---
pattern_id: PAT-005
title: "Finanzblick sync requires modal sequence — POST /sync is WAF-blocked"
category: integration
severity: medium
status: active
first_observed: 2026-07
last_updated: 2026-08-30
related_systems: []
related_solution_docs: []
related_skills: [finanzblick-cashflow]
---

# Finanzblick sync requires modal sequence — POST /sync is WAF-blocked

## Symptom

Programmatic synchronization with Finanzblick (banking data aggregator) fails when
calling the `POST /sync` API endpoint directly. The request is blocked by the WAF
(Web Application Firewall), returning 403 or connection reset.

Historical fetches (without sync) work fine with the `--no-sync` flag, avoiding 2FA.

## Root Cause

Finanzblick's WAF detects and blocks automated POST requests to the sync endpoint
that don't originate from the legitimate browser session with proper CSRF tokens
and session cookies.

## Mitigation

Sync must be performed via the **UI button + 2FA modal sequence**:
1. Navigate to the Finanzblick web interface in a browser
2. Click the sync button (UI-triggered, not API)
3. Handle the 2FA modal sequence in order:
   - PIN modal → click OK
   - AUTH modal → click WEITER
   - ERR modal → click OK
4. Wait for sync completion

For historical data fetches (no sync needed), use the `--no-sync` flag — this
bypasses 2FA entirely.

## Prevention

- Never attempt direct `POST /sync` calls — always use the UI flow
- The `finanzblick-cashflow` skill encodes this modal sequence
- This skill is USER-OWNED and needs `hermes curator adopt` to manage

## Evidence

- Observed during Finanzblick cashflow analysis sessions (Jul 2026)
- MEMORY.md entry: "FB sync=UI btn+2FA modals(PIN→OK,AUTH→WEITER,ERR→OK). POST /sync=WAF-blocked. --no-sync flag for hist.fetches(no 2FA). fb-cashflow skill=USER-OWNED,needs `hermes curator adopt`."