Alliance Pay API integration services (HUMO / UZCARD / OpenBanking)

Deliverables checklist

• OpenAPI 3.1 specification covering login, statements, transfers, and webhooks
• Protocol and auth flow report (token chain, device binding, certificate pinning notes)
• Runnable source in Python and Node.js for statement export and HUMO P2P
• Postman collection plus automated pytest / Jest integration tests
• Compliance pack: ZRU-547 data-minimization checklist, consent-capture template, retention policy

API example: Alliance Pay statement query

// Fetch Alliance Pay card statement (pseudocode)
POST /api/v1/alliance-pay/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>
X-Device-Id: <DEVICE_FINGERPRINT>

{
  "account_id": "UZ34AABK00000000012345",
  "card_network": "HUMO",
  "from_date": "2026-03-01",
  "to_date": "2026-03-31",
  "page": 1,
  "page_size": 100
}

Response (200):
{
  "account_id": "UZ34AABK00000000012345",
  "currency": "UZS",
  "opening_balance": 4520000,
  "closing_balance": 4105750,
  "transactions": [
    { "ts": "2026-03-04T09:12:11Z",
      "amount": -125000,
      "merchant": "Uzbektelecom",
      "category": "utility",
      "cashback": 1250 }
  ],
  "page": 1, "has_more": true
}

Key integration scenarios

Corporate accounting sync (UZS and USD movements into ERP), loyalty analytics over the 1% utility cashback stream, merchant-side reconciliation for HumoPay tap-to-pay, SWIFT compliance audit trails, and unified dashboards that combine Alliance Pay with other Uzbek wallets for treasury teams.

1. SME accounting sync

An SME using a local accounting suite needs its Alliance Pay card and UZS settlement movements posted automatically. The flow: daily statement pull via /statement, normalization into IFRS-style journal lines, and delivery into the ERP. Maps to classic OpenBanking AISP patterns, scoped to authorized consent.

2. HUMO-to-HUMO disbursement for marketplaces

A local marketplace pays sellers by pushing HUMO-to-HUMO transfers. We wrap the Alliance Pay transfer endpoint with an idempotent /disbursement call, queue retries on network timeouts, and publish a webhook per settlement event for the merchant's ledger.

3. SWIFT outbound with compliance trail

An exporter uses SWIFT to pay overseas suppliers. Integration covers the pre-screen AML fields (beneficiary, purpose, ISO 20022 remittance code), the actual /swift/transfer call, and a reconciliation webhook that matches MT103 references back to the internal invoice number.

4. Utility & "My Home" household analytics

A consumer-finance app ingests the household's utility history through the Alliance Pay provider catalogue and "My Home" data model. Monthly rollups feed a budgeting UI and trigger anomaly alerts when a utility line jumps beyond seasonal baselines; cashback events are tagged separately.

5. Deposit & loan portfolio for wealth tools

A wealth dashboard ingests deposit positions (principal, rate, maturity) and loan amortisation schedules from Alliance Pay, joining them with accounts held elsewhere to produce a single net-worth view. Each data refresh is consent-bound and time-boxed to the user's active authorization.

Authorization & session flow

// Step 1: init session (pseudocode)
POST /api/v1/alliance-pay/session/init
{
  "phone": "+998XXXXXXXXX",
  "device_id": "ab12-cf9e-77",
  "app_version": "3.8.1"
}
=> { "session_id": "...", "challenge": "otp_sms" }

// Step 2: verify OTP and bind consent
POST /api/v1/alliance-pay/session/verify
{
  "session_id": "...",
  "otp": "483920",
  "scopes": ["statement:read","transfer:humo","deposit:read"],
  "consent_ttl_days": 90
}
=> { "access_token": "...", "refresh_token": "...",
     "expires_in": 1800 }

HUMO P2P transfer request

POST /api/v1/alliance-pay/transfer/humo
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: 2026-04-23-tx-00017

{
  "from_card": "9860xxxxxxxx1234",
  "to_card":   "9860xxxxxxxx9876",
  "amount":    350000,
  "currency":  "UZS",
  "purpose":   "salary_advance",
  "client_ref":"payroll-Q2-00017"
}

=> 202 Accepted
{
  "transfer_id": "trf_9f3b2c",
  "status": "pending",
  "fee": 0,
  "network": "HUMO"
}

Webhook: transaction event

// Delivered to your /webhooks/alliance-pay
POST /webhooks/alliance-pay
X-Signature: sha256=...

{
  "event": "transaction.posted",
  "account_id": "UZ34AABK00000000012345",
  "tx": {
    "id": "tx_88201",
    "ts": "2026-04-23T12:04:55Z",
    "amount": -42000,
    "currency": "UZS",
    "channel": "HumoPay",
    "merchant": "Korzinka Supermarket"
  }
}

// Error handling: retry with exponential backoff (1s, 4s, 16s, 64s)
// 401 => refresh token; 409 => idempotency conflict, drop duplicate.

About us

We are an independent technical studio specialised in OpenBanking, OpenData, and authorized protocol analysis. Our engineers have shipped API layers for retail banks, payment processors, and cross-border remittance providers across CIS, South Asia, and Southeast Asia, including HUMO and UZCARD-adjacent work.

• Retail banking, e-wallets, card schemes, and cross-border settlement
• Protocol analysis with a strict authorized-use posture
• Custom SDKs in Python, Node.js, Go, and Kotlin for mobile-side integration
• Compliance alignment with Uzbek ZRU-547, CBU guidance, and scheme rules
• Source code delivery from $300 — runnable API source plus documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — call our hosted Alliance Pay endpoints and pay only per successful request, no upfront commitment

Contact

Share the target app, the data scopes you need, and any existing sandbox credentials. We reply within one business day.

Contact page

Engagement workflow

1. Scope confirmation — which Alliance Pay scopes (statement, transfer, deposit, SWIFT) and which regions.
2. Protocol analysis and API design (3–6 business days).
3. Implementation and internal validation against mock and sandbox traffic (4–9 business days).
4. Documentation, Postman collection, and test harness (1–2 business days).
5. Typical first drop: 7–15 business days; regulated reviews may extend this.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance?

Do you cover both Android and iOS?