Sulfah (سلفة) API integration & OpenBanking data services

Why Sulfah data is worth integrating

Sulfah was one of the first companies admitted to the Saudi Central Bank (SAMA) regulatory sandbox for consumable micro-lending, and it is repeatedly cited as a key player in the Kingdom's fintech lending landscape — including in the Saudi Arabia Fintech Market 2024–2029 research that lists it alongside Lendo, SURE and Foodics. Because every financing journey runs through the app and a regulated backend, the data is consistent and machine-readable: amounts, tenures, APRs, fee breakdowns, installment calendars, and contract acceptance timestamps.

For a borrower-side or partner-side integrator, that means a Sulfah API integration can replace manual screenshotting and PDF downloads with a clean feed of obligations and payments. Accounting teams get liability schedules; risk and treasury teams get exposure and DBR (debt-burden ratio) inputs; compliance teams get an immutable record of the APR disclosure and contract acceptance that SAMA's Responsible Lending Principles require lenders to keep.

The wider context matters too. Saudi Arabia launched its Open Banking Framework in November 2022, added the "View My Bank Accounts" service in May 2024, issued a major Payment Initiation Services (PIS) update in September 2024, and in 2026 moved open banking from the sandbox into a formal licensing regime. Designing a Sulfah integration in that idiom — consent-driven, FAPI-style security, account-information and payment-initiation patterns — keeps it forward-compatible with the Kingdom's OpenFinance direction under Vision 2030's Financial Sector Development Program.

What we deliver

Data available for integration (OpenData perspective)

The table below maps the data a Sulfah integration can expose to the screen or feature it originates from, its granularity, and a typical downstream use. Field names are illustrative; exact shapes are confirmed during protocol analysis.

Typical integration scenarios

Technical implementation

Below are illustrative request/response snippets showing the auth handshake, a statement-style read, and a webhook payload. Endpoint names are placeholders; the protocol report delivered with the project documents the real paths, headers and signing scheme.

POST /api/v1/sulfah/auth/login
Content-Type: application/json

{
  "msisdn": "+9665XXXXXXXX",
  "otp": "482913",
  "device_id": "a1b2c3d4"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_9f2c...",
  "expires_in": 3600,
  "user_id": "usr_18347"
}

GET /api/v1/sulfah/loans/LN-20251130/schedule
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "loan_id": "LN-20251130",
  "principal": 20000.00,
  "currency": "SAR",
  "tenure_months": 18,
  "apr": 75.32,
  "processing_fee": 200.00,
  "vat_on_fee": 30.00,
  "total_repayment": 29990.00,
  "installments": [
    {"no": 1, "due_date": "2026-01-01", "amount": 1666.11, "status": "paid"},
    {"no": 2, "due_date": "2026-02-01", "amount": 1666.11, "status": "due"}
  ]
}

POST https://your-app.example/webhooks/sulfah
X-Sulfah-Signature: sha256=7b1d...
Content-Type: application/json

{
  "event": "payment.received",
  "loan_id": "LN-20251130",
  "installment_no": 1,
  "amount": 1666.11,
  "paid_at": "2026-01-01T08:12:44Z"
}

// Respond 2xx within 5s, otherwise the event is retried
// with exponential backoff (verify the HMAC before processing)

GET /api/v1/sulfah/loans?status=active&page=2&page_size=50
Authorization: Bearer <ACCESS_TOKEN>

401 { "error": "token_expired", "hint": "refresh and retry" }
429 { "error": "rate_limited", "retry_after": 30 }
200 {
  "page": 2, "page_size": 50, "total": 73,
  "items": [ /* ... */ ]
}

Data flow / architecture

A minimal pipeline looks like this: Sulfah app / authorized API → Ingestion service (token management, retries, HMAC verification) → Normalized storage (loans, installments, payments, documents tables) → Output layer (your REST API, scheduled Excel/CSV exports, or a BI/warehouse sync). Webhooks feed the ingestion service for near-real-time events; a nightly reconciliation job back-fills anything missed.

Compliance & privacy

Sulfah operates under the supervision of the Saudi Central Bank (SAMA), which permitted it as a fintech startup for consumable micro-lending. Any integration we build is scoped to data the user is entitled to and is delivered with guidance on the controls that apply in the Kingdom:

• SAMA Open Banking Framework — we follow its consent model and FAPI-aligned security profile (mutual TLS, signed requests, scoped access tokens) so the integration matches the direction SAMA set in 2022–2026.
• Responsible Lending Principles for Individual Customers — the APR ceiling (max 89.59% for Sulfah products), affordability/DBR checks, and disclosure-before-contract requirements are reflected in how application and contract data are surfaced and retained.
• Regulations for Consumer Financing — fee, profit and total-cost fields are exposed exactly as disclosed, never re-derived.
• SIMAH (Saudi Credit Bureau) — record-keeping and identifiers are kept compatible with credit-reporting expectations.
• Saudi Personal Data Protection Law (PDPL) — data minimization, purpose limitation, consent logging, encryption at rest/in transit, and a defined retention window.

We work only under customer authorization or with documented, authorized APIs; we do not bypass security controls, and we will sign an NDA and a data-processing agreement where required.

Market positioning & user profile

Sulfah is a B2C consumer-lending product focused on Saudi Arabia, serving salaried residents and expatriates who need small, short-term financing (SAR 1,000–25,000, 3–18 months) faster than a traditional bank branch — the app's AI/ML underwriting targets disbursement to the customer's bank account within minutes. Its users skew mobile-first on Android and iOS, and the company is positioned within the Kingdom's Shariah-compliant micro-finance segment alongside the Vision 2030 fintech push. Integrators on this page are typically accounting/ERP vendors, PFM and budgeting apps, employer financial-wellness programs, and risk/compliance teams that need a programmatic feed of borrower obligations rather than manual statements.

Screenshots

App screenshots from the Google Play listing. Click any thumbnail to enlarge.

Similar apps & integration landscape

Teams that integrate Sulfah data often work across several Saudi consumer-finance apps at once. The names below are part of the broader ecosystem we routinely see referenced; listing them here helps anyone researching these products find a consistent approach to data integration. We do not rank or critique them.

• Quara Finance — Shariah-compliant personal financing app offering larger limits and multi-year tenures; users frequently want a unified obligation export across Quara and Sulfah.
• Tamam Finance — fully digital micro-finance focused on financial inclusion; holds application, contract and installment data similar in shape to Sulfah's.
• Tasheel Finance — consumer financing through electronic channels; statement and repayment-schedule sync is the common integration request.
• Nayifat (Nayifat Instalment) — long-standing instalment finance provider; account login and loan-status reads map cleanly to the same connector model.
• Emkan Finance — digital consumer lending and BNPL; disbursement and installment events are typical webhook targets.
• Madfu — buy-now-pay-later app; order-level repayment schedules are the equivalent of Sulfah's installment ledger for reconciliation.
• Arib — personal financing with flexible tenures; users consolidating obligations want APR and remaining-balance fields normalized alongside Sulfah's.
• Alraedah Finance — SME and consumer financing; contract-document export and audit archiving overlap with the compliance scenario above.
• Lendo — invoice-financing and crowdlending platform cited alongside Sulfah in Saudi fintech market reports; relevant when a partner aggregates multiple credit products.
• Tabby — widely used BNPL across the GCC; transaction and installment exports complement Sulfah's data for a full short-term-credit picture.