> ## Documentation Index
> Fetch the complete documentation index at: https://holder.docs.fiskil.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Resource Server

> Responsibilities, contracts, and implementation guidance for a compliant Resource Server.

The Resource Server is your application's data API — responsible for exposing customer data after a user has given consent.

Fiskil handles authorization, token issuance, and consent orchestration. During the consent process and once a user has approved access, Fiskil calls your Resource Server with a JWT. Your job is to validate that token and return the right data.

***

## How It Works

The diagram below illustrates the complete Resource Server integration flow:

```mermaid theme={null}
sequenceDiagram
    participant User as End User
    participant DR as Data Recipient
    participant DP as Fiskil Data Provider
    participant RS as Your Resource Server
    participant DB as Your Database

    User->>DR: Initiate data request
    DR->>DP: Request consent authorization
    DP->>User: Present consent screen
    User->>DP: Approve data sharing

    Note over DP: Generate JWT token<br/>based on approved permissions

    DP->>RS: API request with JWT
    RS->>RS: Validate JWT signature & claims
    RS->>RS: Check token vs endpoint requirements

    alt Valid token & sufficient
        RS->>DB: Query customer data
        DB-->>RS: Return requested data
        RS-->>DP: Return data (JSON)
        DP-->>DR: Forward data to recipient
        DR-->>User: Present data in application
    else Invalid token
        RS-->>DP: Return 401/403 error
        DP-->>DR: Return error response
        DR-->>User: Display error message
    end
```

## Example Data Endpoint

At least one endpoint that exposes real data is required to test and go live. The API must start with `/customer/{customerId}` so we fetch data for the customer who has granted the consent.

### `GET /customer/{customerId}/accounts/{id}/balances`

Returns the account balance.

**Example response:**

```json theme={null}
{
  "account_id": "acc_001",
  "available": 1200.50,
  "current": 1250.75,
  "currency": "AUD"
}
```

You can return mock data during the initial testing phase.

***

## Next Steps

* [Implement Authentication & Authorization APIs](/docs/build/end-user-authentication)
* [Set up your JWT validation](/docs/build/jwt-security)
* [Register your Resource Server in the Console](/docs/get-started/instances)
* [Review the go-live checklist](/docs/go-live)