
curl -X GET "https://api.matcher.example.com/v1/discovery/aggregator-connections" \
  -H "Authorization: Bearer $TOKEN"

# Get one by id
curl -X GET "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN"

# Update (PUT). vendor is immutable. Supply clientId+secret together to rotate
# the sealed credential, or omit both to keep the stored secret intact.
curl -X PUT "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "configName": "pluggy-main",
    "baseUrl": "https://api.pluggy.ai",
    "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab"
  }'

# Delete (soft-delete; frees the config name for reuse). Returns 204.
curl -X DELETE "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN"

Test an aggregator connection

Run a live connectivity check against an existing connection’s already-sealed credential, addressed by (vendor, configName). No credential is supplied or returned—the result is a secret-free boolean health.

curl -X POST "https://api.matcher.example.com/v1/discovery/aggregator-connections/test" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "configName": "pluggy-main"
  }'

Response

{
  "vendor": "pluggy",
  "configName": "pluggy-main",
  "healthy": true
}

Aggregator webhook tokens

---

Aggregators push data change signals to Matcher via webhooks. Mint an opaque token bound to an aggregator connection, then configure the returned URL in the vendor dashboard.

Mint a webhook token

The raw token and its provider-facing URL are returned exactly once—only the token’s SHA-256 hash is stored.

curl -X POST "https://api.matcher.example.com/v1/discovery/webhooks/tokens" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "connection_config_name": "pluggy-main"
  }'

Response

{
  "vendor": "pluggy",
  "token": "<raw-token-shown-once>",
  "webhook_url": "https://api.matcher.example.com/v1/discovery/webhooks/pluggy/<raw-token>"
}

Receiving webhooks

The vendor calls POST /v1/discovery/webhooks/{provider}/{webhookToken} (no operator JWT). It is authenticated by the opaque path token plus a per-provider source check: a valid HMAC-SHA256 of the raw body in the X-Webhook-Signature header, or membership in the provider’s source-IP allowlist. Both layers fail closed. A valid first delivery returns 202 Accepted and the signaled data is pulled asynchronously into the ingestion pipeline; a replay of an already-processed event returns 200 OK.

Best practices

---

Always test connections before extracting

A failed extraction mid-run is harder to recover from than a failed test. Test every connection before creating an extraction — especially when connecting to a new source or after a credential rotation.

Inspect schemas before mapping fields

Field names vary across systems. A bank might call the transaction date value_date while your ledger uses posting_date. Check the schema before configuring field mappings to avoid silent mismatches.

Monitor extractions actively for large datasets

Large extractions take time. Don’t assume completion — poll the extraction status and confirm the record count before starting a match run. Starting a run on incomplete data generates incorrect exceptions.

Refresh connections when sources change

Discovery doesn’t scan for new connections automatically. When a new payment processor is added or a new database is registered with the embedded engine, trigger a refresh. Otherwise, Discovery won’t show the new source.

Scope extractions to the reconciliation period

Use date range parameters to extract only the data relevant to the current reconciliation period. Extracting unbounded data increases processing time and may pull records that belong to already-closed contexts.

Next steps

---

External sources

Configure the external data sources that Discovery connects to.

Field mapping

Map fields from extracted data to Matcher’s transaction model.

Discovery API reference

Full API reference for Discovery endpoints.