Secure GraphQL Banking API Integration

I need a production-ready, security-hardened GraphQL API that sits between our core banking platform and selected third-party payment service providers. The service will run on Apache Camel so that routing, orchestration, retry logic, and auditing are handled consistently. Message payloads coming from the core system are XML; I will rely on XSLT transformations inside the Camel routes to map them into the JSON structures required by the GraphQL layer and vice-versa.

The API must expose the following capabilities to the external payment partners:

• Query current and historical account balances and transactions
• Initiate single and bulk payments, including internal transfers
• Push real-time payment-status notifications back to the partner system
• Check and update customer card status (active, blocked, expired)

All endpoints need OAuth 2.0 / JWT authentication, field-level encryption where sensitive data leaves our network, and detailed audit logging compatible with our existing ELK stack. Unit tests, Postman (or similar) collections, and concise deployment notes for a Kubernetes target environment will be part of the hand-over.

I will supply sample XML schemas from the core banking system and the required JSON contracts for each partner. Code should be delivered in a private Git repository with clear commit history.