Alfardan Exchange Send Money — API integration & OpenFinance services

Send Money & remittance API

Wraps the in-app "Send Money" flow as a clean REST endpoint: create transfer, attach beneficiary, run iPiD payee verification, debit source wallet, return reference. Fields include corridor (e.g. QAR→INR), purpose code, and AML flag. Use it to embed Qatar-originating remittance in payroll, expense, or marketplace payout systems.

Beneficiary directory sync

Pull saved beneficiaries with bank, IBAN/account, mobile wallet, and KYC reference. The webhook stream pushes diffs (added, edited, deactivated) to keep CRM and ERP records in lockstep with what the user maintains inside the app.

FX rate & multi-currency cash

Read currently displayed buy-sell rates per corridor; place an order for foreign currency cash delivery (USD, EUR, GBP, INR, PHP, etc.). Designed for travel-tech aggregators and corporate treasury that need the same numbers shown in-app to back-end pricing.

Gold bars & coins order API

Surface high-purity (24K) bullion inventory: weight (1g, 5g, 10g, 100g, 1oz), origin (PAMP, The Royal Mint), unit price, settlement, and delivery slot. Use for jewellery retail, wealth-management dashboards, or commodity-tracking spreadsheets that want one source of order truth.

Statement export & audit log

Date-ranged exports of remittance, FX, and gold transactions with pagination and signed receipt URLs. Statement output mirrors the WhatsApp/email receipt format the app already emits, so external accounting tools can match line items 1:1.

Webhook event bus

Push events: transfer.completed, transfer.failed, fx.rate.updated, gold.order.shipped, kyc.updated, avios.earned. Used by reconciliation engines that prefer event-driven architecture over polling.

1. Payroll & payout for GCC employers

A construction or hospitality employer in Qatar wants to pay 800 expat workers in INR, PHP, NPR, and BDT. We wrap POST /v1/transfer as a bulk endpoint, run iPiD payee verification on every beneficiary, and stream transfer.completed events into the HR system. Payslips reference the same transaction ID the worker sees in the app.

2. Accounting & ERP reconciliation

An SME using Zoho Books or QuickBooks needs every Alfardan transaction tagged to a vendor and cost centre. We expose GET /v1/statement with a normalized schema (txn_id, posted_at, type, currency, amount, fee, fx_rate, beneficiary_id) and a daily reconciliation report that flags orphaned receipts.

3. Treasury FX dashboard

A regional treasury team blends Alfardan's corridor rates with bank quotes for QAR/USD/EUR/GBP. The FX feed is polled every 60 seconds; rate snapshots feed a Grafana board, and a webhook on rate moves above N basis points triggers a Slack alert. Nothing here requires changes to the consumer app.

4. Gold inventory & wealth advisory

An independent wealth advisor tracks PAMP and Royal Mint bullion holdings across clients. Each gold-order webhook (gold.order.shipped) updates a portfolio system with weight, purity, and a unit cost basis, so quarterly statements include the bullion line on the client's overall asset view.

5. Compliance, AML, and audit pull

An internal audit team pulls signed daily statements, KYC change events, and payee-verification outcomes into a SIEM. The pull job uses an OAuth-style refresh token, retains every response under WORM storage, and feeds the QCB-aligned monthly AML/CFT report.

Auth: OAuth-style token exchange

POST /api/v1/alfardan/auth/login
Content-Type: application/json

{
  "msisdn": "+9745xxxxxxx",
  "qid": "QID-XXXXXXXXXXX",
  "device_fp": "a1b2c3...",
  "otp": "123456"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_a8f9...",
  "expires_in": 1800,
  "scope": "remittance.read transfer.write fx.read gold.read"
}

Statement query (paged, ISO 8601)

GET /api/v1/alfardan/statement?from=2026-01-01&to=2026-03-31&type=remittance&page=1
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "page": 1,
  "page_size": 50,
  "total": 287,
  "items": [{
    "txn_id": "AFE-2026-000182",
    "posted_at": "2026-03-12T08:14:09Z",
    "type": "remittance",
    "corridor": "QAR-INR",
    "amount_src": 1500.00,
    "currency_src": "QAR",
    "amount_dst": 33810.00,
    "currency_dst": "INR",
    "fx_rate": 22.54,
    "fee": 15.00,
    "beneficiary_id": "BEN-9981",
    "status": "settled",
    "ipid_verified": true
  }]
}

Webhook: transfer settled

POST https://your-app.example.com/hooks/alfardan
X-Alfardan-Signature: t=1761500000, v1=hex(hmac_sha256...)

{
  "event": "transfer.completed",
  "occurred_at": "2026-04-21T11:02:14Z",
  "data": {
    "txn_id": "AFE-2026-000201",
    "corridor": "QAR-PHP",
    "amount_src": 800.00,
    "fx_rate": 12.41,
    "settlement_rail": "instaPay",
    "ipid_verified": true
  }
}

// Verify HMAC, ack with 2xx within 5s,
// retry policy: 0/30s/2m/10m/1h, 6 attempts.

Error model & rate limits

Standard error envelope: { "error": { "code": "TRANSFER_LIMIT_EXCEEDED", "message": "...", "trace_id": "..." } }. Per-token rate limits are 60 req/min for read, 10 req/min for write. 429 includes Retry-After. Idempotency keys are required for any POST /transfer to prevent duplicate debits during network retry.

Qatar Central Bank (QCB) alignment

Alfardan Exchange operates under a QCB exchange-house licence, with obligations covering AML/CFT, e-KYC (per the 2023 QCB e-KYC regulation), and the 2024 Payment Services Regulation. Our integrations are scoped to read endpoints under explicit user authorization, with logging, consent records, and Strong Customer Authentication (SCA) at every transfer step. Sensitive identifiers (Qatar ID, IBAN) are tokenized at rest.

Privacy & data minimization

We collect only fields the customer explicitly asks for in their integration scope and apply field-level redaction by default. Data retention defaults to 90 days for transactional records and 24 hours for OAuth refresh material; both are overridable per contract. Cross-border data flows align with Qatar's data-protection law and, where the consumer is in scope, GDPR Article 6 lawful-basis selection.

Deliverables checklist

• OpenAPI / Swagger specification covering login, statement, transfer, FX, and gold endpoints
• Authorization and protocol report (token chain, OTP/SCA flow, device-binding)
• Runnable source code (Python / Node.js / Go) for login, statement export, and webhook receiver
• Postman collection, integration tests, and a sandbox harness that mocks Alfardan responses
• Compliance pack: QCB, AML/CFT, e-KYC, GDPR mapping notes, and consent record templates

Engagement workflow

1. Scope confirmation — agree which data surfaces (remittance, FX, gold, statement) are in scope.
2. Authorized protocol analysis & API design (2–5 business days).
3. Build and internal validation (3–8 business days).
4. Documentation, samples, and test cases (1–2 business days).
5. First delivery typically lands in 5–15 business days; longer for multi-corridor or production rollouts.

About the studio

We are an independent technical studio focused on App interface integration and authorized API integration. The team has years of hands-on experience in mobile fintech, exchange-house back-office systems, and OpenBanking-style protocols, with delivered work covering remittance, payments, gold-bullion ordering, and treasury data feeds across the GCC and beyond. We know the QCB, SAMA, CBUAE, and CBE regulatory environments and ship integrations that respect them.

• Remittance, exchange-house, and digital-banking integration
• Authorized data-extraction and protocol-analysis engagements
• Custom Python / Node.js / Go SDKs and test harnesses
• Full pipeline: protocol analysis → build → validation → compliance
• Source code delivery from $300 — receive runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted endpoints and pay only per call, no upfront cost; suited to teams that prefer usage-based pricing

Contact

For quotes, sandbox access, or to brief us on your target app and requirements, open the contact page below. Typical first response within one business day.

Open contact page

We work under explicit customer authorization and documented public/authorized APIs only. NDAs available on request.

FAQ

What inputs do you need from us?

How long does delivery take?

How is compliance handled?

Can the API be hosted by you?

Recent context

In April 2025 Alfardan Exchange partnered with iPiD to launch Qatar's first real-time payee-verification service inside the exchange industry — a fact our integrations now mirror via an ipid_verified flag on every transfer object. Alfardan also won the "Best Money Transfer Qatar 2025" award from Global Banking & Finance Review and announced a Qatar Airways Privilege Club partnership in June 2025, which surfaces an Avios-accrual event we track in the webhook stream.