Kapitalbank API integration services (Kapital API / OpenBanking Uzbekistan)

1. Authorization & session

Login API with phone-number + SMS OTP and biometric step-up (Face ID / Touch ID parity), token refresh, device fingerprint, IP-based session monitoring. Used to mirror the same login surface that the Kapitalbank app exposes to its multi-million Uzbek customer base.

2. Cards module

List bound cards (Humo, Uzcard, Visa, Mastercard), check balances, request a new card, change PIN, block/unblock card. Each card returns its currency, masked PAN, expiry and tariff — useful for self-service portals and HR-driven payroll-card programs.

3. Accounts & deposits

Read current account balances in UZS and foreign currency, list term deposits with maturity and interest accrual, fetch loan amortisation schedules. Used by personal-finance dashboards and SMB cashflow trackers that need a single source of truth for every Kapitalbank product a client holds.

4. Transactions & statements

Paged statement query with from/to date, currency filter, transaction type (transfer, P2P, payment, FX, cashback) and merchant text search. Supports exports to JSON, Excel and PDF for accounting submission, VAT reconciliation and audit logs.

5. Transfers & payments

Authorized initiation of transfers between own accounts, P2P transfers by card or phone number, payment for utilities, taxes and government services using stored billers, and FX conversion at Kapitalbank's published rate. Each call writes a server-side audit entry that matches the in-app transaction history.

6. Notifications & webhooks

Push-style webhook out of our gateway whenever a new statement entry arrives, a card is blocked, or an FX rate refresh occurs. Lets your back office react in seconds instead of polling the statement endpoint every few minutes.

Deliverables checklist

• API specification (OpenAPI / Swagger) for login, cards, accounts, statements, transfers and FX
• Protocol and auth flow report (OAuth-style token, SMS OTP, device fingerprint, refresh chain)
• Runnable source for login + statement + FX endpoints in Python or Node.js
• Automated tests, mocked sandbox responses and Postman collection
• Compliance guidance (KYC, consent records, data minimisation, retention)
• Mapping notes between our wrapper and the official Kapital API portal endpoints

API example: login & token refresh (pseudocode)

// Step 1 — authenticate a user against Kapitalbank
POST /api/v1/kapitalbank/login
Content-Type: application/json

{
  "phone": "+998901234567",
  "password": "<APP_PASSWORD>",
  "device_id": "<DEVICE_FINGERPRINT>"
}

// 200 OK
{
  "access_token": "...",
  "refresh_token": "...",
  "expires_in": 1800,
  "step_up_required": "sms_otp"
}

// Step 2 — verify SMS OTP
POST /api/v1/kapitalbank/verify-otp
Authorization: Bearer <ACCESS_TOKEN>
{ "code": "1234" }

API example: statement query (pseudocode)

POST /api/v1/kapitalbank/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "account_id": "UZ12000000000000000001",
  "currency": "UZS",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "page": 1,
  "page_size": 100,
  "type": ["TRANSFER","PAYMENT","FX"]
}

// 200 OK
{
  "items": [
    { "id":"...", "ts":"2026-03-15T09:11:42Z",
      "amount": -154000, "currency":"UZS",
      "type":"PAYMENT", "merchant":"Uztelecom",
      "mcc":"4814", "status":"COMPLETED" }
  ],
  "page": 1, "total_pages": 4
}

API example: webhook for new transactions

// We push events to your endpoint when an
// authorized Kapitalbank account sees movement.
POST https://your-app.example/webhooks/kapitalbank
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "transaction.created",
  "account_id": "UZ12...",
  "txn": { "id":"...", "amount": 2500000, "currency":"UZS",
           "type":"INCOMING_TRANSFER", "counterparty":"Uzum Market" },
  "received_at": "2026-04-29T08:14:00Z"
}

// Error model used across endpoints
// 4xx { "error":"INVALID_OTP", "request_id":"..." }
// 5xx { "error":"UPSTREAM_TIMEOUT", "retry_after":15 }

Compliance & privacy

All work is performed under explicit customer authorization or against documented public / corporate APIs. We align with Uzbekistan's Law on Personal Data, the Central Bank of Uzbekistan's prudential and AML/CFT rules, and the open-banking framework being rolled out under the November 2025 presidential decree (target go-live by September 2026). Where customers operate cross-border, we extend coverage to GDPR-style consent capture and ISO 27001-aligned controls.

Operationally we rely on TLS 1.2+ on every hop, hardware-backed key storage for tokens, and a consent ledger that records who authorised what data and for how long. Personal data is minimised: by default we only persist the fields the customer explicitly subscribed to (e.g. statements only, no card PAN). Logs are retained per the customer's regulatory requirement and can be wiped on consent revocation.

Data flow / architecture

A typical pipeline looks like: Kapitalbank Mobile App / Kapital API → our authorized integration layer (login + token refresh + rate limiter) → normalisation & schema mapping → secure storage (encrypted at rest, customer-scoped) → outbound API or webhook to your accounting / ERP / risk engine. Each hop emits structured audit events so you can reconstruct any transaction, end to end, on demand.

• Client App → Ingestion (login, OTP, refresh)
• Ingestion → Normalisation (cards, accounts, statements, FX)
• Normalisation → Storage (encrypted, per-tenant)
• Storage → API / Webhook out → your back office

About us

We are an independent technical service studio focused on App interface integration and authorized API integration. Our engineers come from banks, payment processors, protocol-analysis teams and cloud platforms, and we work daily with OpenBanking-style flows in CIS, EU and APAC markets. For Kapitalbank specifically we combine Uzbekistan-domain knowledge (UZS, Humo/Uzcard, Central Bank rules, the upcoming open-banking framework) with hands-on protocol analysis of the uz.kapitalbank.kbonline package.

• Financial and banking apps (transactions, statements, transfer integration)
• E-commerce, food delivery and retail apps (orders, payments, sync)
• Hotel, travel and mobility apps (bookings, itineraries, payment verification)
• Social, OTT media and dating apps (auth/login, messaging, profiles)
• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted API endpoints and pay only for the calls you make, no upfront fee

Contact

Send us the target app (Kapitalbank, package uz.kapitalbank.kbonline) and the data scope you need (e.g. statements only, statements + transfers, full retail surface). We will reply with scope, timeline and a price band.

Contact page

Engagement workflow

1. Scope confirmation: which Kapitalbank surfaces (login, cards, accounts, statements, transfers, FX) and which delivery format (source code vs hosted API).
2. Protocol analysis and API design (2–5 business days, depending on the chosen surfaces and currencies).
3. Build, internal validation and sandbox responses (3–8 business days).
4. Documentation, sample integrations and test cases (1–2 business days).
5. Typical first delivery: 5–15 business days; KYC-heavy or cross-border scopes may extend the timeline.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance?