GoodScore API integration services (Experian / CRIF / Account Aggregator)

Deliverables checklist

• OpenAPI 3.1 specification covering score, report, tradeline, and webhook endpoints
• Protocol and authentication report (OAuth-style token flow, refresh, device binding, certificate pinning notes)
• Runnable Python (FastAPI) and Node.js (Express) reference servers
• Postman collection, automated pytest suite, and replayable HAR fixtures
• Compliance pack: consent text templates, retention policy, DPDP-aligned purpose register
• Operational guide: rate limits, retry/backoff, score-change webhook signing

Engagement options

• Source code delivery from $300 — we hand over runnable API source and documentation; pay after delivery upon satisfaction.
• Pay-per-call hosted API — call our managed GoodScore endpoints and pay only per request, with no upfront fee. Suitable for teams that want to skip protocol upkeep entirely.
• Hybrid — we host the bureau-facing connector and ship the orchestration layer to your VPC so PII never leaves your boundary.

1. Pre-approval engine for digital lenders

A lending partner (e.g. an NBFC like Earlysalary, already a GoodScore lending partner) wants to pre-qualify users without forcing them through a fresh bureau pull. Our connector exposes GET /goodscore/score and GET /goodscore/report behind your consent layer; the response is normalized into a single bureau-agnostic schema, scored against your policy engine, and returned to the user inside seconds. This maps directly to OpenFinance "consent-driven data sharing" patterns.

2. Continuous monitoring & alerting

Wealth-tech and credit-coaching products subscribe to the score.changed webhook to push alerts when a customer's Experian or CRIF score moves by more than a configurable threshold. Each event includes the previous and new score, the bureau, the contributing factors (utilization, DPD, new account), and a signed payload so downstream systems can verify authenticity.

3. Account Aggregator handoff

For RBI-regulated FIUs, the GoodScore connector can be wrapped as an AA-compatible data fetch: the FIU raises a consent artefact, the user approves on their AA app, and we resolve the FI-Type for credit information against the appropriate bureau or the GoodScore-cached snapshot. This avoids duplicate hard pulls and keeps the user inside the regulated AA consent grammar.

4. Cashflow underwriting from bill events

Thin-file or new-to-credit users often have no rich bureau history. The SMS-derived expense stream — only available if the user has granted GoodScore SMS access — gives a complementary picture: salary credits, rent, utility EMIs, BNPL repayments. Combined with the Experian thin-file score, this drives alternate-data scorecards used by neo-banks and SME lenders.

5. Compliance and audit reporting

For internal audit and RBI inspections, every bureau pull, consent record, and outbound API call is captured into an immutable log with hash chaining. Reports can be exported to JSON, CSV, or PDF for evidence binders, satisfying the record-keeping expectations of the Credit Information Companies (Regulation) Act, 2005.

Authentication and session bootstrap

// Bind a GoodScore user to your tenant
POST /api/v1/goodscore/auth/login
Content-Type: application/json

{
  "tenant_id": "acme-nbfc",
  "user_ref": "u_8f23",
  "msisdn": "+91XXXXXXXXXX",
  "device_id": "and-1a2b3c",
  "consent_artefact_id": "aa://consent/8a7d..."
}

200 OK
{
  "session_id": "sess_01HF...",
  "access_token": "eyJ...",
  "refresh_token": "rt_01HF...",
  "expires_in": 1800,
  "scopes": ["score.read","report.read","tradelines.read"]
}

Fetch credit score and report

// Fetch normalized multi-bureau snapshot
GET /api/v1/goodscore/credit/snapshot
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: aa://consent/8a7d...

200 OK
{
  "user_ref": "u_8f23",
  "as_of": "2026-05-04T03:11:08Z",
  "scores": [
    {"bureau":"EXPERIAN","value":742,"band":"GOOD","delta_30d":+8},
    {"bureau":"CRIF_HIGHMARK","value":735,"band":"GOOD","delta_30d":+5}
  ],
  "tradelines_count": 7,
  "open_enquiries_90d": 2,
  "report_url": "https://files.openfinance-lab.com/r/01HF.../report.pdf"
}

Score-change webhook (signed)

// Webhook to your ingestion endpoint
POST https://your-app.example/hooks/goodscore
X-Signature: t=1714790000,v1=9f3c...
Content-Type: application/json

{
  "event": "score.changed",
  "user_ref": "u_8f23",
  "bureau": "EXPERIAN",
  "previous": 734,
  "current": 742,
  "factors": ["utilization_down","on_time_emi"],
  "occurred_at": "2026-05-04T02:58:11Z"
}

// Verify with HMAC-SHA256(secret, "{t}.{raw_body}") == v1

Regulations we map to

• Credit Information Companies (Regulation) Act, 2005 — governs the use of bureau data; we keep purpose binding and retention windows tight.
• RBI Master Direction NBFC-Account Aggregator (2016, with 2025 SRO update) — consent artefacts, FIU/FIP roles, traceable revocation. See the official Department of Financial Services portal.
• Digital Personal Data Protection Act, 2023 (DPDP) — lawful basis, notice, data principal rights, breach reporting.
• RBI Digital Lending Guidelines, 2022 — data minimization on lender-facing pulls, no covert collection.

Operational controls

• Authorized access only: documented partner APIs, customer-supplied credentials, or AA-mediated consent.
• PII at rest is encrypted with envelope keys (AWS KMS / GCP KMS); PAN and Aadhaar are tokenized.
• SMS-derived events are processed on-device or in an isolated parser; raw SMS bodies are not retained.
• Audit log is hash-chained and exportable for RBI inspection or internal SOC 2 evidence.
• Optional regional data residency in ap-south-1 (Mumbai) for India-only deployments.

Paisabazaar

The only consumer platform that exposes all four bureau scores (CIBIL, Experian, Equifax, CRIF High Mark). A common pairing is to pull the Experian + CRIF view from GoodScore and the CIBIL + Equifax view from Paisabazaar to get full-coverage cross-bureau verification.

OneScore (FPL Technologies)

Lifetime-free CIBIL + Experian score app from the team behind OneCard. Integrators often unify OneScore session data with GoodScore tradelines for users who use both, reducing duplicate hard pulls.

CRED

Premium credit-card bill-payment and rewards app surfacing CRIF + Experian scores. Useful in scenarios where the credit-card spend timeline from CRED complements the underlying tradeline from GoodScore.

Bajaj Finserv

Lender-owned super-app with CIBIL score views. Combining Bajaj's loan-origination signals with GoodScore's improvement plan gives a 360-degree pre-approval picture.

BankBazaar

Marketplace that distributes credit cards and loans against bureau pulls. A unified GoodScore + BankBazaar export is common for affiliate-attribution and cross-product analytics.

CreditMantri

Credit-improvement and loan-discovery app holding bureau snapshots and dispute workflows. Pairs naturally with GoodScore's improvement plan for unified customer-journey analytics.

Freo (formerly MoneyTap)

Credit line and savings super-app with embedded score views. Integrators often join Freo's line-utilization data with GoodScore's tradeline timeline to model rolling exposure.

Jupiter Money

Neo-banking app with cashflow tooling and lending features for thin-file users. Combining Jupiter's transaction stream with GoodScore's bureau view supports alternate-data scoring.

myCIBIL (TransUnion CIBIL)

Official consumer portal of the most widely used Indian bureau. Used as the canonical CIBIL reference when building a multi-bureau merge alongside GoodScore's Experian/CRIF data.

CreditKlick

Credit-improvement app focused on score-builder programs. Often integrated together with GoodScore for teams that want to compare improvement-plan adherence and outcomes across cohorts.

About OpenFinance Lab

We are an independent technical studio focused on mobile-app protocol analysis and OpenData / OpenFinance / OpenBanking integration. Our team has shipped credit-bureau, payment, and account-aggregator stacks for NBFCs, neo-banks, and cross-border fintechs, and we work comfortably across India, the Gulf, Singapore, and the United Kingdom.

• Bureau API connectors (Experian, CRIF High Mark, CIBIL, Equifax)
• RBI Account Aggregator FIU and TSP integration patterns
• Mobile reverse-engineering for authorized data extraction (Android & iOS)
• Custom Python / Node.js / Go SDKs and conformance test harnesses
• Source code delivery from $300 — runnable code and full docs; pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing with no upfront cost

Contact

For quotes, NDAs, or to submit your target app and requirements, open our contact page:

Contact page

We respond within one business day. Typical first-call agenda: scope, data fields needed, target stack (Python / Node.js / Java), deployment model (your VPC vs hosted), and compliance constraints.

Engagement workflow

1. Scope confirmation: target endpoints (score, report, tradelines, webhook), expected QPS, regions.
2. Protocol analysis and API design (2–5 business days).
3. Build, internal validation, and regression suite (3–8 business days).
4. Docs, sample apps, Postman collection, and replayable fixtures (1–2 business days).
5. Typical first delivery: 5–15 business days; bureau-side approvals or AA onboarding may extend the timeline.

FAQ

What inputs do you need to start a GoodScore integration?

How long does delivery take?

How do you handle compliance with RBI and DPDP Act?

Can you integrate other credit bureaus alongside Experian and CRIF?