M Credit API integration services (Mongolia NBFC / OpenFinance)

1. NBFC portfolio dashboard

A Mongolian credit-bureau partner needs near-real-time visibility into outstanding e-loans by province. Our connector pulls e-loan agreement records and pushes them to a daily ETL keyed by registry ID. The data lands in BigQuery or ClickHouse, where APR distribution, par-30 rates, and concentration in the 21 provinces become readable in a few SQL queries — without touching the operational M Credit core.

2. BNPL merchant settlement

For an e-commerce partner that originates M Credit purchase-loan agreements at checkout, we expose a BNPL settlement webhook. Each instalment event (paid, missed, extended) is signed and pushed to the merchant's reconciliation queue, mapping the M Credit agreement ID back to the merchant's order ID and SKU. This solves the classic "did the customer actually pay back instalment 2 of 4?" problem.

3. Magic Card expense feed for SMEs

SMEs whose owners use the new Magic Credit Card want their card transactions to flow into corporate accounting tools. We deliver an OpenFinance-style card transaction feed with merchant category, MCC, amount, and currency, ready to map into 1C, Microsoft Dynamics, or Mongolian-localised ERPs.

4. Risk & bonus-points modelling

Underwriters want to use the M Credit on-time-repayment bonus ledger as a feature in their credit model. We expose bonus events as a time-series, including redemption-to-rate-discount mapping, so risk teams can quantify how loyalty status correlates with default. The output plugs directly into a feature store (Feast, Tecton).

5. Compliance & audit archive

Auditors require signed copies of every loan agreement and every repayment confirmation. Our pipeline pulls the in-app PDF agreements and stores them in WORM-compliant object storage with retention metadata, satisfying both internal audit and Bank of Mongolia credit-information expectations.

Login & token refresh

// Bind an M Credit user under documented authorization
POST /api/v1/mcredit/auth/login
Content-Type: application/json

{
  "phone": "+976XXXXXXXX",
  "device_id": "b9f2-7d3a-..."
}

200 OK
{
  "access_token": "eyJhbGci...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "user_id": "mcr_0001234"
}

E-loan statement export

POST /api/v1/mcredit/eloan/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "user_id": "mcr_0001234",
  "from_date": "2026-01-01",
  "to_date":   "2026-04-30",
  "format":    "json"
}

Response (truncated)
{
  "agreements": [{
    "agreement_id": "EL-2026-AB12",
    "principal_mnt": 500000,
    "apr_pct": 36,
    "tenor_months": 3,
    "monthly_payment_mnt": 176765.18,
    "status": "active"
  }],
  "next_cursor": null
}

BNPL purchase-loan webhook

// Solomon Investments NBFC posts to your endpoint
POST https://your-merchant.example/webhook/mcredit
X-Mcredit-Signature: sha256=...

{
  "event": "instalment.paid",
  "agreement_id": "PL-2026-77F1",
  "merchant_order_id": "ORD-90211",
  "instalment_no": 2,
  "instalments_total": 4,
  "amount_mnt": 125000,
  "extensions_used": 0,
  "occurred_at": "2026-05-02T08:14:00+08:00"
}

// Reply 2xx within 5s; we retry with exponential backoff on non-2xx

Error handling & idempotency

Endpoints return JSON errors with stable codes (MCR_AUTH_EXPIRED, MCR_RATE_LIMITED, MCR_KYC_INCOMPLETE). All write paths accept an Idempotency-Key header, so retried instalment confirmations cannot double-post. Read endpoints support cursor-based paging via next_cursor; long statement windows are streamed with chunked transfer encoding to avoid 30s gateway timeouts.

Mongolian regulatory alignment

M Credit is a non-banking financial institution under the supervisory perimeter of the Bank of Mongolia (Mongol Bank), including its Credit Information Unit. Any integration we build respects the Mongolian Law on Protection of Personal Data effective 1 May 2022, plus the 2024–2028 Strategic Plan of the Ministry of Digital Development that strengthens consent records and ethical AI use across e-Mongolia services.

Security baseline (ISO 27001:2022)

M Credit has publicly adopted ISO 27001:2022 controls. Our extraction layer is designed to extend that baseline into your environment: TLS 1.2+ in transit, AES-256 at rest, key separation between identity and ledger data, secrets in an HSM-backed vault, full request and consent audit logs, and a documented data-retention schedule aligned with NBFC bookkeeping rules.

Open Banking direction

While Mongolia does not yet have a single nationwide Open Banking mandate, Golomt Bank introduced the country's first OpenBanking framework in 2020 and integrations with E-Mongolia, UBcab, Tapatrip and others have followed. Our M Credit integrations are designed in the same spirit: consent-first, scoped tokens, revocable access, and OAuth-friendly endpoints so that future regulatory harmonisation is a configuration change, not a rewrite.

Data minimisation

We only request the fields each scenario actually needs. A merchant settling BNPL instalments does not see KYC documents; a risk team does not see card PANs (only tokenised IDs). This per-scope filtering is enforced at the gateway and is auditable.

Deliverables checklist

• OpenAPI 3.1 specification for every M Credit endpoint we expose
• Protocol & auth flow report (token chain, device binding, signature scheme)
• Runnable Python and Node.js source for login, e-loan, BNPL, Magic Card
• Postman collection plus pytest / vitest test harness
• Data-mapping notes between Mongolian-language fields and English schema
• Compliance pack: data-flow diagram, retention matrix, consent template

Data flow / architecture

Pipeline shape (text-only):

1. Client app (M Credit on Android / iOS, mn.mcredit) authenticates via the protocol layer.
2. Ingestion gateway normalises the call, applies rate limits, and writes a consent log entry.
3. Storage — encrypted Postgres for relational ledger; object storage for signed PDFs.
4. Analytics / API output — REST + webhook fan-out to your dashboards, ERP, or risk engine.

Each hop is observable via OpenTelemetry traces and an immutable audit log, so an incident review can be answered in minutes instead of days.

About our studio

We are an independent technical-services studio focused on App protocol analysis and authorized API integration for fintech, payments, retail, and travel verticals. Our engineers come from banks, payment gateways, and security backgrounds; we know NBFC business logic, mobile-app reverse engineering for legitimate integration, and the field-level pragmatism it takes to ship Mongolian-language apps to English-speaking back offices.

• OpenData / OpenFinance / OpenBanking-style integrations across Asia
• End-to-end pipeline: protocol analysis → build → validation → compliance pack
• Custom Python / Node.js / Go SDKs and CI-ready test harnesses
• Source-code delivery from $300 — runnable code plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — call our hosted M Credit endpoints, pay only per request, zero upfront fee

Contact

To start an M Credit integration or request a quote with your scope (e-loan, BNPL, Magic Card, bonus points), please open our contact page:

Contact page

Engagement workflow

1. Scope confirmation: e-loan, BNPL, Magic Card, bonus points, or full coverage.
2. Protocol analysis & API design (2–5 business days, scope-dependent).
3. Build, internal validation, and Mongolian-language field mapping (3–8 business days).
4. Documentation, OpenAPI spec, sample code, and test cases (1–2 business days).
5. First delivery: typically 5–15 business days. Solomon Investments NBFC partner approvals can extend this.

FAQ

What do you need from me to start an M Credit integration?

How long does an M Credit API delivery take?

How do you handle compliance with Mongolian regulations?

Do you support pay-per-call billing instead of source code?