PASHA Bank API integration & Open Banking services

1. Card & balance API

Surface the full list of debit, credit and salary cards bound to a PASHA Bank account, with available balance, card status (active / blocked), expiry, and last four digits. Use case: a fintech dashboard that aggregates an SME owner's personal and corporate cards into one cash-position view.

2. Transaction history API

Fetch recent transactions across cards and accounts with merchant, amount, currency (AZN, USD, EUR), MCC code and timestamp. Use case: an accounting module that auto-categorizes salary transfers, utility payments, and Keshbek cashback for monthly closing.

3. PIN reset & security API

Mirror the app's "reset PIN attempts" and "assign a new PIN" workflows. Use case: a corporate help-desk tool that lets a PASHA Bank Business administrator unblock an employee card without forwarding tickets to the bank's call center.

4. Card-to-card & ANI transfers

Initiate card-to-card transfers in AZN, configure ANI Payment System aliases (phone number, IBAN, PAN), and read settlement status. Use case: a marketplace that pays out vendors via ANI in seconds instead of next-day SWIFT.

5. Bill payments API

Wrap mobile, utility, cable TV, internet and telephone payment endpoints exposed inside the app. Use case: a property-management SaaS that batches monthly utility bills for tenants and reconciles paid-status against bank confirmations.

6. Keshbek & campaigns feed

Read Keshbek balance, accruals, and the offers / campaigns module the app surfaces. Use case: a loyalty analytics tool that measures cashback ROI per merchant category and recommends spending shifts.

A. SME accounting auto-sync

Business context: An SME using a regional ERP wants every PASHA Bank corporate card transaction to flow into its general ledger nightly.

Data & APIs: Login API + Transaction history API + Card balance API. Pull last 24 hours of records, post journal entries, and reconcile balance after each batch.

OpenData/Open Banking mapping: Account Information Service Provider (AISP) role under the Azerbaijan Central Bank Open Banking framework — read-only access scoped by user consent.

B. Credit risk & SİMA-signed onboarding

Business context: A digital lender wants to underwrite consumers using their PASHA Bank account history before approving a top-up loan.

Data & APIs: Statement export API + Cash loan status API + SİMA-aware document signing flow (initiate signing, poll status, archive signed PDF).

OpenData/Open Banking mapping: Combines AISP (account data) with regulated electronic-signature workflow; reduces underwriting cycle time, mirroring SİMA's reported 3x faster lending.

C. Loyalty & Keshbek analytics

Business context: A retail group wants to measure how Keshbek cashback at its stores compares with cashback earned at competitors.

Data & APIs: Keshbek balance feed + Transaction history API filtered by MCC code + Offers & campaigns feed.

OpenData/Open Banking mapping: Consent-based read of loyalty data; aggregated, anonymized analytics that respects local data law.

D. Property & utility expense automation

Business context: A property-management SaaS pays mobile, utility, cable TV and internet bills for hundreds of tenant units monthly.

Data & APIs: Bill payment APIs + Card-to-card transfer for tenant collections + ANI Payment System aliases for instant settlement.

OpenData/Open Banking mapping: Payment Initiation Service (PIS) inspired flows under the AISP/PISP-style draft Azerbaijan payment law.

E. Treasury dashboard for multi-bank Azerbaijan client

Business context: A holding with cards across PASHA Bank, Kapital Bank (Birbank), ABB, and Bank of Baku wants one cash-position view.

Data & APIs: Card list + balance + transaction APIs across banks. Our adapter normalizes responses into a single schema and pushes them to a BI warehouse.

OpenData/Open Banking mapping: Multi-bank aggregation pattern aligned with the 13-bank CBA Open Banking platform live since October 2025.

1. Authorization & token refresh

// Issue an access token bound to a customer device
POST /api/v1/pashabank/oauth/token
Content-Type: application/json

{
  "grant_type": "password",
  "username": "+99450XXXXXXX",
  "password": "<one_time_otp>",
  "device_id": "ios-9F3E...",
  "scope": "cards statements ani keshbek"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "v1.MRR...",
  "expires_in": 3600,
  "scope": "cards statements ani keshbek"
}

2. Statement query (transactions)

POST /api/v1/pashabank/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "card_id": "PB-CARD-1029",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "currency":  "AZN",
  "page": 1,
  "page_size": 100
}

200 OK
{
  "items": [
    {
      "txn_id": "AZ-9921-0012",
      "posted_at": "2026-03-02T09:14:11+04:00",
      "amount": -42.50,
      "currency": "AZN",
      "merchant": "Bakcell Top-up",
      "mcc": "4814",
      "channel": "ANI"
    }
  ],
  "page": 1,
  "has_more": true
}

3. Webhook: cash-loan SİMA signing status

POST https://your-app.example.com/webhooks/pashabank
X-Pashabank-Signature: t=...,v1=...
Content-Type: application/json

{
  "event": "loan.sima_signed",
  "loan_id": "LOAN-77231",
  "customer_id": "CUST-AZ-0093",
  "signed_at": "2026-03-12T11:02:44+04:00",
  "status": "DOCUMENTS_DELIVERED",
  "courier_tracking_id": "PB-COURIER-554"
}

// Verify signature and acknowledge with 2xx within 5 seconds
// Retries follow exponential backoff up to 24h.

4. Error handling pattern

All endpoints return a typed envelope (error.code, error.message, error.retryable) so your client can branch on transient (429, 5xx) versus terminal errors (auth, scope, KYC). We document idempotency keys for transfer endpoints so a retry never produces a duplicate AZN debit.

Deliverables checklist

• API specification (OpenAPI 3.1 / Swagger)
• Protocol & auth flow report (OAuth, token refresh, device binding, request signing)
• Runnable source code (Python, Node.js, or Go) for login, cards, statement and ANI flows
• Webhook handlers (loan signing, transfer settlement) with retry semantics
• Postman collection plus automated integration tests
• Compliance handover: CBA Open Banking, AISP scope mapping, retention policy
• Migration guide for moving an existing scraper to authorized APIs

Engagement workflow

1. Scope confirmation: which PASHA Bank screens and APIs do you need (login, statements, ANI, Keshbek, loans)?
2. Protocol analysis & API design (2–5 business days, complexity-dependent)
3. Implementation & internal validation (3–8 business days)
4. Documentation, samples, and test cases (1–2 business days)
5. Typical first delivery: 5–15 business days. Third-party approvals or sandbox onboarding may extend timelines.

About our studio

We are an independent technical studio specializing in App interface integration and authorized API integration. Our team includes engineers from banks, payment gateways, protocol-analysis labs, and cloud platforms. We have shipped Open Banking integrations across the CIS, MENA, and Europe, and we know how to align with the Central Bank of Azerbaijan's Open Banking expectations as well as PSD2-style AISP/PISP patterns.

• Domains: digital banking, lending, insurtech, cross-border clearing, loyalty
• Engineering: Python, Node.js, Go, Kotlin and Swift SDK delivery
• Full pipeline: protocol analysis → API design → build → validation → compliance
• Source-code delivery from $300 — runnable API source code plus full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — access our hosted PASHA Bank-aware API and pay only per call, no upfront cost. Ideal for teams that want usage-based pricing.

Contact

For quotes or to submit your target app and requirements, open our contact page:

Open contact page

Tell us which PASHA Bank flows matter most — login, transactions, ANI, Keshbek, loans, SİMA — and we will scope the integration in 1–2 business days.

What do you need from me?

The target app name (provided), concrete needs (e.g. card statement export, ANI integration, loan webhook), and any existing backend credentials, sandbox account, or signed customer authorization that scopes the data access.

How long does delivery take?

Typically 5–15 business days for a first API drop and documentation. A multi-bank Azerbaijan stack covering PASHA Bank plus Birbank or ABB Mobile may take longer because each protocol surface requires its own analysis.

How do you handle compliance and bank secrecy?

We rely on documented public APIs or explicit customer authorization, log every consent, store minimal data, and deliver a written DPIA-ready handover. NDAs and data-residency rules (data inside Azerbaijan) can be added on request.

Do you support both Android and iOS?

Yes. Many of PASHA Bank's mobile features are exposed on both platforms with different protocol surfaces; our deliverable normalizes them into one cross-platform API so you only ship one integration.