> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Discovery

> Use Discovery and Fetcher to detect external data sources, inspect their schemas, and pull transactions into Matcher automatically.

Discovery automates data source detection and extraction through Fetcher. Instead of manually uploading files, Discovery connects to external systems, identifies available data, and extracts transactions directly into Matcher.

## What Discovery solves

***

Manual file uploads create friction at every step. Teams export files, transfer them, monitor for failures, and re-upload when something goes wrong. This process is time-consuming, error-prone, and breaks when data volume grows.

Discovery replaces the manual pipeline. It connects to external systems through Fetcher, detects available data sources automatically, and pulls transactions into Matcher on demand. When a new data source appears — a new bank connection, a new payment processor — Discovery finds it without reconfiguration.

## How Discovery works

***

Discovery runs on Fetcher's extraction engine, which Matcher hosts in-process; Fetcher is not a remote service. The embedded engine manages connections to external databases and runs extractions locally. Discovery exposes those connections and coordinates the extraction process, handing results directly to Ingestion.

The workflow has seven steps:

1. **Check status** — Confirm Discovery and its embedded engine are available.
2. **Browse connections** — See all data sources the embedded engine has access to.
3. **Inspect a connection** — Review the schema to understand what fields are available.
4. **Test a connection** — Validate the connection before committing to an extraction.
5. **Create an extraction** — Request that Matcher pull data from a specific source.
6. **Monitor progress** — Track extraction status as data flows in.
7. **Refresh connections** — Rescan when new data sources are added.

## Discovery workflow

***

### Check Discovery status

Verify that Discovery and the embedded Fetcher engine are operational before starting.

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/status" \
  -H "Authorization: Bearer $TOKEN"
```

<Tip>
  API Reference: [Get Discovery status](/en/reference/matcher/discovery-status)
</Tip>

### Browse connections

List all data sources available through the embedded Fetcher engine.

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/connections" \
  -H "Authorization: Bearer $TOKEN"
```

The response lists each connection with its name, type (database, API, file store), and current status.

<Tip>
  API Reference: [List connections](/en/reference/matcher/list-discovery-connections)
</Tip>

### Get a connection

Retrieve a single discovered Fetcher connection by its internal identifier:

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/connections/{connectionId}" \
  -H "Authorization: Bearer $TOKEN"
```

`GET /v1/discovery/connections/{connectionId}` returns the full `ConnectionResponse` (name, type, status, and metadata) for one connection — useful when you already hold a `connectionId` (for example from a source binding's query rail) and want its current details without listing every connection.

<Tip>
  API Reference: [Get discovery connection](/en/reference/matcher/retrieve-discovery-connection)
</Tip>

### Inspect a connection

Review the schema of a specific connection to understand what data fields are available before extracting.

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/schema" \
  -H "Authorization: Bearer $TOKEN"
```

Use schema inspection to confirm that required fields — transaction IDs, amounts, dates, references — exist before building field mappings.

<Tip>
  API Reference: [Get connection schema](/en/reference/matcher/get-connection-schema)
</Tip>

### Test a connection

Validate that Matcher can reach and read from a connection before creating an extraction.

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/test" \
  -H "Authorization: Bearer $TOKEN"
```

A successful test confirms connectivity and read access. Always test before creating an extraction — especially for new or recently modified connections.

<Tip>
  API Reference: [Test connection](/en/reference/matcher/test-discovery-connection)
</Tip>

### Create an extraction

Request that Matcher pull transaction data from a specific connection into the current context.

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/connections/{connectionId}/extractions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "tables": {
      "transactions": {}
    },
    "startDate": "2026-06-01",
    "endDate": "2026-06-30"
  }'
```

The response returns an extraction ID. Use it to monitor progress.

<Tip>
  API Reference: [Create extraction](/en/reference/matcher/create-extraction)
</Tip>

### Monitor extraction progress

Track the status of an active extraction by polling its status with `GET`.

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/extractions/{extractionId}" \
  -H "Authorization: Bearer $TOKEN"
```

Extraction status transitions from `PENDING` → `SUBMITTED` → `EXTRACTING` → `COMPLETE` (or `FAILED`/`CANCELLED`). The response carries the extraction `status`, an `errorMessage` when it failed, and the linked `ingestionJobId` once the extraction bridges into ingestion.

<Tip>
  API Reference: [Get extraction](/en/reference/matcher/retrieve-extraction)
</Tip>

### Refresh available connections

When new data sources are registered with the embedded engine, trigger a refresh so Discovery picks them up.

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/refresh" \
  -H "Authorization: Bearer $TOKEN"
```

<Tip>
  API Reference: [Refresh connections](/en/reference/matcher/refresh-discovery)
</Tip>

### List connector types

List the connector (datasource) types the engine registry has registered for this deployment. Each entry carries a backend-derived `category` (`database` or `rest`). The registry is live—only connectors registered at boot appear. Aggregator vendors (Pluggy/Belvo) are excluded; provision those through the aggregator-connections surface below.

```bash theme={null}
curl -X GET "https://api.matcher.example.com/v1/discovery/connector-types" \
  -H "Authorization: Bearer $TOKEN"
```

#### Response

```json theme={null}
{
  "types": [
    { "type": "POSTGRESQL", "category": "database" },
    { "type": "MYSQL", "category": "database" }
  ]
}
```

## Aggregator connections (Open Finance)

***

Open-Finance data-aggregator connections (Pluggy or Belvo) let Matcher pull transactions from bank aggregators. Credential material (`clientId`/`secret`) is **sealed on write and never returned**—every read is secret-free by construction.

### Create an aggregator connection

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/aggregator-connections" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "configName": "pluggy-main",
    "baseUrl": "https://api.pluggy.ai",
    "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
    "clientId": "...",
    "secret": "..."
  }'
```

All six fields are required. `vendor` is one of `pluggy` or `belvo`. `configName` is the tenant-scoped name the webhook token-mint endpoint binds to. Returns **201** with a secret-free connection.

#### Response

```json theme={null}
{
  "vendor": "pluggy",
  "configName": "pluggy-main",
  "baseUrl": "https://api.pluggy.ai",
  "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab"
}
```

### List, get, update, and delete

```bash theme={null}
# List (cursor-paginated, secret-free)
curl -X GET "https://api.matcher.example.com/v1/discovery/aggregator-connections" \
  -H "Authorization: Bearer $TOKEN"

# Get one by id
curl -X GET "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN"

# Update (PUT). vendor is immutable. Supply clientId+secret together to rotate
# the sealed credential, or omit both to keep the stored secret intact.
curl -X PUT "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "configName": "pluggy-main",
    "baseUrl": "https://api.pluggy.ai",
    "accountRef": "a1b2c3d4-5678-90ab-cdef-1234567890ab"
  }'

# Delete (soft-delete; frees the config name for reuse). Returns 204.
curl -X DELETE "https://api.matcher.example.com/v1/discovery/aggregator-connections/{id}" \
  -H "Authorization: Bearer $TOKEN"
```

### Test an aggregator connection

Run a live connectivity check against an existing connection's already-sealed credential, addressed by `(vendor, configName)`. No credential is supplied or returned—the result is a secret-free boolean health.

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/aggregator-connections/test" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "configName": "pluggy-main"
  }'
```

#### Response

```json theme={null}
{
  "vendor": "pluggy",
  "configName": "pluggy-main",
  "healthy": true
}
```

## Aggregator webhook tokens

***

Aggregators push data change signals to Matcher via webhooks. Mint an opaque token bound to an aggregator connection, then configure the returned URL in the vendor dashboard.

### Mint a webhook token

The raw token and its provider-facing URL are returned **exactly once**—only the token's SHA-256 hash is stored.

```bash theme={null}
curl -X POST "https://api.matcher.example.com/v1/discovery/webhooks/tokens" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vendor": "pluggy",
    "connection_config_name": "pluggy-main"
  }'
```

#### Response

```json theme={null}
{
  "vendor": "pluggy",
  "token": "<raw-token-shown-once>",
  "webhook_url": "https://api.matcher.example.com/v1/discovery/webhooks/pluggy/<raw-token>"
}
```

### Receiving webhooks

The vendor calls `POST /v1/discovery/webhooks/{provider}/{webhookToken}` (no operator JWT). It is authenticated by the opaque path token **plus** a per-provider source check: a valid HMAC-SHA256 of the raw body in the `X-Webhook-Signature` header, **or** membership in the provider's source-IP allowlist. Both layers fail closed. A valid first delivery returns **202 Accepted** and the signaled data is pulled asynchronously into the ingestion pipeline; a replay of an already-processed event returns **200 OK**.

## Best practices

***

<AccordionGroup>
  <Accordion title="Always test connections before extracting">
    A failed extraction mid-run is harder to recover from than a failed test. Test every connection before creating an extraction — especially when connecting to a new source or after a credential rotation.
  </Accordion>

  <Accordion title="Inspect schemas before mapping fields">
    Field names vary across systems. A bank might call the transaction date `value_date` while your ledger uses `posting_date`. Check the schema before configuring field mappings to avoid silent mismatches.
  </Accordion>

  <Accordion title="Monitor extractions actively for large datasets">
    Large extractions take time. Don't assume completion — poll the extraction status and confirm the record count before starting a match run. Starting a run on incomplete data generates incorrect exceptions.
  </Accordion>

  <Accordion title="Refresh connections when sources change">
    Discovery doesn't scan for new connections automatically. When a new payment processor is added or a new database is registered with the embedded engine, trigger a refresh. Otherwise, Discovery won't show the new source.
  </Accordion>

  <Accordion title="Scope extractions to the reconciliation period">
    Use date range parameters to extract only the data relevant to the current reconciliation period. Extracting unbounded data increases processing time and may pull records that belong to already-closed contexts.
  </Accordion>
</AccordionGroup>

## Next steps

***

<Card title="External sources" icon="building-columns" href="/en/matcher/integrations/matcher-external-sources" horizontal>
  Configure the external data sources that Discovery connects to.
</Card>

<Card title="Field mapping" icon="arrows-left-right" href="/en/matcher/configuration/matcher-field-mapping" horizontal>
  Map fields from extracted data to Matcher's transaction model.
</Card>

<Card title="Discovery API reference" icon="code" href="/en/reference/matcher/discovery-status" horizontal>
  Full API reference for Discovery endpoints.
</Card>