Kotak Cherry API integration (MFs, SIPs & OpenFinance)

Deliverables checklist

• OpenAPI 3.1 specification covering login, holdings, SIPs, NFOs and CAS ingest
• Protocol report describing the auth chain (mobile + OTP, Kotak Bank SSO, JWT refresh)
• Runnable reference implementation in Python (FastAPI) and Node.js (Express)
• Postman collection plus pytest / jest suites covering happy-path and error responses
• Compliance memo on SEBI investor data rules and RBI Account Aggregator alignment

Engagement models

Choose either a one-time source code drop (from $300) — you receive runnable code, tests and docs and pay only after acceptance — or our hosted, pay-per-call API with usage-based billing and no upfront commitment. Hosted clients benefit from rotating tokens, retry/backoff logic and a 30-day audit trail kept to the minimum data needed for support.

For larger wealth platforms, we also offer a private deployment where every component runs inside your VPC, useful when SEBI investment adviser rules or institutional risk policies prohibit data egress.

1. Wealth dashboard consolidation for an RIA

A SEBI-registered investment adviser needs a single screen that shows every client's mutual fund holdings, including funds bought directly on Kotak Cherry. The integration calls the holdings API on a daily schedule and merges output with broker and EPF data. Mapping to OpenFinance: this is a classic Financial Information User (FIU) read pattern, with consent captured against the AA template for "MF holdings".

2. SIP cash-flow planner inside a budgeting app

A personal finance app wants to warn users two days before an SIP debit, so they can top-up the linked savings account. The SIP listing API returns mandate id, next debit date and amount; a webhook then fires when an instalment fails. This maps to "PSD2-style" notification primitives, adapted to the Indian context where eNACH mandates rather than direct debits power the underlying flow.

3. Tax filing automation for capital gains

An ITR filing service consumes the transaction ledger and applies the SEBI grandfathering rules for equity gains. Each redemption row is matched with the original purchase NAV and units to compute short-term and long-term capital gains for Schedule CG. The same payload is reusable for offline accounting tools such as Tally or Zoho Books.

4. Family-office reporting via CAS bridge

A family office operates with several PAN holders and wants weekly XIRR reports. The CAS bridge ingests MF Central QR codes uploaded by each member, normalises folios across HDFC, Nippon, ICICI Prudential, SBI and Kotak Mutual Fund, and returns a single graph of holdings ready for OLAP-style aggregation.

5. Risk-profile-aware product recommendations

A robo-advisor consumes the Portfolio Health signals and combines them with the user's stated risk appetite from its own onboarding. Funds flagged "Immediate Action" by Cherry's health check feed back into the recommendation engine as negative signals, reducing weight in the next allocation. This avoids re-implementing risk scoring from scratch and reuses analysis Kotak Cherry already performs.

Login & session establishment

// 1. Mobile + OTP login
POST /api/v1/cherry/auth/start
Content-Type: application/json

{
  "mobile": "+91XXXXXXXXXX",
  "device_id": "uuid-v4",
  "client_app": "openfinance-lab/1.0"
}

// 2. Verify OTP and exchange for tokens
POST /api/v1/cherry/auth/verify
{
  "request_id": "req_01H...",
  "otp": "######"
}
=> { "access_token": "...",
      "refresh_token": "...",
      "expires_in": 1800,
      "investor_id": "INV_..." }

Holdings & SIP listing

GET /api/v1/cherry/holdings
Authorization: Bearer <ACCESS_TOKEN>
=> [
  { "folio": "1234567/89",
    "scheme_code": "120586",
    "isin": "INF174K01LS2",
    "units": 1234.567,
    "avg_nav": 42.18,
    "latest_nav": 51.24,
    "value_inr": 63266.71 }
]

GET /api/v1/cherry/sips?status=active
=> [
  { "mandate_id": "MND_8821",
    "scheme_code": "120586",
    "amount_inr": 5000,
    "frequency": "monthly",
    "next_debit": "2026-06-05" }
]

CAS / MF Central ingest webhook

POST /api/v1/cherry/cas/import
Content-Type: multipart/form-data
Authorization: Bearer <ACCESS_TOKEN>

cas_qr=@mfcentral_2026-05-09.png
investor_id=INV_...

=> { "import_id": "imp_01H...",
      "amcs_detected": 7,
      "folios": 14,
      "status": "queued" }

// Webhook delivered when parsing completes
POST /your/webhook
{ "event": "cas.import.completed",
  "import_id": "imp_01H...",
  "holdings_count": 38,
  "errors": [] }

Regulatory alignment

Indian mutual fund data falls under the supervision of SEBI and is shared between regulated entities through the RBI Account Aggregator framework. From 1 June 2025 the AA framework began validating consent and data-fetch requests against fair-use templates in real time, and as of 2025 more than 2.2 billion accounts and an estimated 110-115 million users have linked at least one financial account through the network.

Our integrations capture consent against the AA "MF holdings" and "MF transactions" templates, store hashes of consent artefacts (not personal data), and allow consent revocation through a single endpoint. Where the integration is direct (no AA in the loop), we follow the spirit of the same rules: explicit user authorisation, scope-limited tokens and minimal retention.

Modules & controls

• Consent capture & revocation aligned with AA templates
• PAN masking and tokenisation in stored logs
• Per-tenant encryption keys and rotating refresh tokens
• Optional VPC-only deployment for SEBI-registered intermediaries
• Audit log of every API call with investor and consent reference

About us

OpenFinance Lab is an independent studio focused on financial app integration, protocol analysis and OpenData delivery. The team blends engineers from Indian retail brokers, account-aggregator TSPs, payment gateways and mobile reverse engineering, so we understand both the regulatory side (SEBI, RBI, NPCI) and the operational side (eNACH mandates, RTA flows, AMC RTAs such as CAMS and KFintech).

• Wealth-tech, lending, payments, insurtech and cross-border clearing experience
• Account Aggregator FIU-side integration patterns and consent UX
• Custom Python / Node.js / Go SDKs with type-safe schemas
• Full pipeline: protocol analysis → build → validation → compliance memo
• Source code delivery from $300, runnable and documented; pay after acceptance
• Pay-per-call hosted API with no upfront cost; ideal for early-stage usage

Contact

Send the target app name (Kotak Cherry: MFs, SIPs), the data points you need, the regions you serve and any sandbox or partner credentials you already hold. We respond within one business day with a scope, fixed-price quote and timeline.

Contact page

Engagement workflow

1. Scope confirmation: target endpoints (login, holdings, SIPs, CAS, NFO), regions and consent model.
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build, test and internal validation against staging or recorded fixtures (3–8 business days).
4. Documentation, sample apps and Postman collection (1–2 business days).
5. Acceptance and handover; pay-per-call clients can switch on hosted endpoints the same day.

FAQ

What Kotak Cherry data can be exposed through an API integration?

How long does a Kotak Cherry integration take to deliver?

Is the integration compliant with SEBI and RBI rules?

Do you support both source-code delivery and pay-per-call?