Credit Sesame API integration (3-bureau / OpenFinance)

Deliverables checklist

• OpenAPI 3.1 specification covering login, scores, alerts, offers, simulator and rent-reporting
• Protocol & auth flow report (OAuth bearer + device-bound session refresh)
• Runnable Python (FastAPI) and Node.js (Express) reference clients
• Postman / Insomnia collection with seeded fixtures and a sandbox account walkthrough
• Test harness covering happy path, expired-token retry, and step-up authentication
• Compliance pack: FCRA, GLBA and CFPB §1033 mapping, plus consent-logging schema

Subscription tier coverage

Credit Sesame currently offers a free tier plus paid plans Extra ($9.99/mo), Plus 1-bureau ($12.99/mo), Plus 3-bureau ($24.99/mo) and Platinum ($19.99/mo). Our integration toolkit detects the active tier from the user session and gracefully degrades responses (single-bureau vs. tri-bureau, simulator vs. no simulator) so your downstream services do not break when a member changes plan.

1. Lender pre-qualification widget

A digital lender embeds a "Check rate" widget. The widget calls our /scores/latest and /offers/prequalified endpoints with the consumer's authorised Credit Sesame token, scores the file against internal underwriting policy, and returns indicative pricing without firing a hard pull. This mirrors the Credit Offers API approach Capital One implemented with Credit Sesame in roughly six weeks of build time, and maps cleanly onto OpenBanking-style consent grants.

2. Personal-finance dashboard sync

A PFM app pulls daily score history and the tradeline list, joins them with bank transactions from a separate aggregator, and renders a single net-worth + credit-health view. The data flow is: POST /auth/login → GET /reports/tradelines?bureau=tu → GET /scores/history?from=2026-01-01, all paginated and idempotent.

3. Identity-protection SOC alerting

A security operations team subscribes to the credit_alerts webhook so that any new tradeline or address change is correlated with internal SIEM events. Each alert payload includes event_type, bureau, severity and a deep-link back to the Credit Sesame dispute flow, enabling one-click consumer-driven freezes.

4. Rent-to-credit thin-file underwriting

A property-tech platform queries /premium/rent-reporting/status to confirm that a renter is actively reporting rent payments to the bureaus. Combined with the simulator endpoint, the platform shows tenants a projected score uplift after twelve months of on-time rent — a powerful retention message that also feeds the landlord's risk model.

5. CRM journey orchestration

A neobank ingests Sesame Grade weekly snapshots into its CRM. When a member moves from "C" to "B", a templated email and an in-app card-upgrade offer are triggered. The same pipeline detects regressions (B → C) and routes the member to free credit-coaching content, increasing engagement without manual segmentation.

Authentication (OAuth bearer + device session)

POST /api/v1/credit-sesame/auth/login
Content-Type: application/json

{
  "username": "user@example.com",
  "password": "<encrypted>",
  "device_id": "ios-9F3...A2",
  "consent_id": "csm-consent-2026-05-04-001"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rft_8a91...",
  "expires_in": 1800,
  "tier": "premium_3b",
  "scopes": ["scores.read","reports.read","alerts.subscribe","offers.read"]
}

3-bureau score & Sesame Grade pull

GET /api/v1/credit-sesame/scores/latest?bureaus=tu,eq,ex
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "as_of": "2026-05-04T08:12:33Z",
  "scores": [
    {"bureau":"transunion","model":"VantageScore 3.0","value":712,"delta_30d":+8},
    {"bureau":"equifax",  "model":"VantageScore 3.0","value":705,"delta_30d":+5},
    {"bureau":"experian", "model":"VantageScore 3.0","value":718,"delta_30d":+11}
  ],
  "sesame_grade": {
    "letter": "B",
    "factors": {
      "payment_history":"A","credit_usage":"C",
      "credit_age":"B","account_mix":"B","inquiries":"A"
    }
  }
}

Credit alerts webhook (server-to-server)

POST https://your-app.example/webhooks/credit-alerts
X-Sesame-Signature: t=1714809600,v1=9f8c...
Content-Type: application/json

{
  "event_id": "evt_01HZRT6X...",
  "event_type": "new_tradeline",
  "bureau": "transunion",
  "severity": "info",
  "consumer_id": "csm_user_88142",
  "payload": {
    "creditor": "Chase Sapphire",
    "balance": 0,
    "limit": 12000,
    "opened_on": "2026-05-02"
  },
  "occurred_at": "2026-05-04T07:55:11Z"
}

Score Simulator (Premium)

POST /api/v1/credit-sesame/simulator/run
Authorization: Bearer <ACCESS_TOKEN>

{
  "scenarios": [
    {"action":"pay_down_card","card_id":"tl_551","amount":2500},
    {"action":"open_card","limit":8000,"utilization_pct":3}
  ]
}

200 OK
{
  "baseline": 712,
  "projected": [
    {"action":"pay_down_card","value":731,"delta":+19},
    {"action":"open_card","value":707,"delta":-5}
  ],
  "horizon_days": 60
}

Compliance & privacy

Credit data is highly regulated in the United States. We ship every Credit Sesame integration mapped to the Fair Credit Reporting Act (FCRA) and the CFPB's Section 1033 personal financial data rights rule, which formalises consumer-permissioned access to financial accounts. Our pipelines redact direct identifiers at ingest, log every consent grant with a verifiable timestamp, and honour withdrawal-of-consent within minutes. Data at rest is encrypted with KMS-backed keys, while transport uses TLS 1.3 with certificate pinning to mitigate man-in-the-middle attacks against mobile sessions.

Beyond FCRA, integrations align with the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, U.S. state privacy laws (CCPA/CPRA, VCDPA), and where the consumer is in Canada, PIPEDA. We provide a one-page compliance matrix that maps each endpoint to the legal basis for processing.

Data flow / architecture

The reference pipeline is intentionally short and auditable:

1. Mobile client — Credit Sesame login surface mirrored through our protocol-aware client with consent capture.
2. Ingestion API — OAuth bearer endpoints normalise scores, tradelines, alerts and offers into a single envelope.
3. Storage — Encrypted Postgres + cold S3 archive, with row-level access policies tied to consent IDs.
4. Output — REST + webhook fan-out; optional Kafka topic for high-volume risk consumers.

Market positioning & user profile

Credit Sesame is positioned as a free-to-start, U.S.-focused credit health platform. Membership exceeds 18 million according to the company's own marketing, with primary user segments being credit-curious millennials and Gen-Z consumers building thin files, sub-prime borrowers actively repairing their credit, and home-buyers preparing for mortgage applications. The product is delivered on Android and iOS plus a responsive web dashboard, and the company also operates the white-label "Sesame" platform that powers the TransUnion direct-to-consumer experience. For B2B integrators, that means the same data model is already battle-tested at bureau scale.

About OpenFinance Lab

We are an independent studio focused on fintech and open-data API integration, with prior shipping experience across U.S. credit bureaus, U.K. Open Banking, EU PSD2 and India UPI. Engineers on the team have built protocol-analysis pipelines for mobile credit and banking apps for the past eight years.

• Credit, lending, identity, and PFM API integrations
• Enterprise API gateways with SOC 2 alignment
• Custom Python / Node.js / Go SDKs and test harnesses
• Source code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing with no upfront cost

Engagement workflow

1. Scope confirmation: which surfaces (scores, tradelines, alerts, offers, simulator, rent reporting).
2. Protocol analysis & API design — 2–5 business days.
3. Build and internal validation against a sandbox account — 3–8 business days.
4. Docs, sample apps and FCRA/CFPB §1033 compliance pack — 1–2 business days.
5. First delivery typically 5–15 business days; bureau or lender approvals can extend timelines.

FAQ

What credit data can I extract from Credit Sesame?

Is Credit Sesame integration FCRA compliant?

How long does delivery take?

Do you support webhooks for credit alerts?