Hattha Mobile API integration services (KHQR / OpenFinance)

Deliverables checklist

• API specification (OpenAPI / Swagger) for login, balance, transactions, statements, KHQR
• Protocol & auth flow report — device binding, OTP, biometric token, refresh and cookie chain
• Runnable source for login + statement + KHQR verification (Python and Node.js)
• Automated tests, Postman collection, and step-by-step API documentation
• Compliance notes — NBC payment rules, KHQR/Bakong guidelines, consent and retention guidance

Engagement options

• Source-code delivery from $300 — you receive runnable API source code plus documentation; pay after delivery once you are satisfied.
• Pay-per-call hosted API — call our managed endpoints and pay only for the requests you make, with no upfront fee; useful for teams that prefer usage-based pricing or a quick proof of concept.
• Maintenance retainer — optional monthly window for keeping clients in sync when the app or Bakong specs change.

Recent app context

Hattha Bank rolled out Hattha Mobile version 3.0 as a modernized rebuild with faster transactions and a simplified hamburger menu. In late 2024 the bank ran a ThaiQR cross-border cashback promotion (20% back on ThaiQR payments via Hattha Mobile in Thailand, November–December 2024), reflecting Cambodia's wider push into cross-border QR with Thailand, Vietnam, Laos, Malaysia, China and Japan. Integrations should therefore treat KHQR ID receipt and cross-border ThaiQR as first-class transaction types, not edge cases.

1. Accounting & ERP reconciliation

Context: an SME using a cloud accounting suite wants Hattha Bank movements to appear automatically. Data/API: nightly call to the transaction-history endpoint with from_date/to_date, plus monthly statement PDF for the audit trail. OpenBanking mapping: an "account information service" pattern — read-only consented access to balances and transactions, normalised to a standard ledger schema and pushed into Xero/QuickBooks-style books.

2. KHQR merchant settlement & refunds

Context: an online store accepts KHQR and needs to confirm each payment before fulfilment. Data/API: generate EMVCo KHQR, then poll or webhook the Bakong verification call by md5/trace ID; on success, write the order; on timeout, void. OpenFinance mapping: a "payment initiation + status" flow against the national QR rail, with settlement reports rolled up daily for finance.

3. Cross-border ThaiQR expense tracking

Context: a travel or logistics firm whose staff pay ThaiQR merchants in Thailand via Hattha Mobile. Data/API: filter transaction history for the cross-border channel, capture FX rate and settlement currency, attach receipt references. OpenData mapping: unified multi-currency expense feed that joins KHR and THB legs into one reportable record for the finance team.

4. Real-time ledger sync via push events

Context: a lending app needs to know the moment a borrower's repayment lands. Data/API: ingest instant push-notification events (debit/credit, amount, balance-after), de-duplicate against the transaction endpoint, then fan out to internal webhooks. OpenBanking mapping: an event-driven "transaction notification" stream feeding a near-real-time mirror of the account ledger.

5. Bill-payment & top-up analytics

Context: a utility aggregator wants spend insight across its biller categories. Data/API: pull bill-payment and mobile top-up records, classify by biller type (utilities, internet, insurance, property, agents, MSISDN top-up), aggregate by period. OpenData mapping: a categorised payments dataset that powers dashboards, dunning, and partner reconciliation without touching card networks.

1) Authenticate & bind device

// Step 1: login (pseudocode)
POST /api/v1/hattha/auth/login
Content-Type: application/json

{
  "username": "85512XXXXXX",
  "password": "<hashed>",
  "device_id": "<uuid>",
  "biometric": false
}

// 200 OK
{
  "access_token": "eyJhbGci...",
  "refresh_token": "def502...",
  "expires_in": 1800,
  "accounts": [{"acct_id":"0010xxxxxx","ccy":"KHR"},{"acct_id":"0020xxxxxx","ccy":"USD"}]
}

// On 401 -> trigger OTP step; on 423 -> account locked; on 426 -> app/version upgrade required

2) Fetch statement / transaction history

POST /api/v1/hattha/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "acct_id": "0010xxxxxx",
  "from_date": "2026-04-01",
  "to_date": "2026-04-30",
  "channel": ["KHQR","TRANSFER","BILL","TOPUP","CROSSBORDER"],
  "page": 1,
  "page_size": 50,
  "format": "json"   // or "pdf" / "xlsx"
}

// 200 OK
{
  "opening_balance": 1820.55,
  "closing_balance": 2143.10,
  "page": 1, "pages": 3,
  "items": [
    {"txn_id":"T2604...","posted_at":"2026-04-03T09:21:04+07:00",
     "amount":-12.50,"ccy":"USD","channel":"KHQR",
     "counterparty":"Merchant ABC","bakong_trace":"FT26...","ref":"INV-7781","status":"SUCCESS"}
  ]
}

3) Verify a KHQR / Bakong payment

POST /api/v1/hattha/khqr/verify
Authorization: Bearer <ACCESS_TOKEN>

{ "md5": "<khqr-md5>" }   // hash of the generated EMVCo KHQR string

// 200 OK
{ "responseCode": 0, "data": { "hash": "...", "fromAccountId": "payer@bank",
  "toAccountId": "merchant@hkl", "amount": 12.50, "currency": "USD",
  "trackingStatus": "COMPLETED", "createdDateMs": 1746000000000 } }

// responseCode != 0 -> not yet paid / expired; retry with backoff, then void the order

4) Push-event webhook (your endpoint)

POST https://yourapp.example/webhooks/hattha
X-Signature: sha256=<hmac>
Content-Type: application/json

{
  "event": "transaction.posted",
  "acct_id": "0010xxxxxx",
  "direction": "CREDIT",
  "amount": 250.00, "ccy": "USD",
  "balance_after": 2393.10,
  "channel": "TRANSFER",
  "ref": "REPAY-10293",
  "occurred_at": "2026-05-12T14:02:11+07:00"
}

// Respond 2xx within 5s; we retry with exponential backoff and de-dupe on (acct_id, ref, occurred_at)

Regulatory context

Hattha Bank is supervised by the National Bank of Cambodia under the Law on Banking and Financial Institutions, and its mobile payment features sit on the NBC's national rails — the Bakong system and the EMVCo-based KHQR standard, with cross-border QR linkages governed by bilateral arrangements (e.g. Thailand via the Regional Payment Connectivity initiative). We build only against authorized or documented interfaces — the Bakong Open API and KHQR SDK, plus partner or sandbox credentials you supply — and we never bypass authentication or impersonate users. Cambodia's draft Personal Data Protection Law and existing telecom/e-commerce privacy provisions inform our data-minimisation defaults.

How we keep it safe

• Customer-authorized access only; consent records and full request/response audit logs
• Data minimisation — request the narrowest scope and shortest retention that meets the use case
• Encryption in transit and at rest; secrets in a vault, not in source
• NDAs and a documented data-processing description on request
• Clear separation of test (sandbox) and production credentials and data

• ABA Mobile — ABA Bank's widely used app; holds accounts, cards, QR payments and transaction history that teams often want to merge with Hattha exports for a single view.
• ACLEDA mobile — ACLEDA Bank's app (the rebuilt "Unity ToanChet"); a common second account whose statements and KHQR records appear in the same reconciliation jobs.
• Wing Bank — Wing's bank-licensed app with a deep agent network; transfers, bill payments and top-ups here frequently need to line up with Hattha movements.
• Sathapana Mobile — Sathapana Bank's app (relaunched in April 2025); similar balance, transfer and statement data that integrators normalise alongside Hattha.
• Prince Bank app — Prince Bank's digital-first app; accounts, deposits and QR payments that show up in cross-bank cash-position dashboards.
• AMK Mobile — AMK's microfinance app; loan, savings and payment records that pair naturally with Hattha's SME-oriented data.
• PRASAC mobile — PRASAC's app, with a large rural customer base; transaction and statement feeds often consolidated with Hattha for agribusiness clients.
• Maybank KH — Maybank Cambodia's app; accounts, FX and QR payments that fit the same cross-border reporting need as Hattha's ThaiQR data.
• Chip Mong Bank app — Chip Mong Commercial Bank's app; another account commonly held alongside Hattha by Phnom Penh merchants.
• Bakong app — the National Bank of Cambodia's wallet that links to bank accounts (including Hattha); the KHQR/Bakong rail that nearly every integration in this list ultimately settles on.

About us

We are an independent technical studio focused on app interface integration and authorized API work, with a strong fintech and digital-banking track record. Our engineers have shipped protocol-analysis and API projects across banks, payment gateways, and microfinance institutions, and we know the National Bank of Cambodia's payment landscape — Bakong, KHQR, FAST, and the cross-border QR linkages — as well as multi-region privacy expectations.

• Payments, digital banking, microfinance, and cross-border remittance integrations
• Enterprise API gateways, webhook delivery, and security reviews
• Custom Python / Node.js / Go SDKs, Postman collections, and test harnesses
• Full pipeline: protocol analysis → build → validation → compliance hand-off
• Source-code delivery from $300 — runnable API source plus documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing, no upfront cost

Contact

To request a quote or scope a Hattha Mobile integration, send us the target app name (already provided here) and your concrete requirements — for example transaction-history export, KHQR verification, or cross-border ThaiQR reconciliation — plus any sandbox or partner credentials you hold.

Contact page

Engagement workflow

1. Scope confirmation — which data and endpoints (login, balance, transactions, statements, KHQR verify, push events).
2. Protocol analysis & API design — 2–5 business days depending on auth complexity.
3. Build & internal validation — 3–8 business days, including tests and a Postman collection.
4. Documentation, samples, and hand-off — 1–2 business days.
5. Typical first delivery: 5–15 business days; third-party or partner approvals may extend the timeline.

FAQ

What data can you extract from Hattha Mobile?

Do you use official Hattha Bank or Bakong APIs?

How long does delivery take and what does it cost?

How do you handle compliance and customer consent?