Alfa by Bank Alfalah — API integration & OpenFinance services

Account & relationship data

Full digital onboarding produces a complete customer object: KYC artefacts, CNIC validity windows, address, dormant-account state, linked products (current, savings, term deposit, FCY), and personalised recommendations. We expose these as a single /customer/profile resource with sub-collections for products, beneficiaries and standing instructions.

Transactions & statements

The "Digital Activity" feed covers Raast transfers, IBFT, card swipes, ATM withdrawals, bill payments, telco recharges and merchant QR scans. Each event carries a stable identifier, MCC-style category, channel tag and a downloadable receipt — enough to drive accounting reconciliation, expense management or risk scoring out of the box.

Cards & payments

Physical debit, virtual debit and credit cards can be activated, blocked, or scoped to specific channels (ATM, POS, e-commerce). Tap & Pay extends NFC payments straight from the phone, while QR pay covers 15,000+ Masterpass merchants — all of it observable through card-event APIs that mirror the in-app controls.

Investments, loans & FCY

Term deposits, mutual funds, PIBs, T-Bills and instant personal loans up to PKR 750,000 sit alongside foreign-currency current and savings accounts in USD, GBP, EUR and AED. We expose unified holdings, orders and conversion resources so a treasury or wealth dashboard can read them without bespoke parsers.

Authorization handshake

// Step 1 — exchange user authorization for an access token
POST /api/v1/alfa/auth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "AC_4f3a...e1",
  "client_id": "<CLIENT_ID>",
  "client_secret": "<CLIENT_SECRET>",
  "redirect_uri": "https://app.example.com/cb",
  "device_binding_id": "dev_9c1..."
}

// Response
{
  "access_token": "eyJhbGci...",
  "refresh_token": "rt_9af...",
  "expires_in": 1800,
  "scope": "accounts statements cards raast"
}

Statement query (multi-currency)

// Step 2 — pull a paged statement for a specific account
POST /api/v1/alfa/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "PK36ALFH0000000123456789",
  "currency": "PKR",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "channels":  ["RAAST", "IBFT", "CARD", "BILL"],
  "page": 1,
  "page_size": 100
}

// Response (excerpt)
{
  "items": [
    {
      "id": "txn_01HX2...",
      "amount": -12450.00,
      "currency": "PKR",
      "channel": "RAAST",
      "counterparty": { "alias": "0345...", "name": "F. Ahmed" },
      "category": "P2P_TRANSFER",
      "posted_at": "2026-03-14T08:21:11+05:00",
      "receipt_url": "https://api.example.com/receipts/01HX2....pdf"
    }
  ],
  "page": 1, "page_size": 100, "has_more": true
}

Raast payment initiation + webhook

// Step 3a — initiate a Raast P2P transfer
POST /api/v1/alfa/payments/raast
Idempotency-Key: ord_2026-04-28-77321
Authorization: Bearer <ACCESS_TOKEN>

{
  "from_account": "PK36ALFH0000000123456789",
  "to_alias":     "03001234567",
  "amount":       2500.00,
  "currency":     "PKR",
  "purpose":      "REFUND",
  "reference":    "ORD-77321"
}

// Step 3b — settlement webhook (HMAC-SHA256 signed)
POST https://merchant.example.com/webhooks/alfa
X-Alfa-Signature: t=1714291200,v1=8c7e...

{
  "event": "payment.settled",
  "payment_id": "pay_01HXR...",
  "status": "SETTLED",
  "settled_at": "2026-04-28T07:20:03Z",
  "raast_ref": "RAAST-2026-04-28-XXYY"
}

Error handling & retries

All endpoints return RFC 7807 problem-detail bodies with stable type URIs (insufficient_funds, raast_alias_not_found, device_binding_expired, kyc_review_required). Mutating calls require an Idempotency-Key header so client retries never produce duplicate transfers. We additionally back the integration with circuit breakers tuned to SBP cut-over windows and Raast maintenance announcements.

Deliverables checklist

• OpenAPI / Swagger 3.1 specification covering all in-scope endpoints
• Protocol & auth-flow report (OAuth 2.0, refresh, device binding, MFA)
• Runnable source for login, statement, Raast and card APIs (Python & Node.js)
• Postman collection plus signed-webhook verification samples
• Automated tests (contract + replay) and load-test results
• Compliance pack: SBP / Raast alignment, KYC, retention, consent receipts

Engagement workflow

1. Scope confirmation: target endpoints (statement, Raast, cards, loans, FCY).
2. Authorized protocol analysis & API design (2–5 business days).
3. Build & internal validation, including signed-webhook simulation (3–8 business days).
4. Documentation, samples, and full test pack (1–2 business days).
5. Typical first delivery in 5–15 business days; multi-region or merchant-side flows may extend timelines.

About our studio

We are an independent studio focused on App interface integration and authorized API integration, with deep experience in Pakistani and GCC fintech. The team includes engineers who have shipped payment systems, core-banking integrations, mobile-app protocol analysis, and cloud API gateways, and we know the practical realities of working alongside SBP, NPCI-style instant rails, and central-bank Open Banking sandboxes.

• Banking apps, e-wallets, brokerage, insurtech and cross-border remittance.
• Authorized protocol analysis with full audit trails.
• Custom Python / Node.js / Go SDKs and replayable test harnesses.
• End-to-end pipeline: scoping → reverse engineering → build → validation → compliance review.
• Source code delivery from $300 — receive runnable API source code and full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — access our hosted endpoints and pay only per call; ideal for teams that want usage-based pricing without upfront work.

Contact

Tell us your target app and the integration scope. We will reply with a fixed-price quote and a delivery timeline within one business day.

Open contact page

Common starting points: Alfa transaction export, Raast settlement webhook, multi-currency balance sync, virtual debit card lifecycle, or a unified API across Alfa + HBL + JazzCash.