Pluto Money API integration & OpenFinance data services

1. Authentication & session

Phone-number login + OTP, followed by long-lived session tokens. We mirror the app's bind/refresh sequence, persist tokens server-side under your secret store, and surface a clean POST /pluto/auth/start + POST /pluto/auth/verify pair. Used to bootstrap any downstream call without needing the original device.

2. UPI autopay mandate sync

Mirrors the e-mandate flow used to set up recurring debits from PhonePe / GPay / Paytm. Exposes UMN, debit frequency (daily/weekly/monthly), max amount, current status, and last debit timestamp. Use it for reconciling Pluto debits against bank statements or AA-pulled account history.

3. Scheme allocation API

Read-only listing of the user's four schemes — Pluto Fixed, Pluto Plus, Pluto Gold, Smart Savings — plus principal, accrued return, lock-in flag, and projected maturity. Drives wealth dashboards, household-level CFP tools, and tax-prep workflows.

4. Digital gold holdings

Surfaces 24K gold gram balances stored in insured vaults (Augmont partnership), live buy/sell rates, conversion-to-physical eligibility, and per-purchase invoices. Useful for wealth aggregators and Sovereign Gold Bond (SGB) comparison tools.

5. P2P RBI-certified pool exposure

Returns aggregated P2P loan pool exposure, expected yield, and disbursement dates. Mapped to RBI's NBFC-P2P framework so downstream systems can apply concentration limits and category-level risk caps.

6. Withdrawal & instant payout

Triggers and observes withdrawal events. Honours the documented 24-hour minimum holding window, captures instant-payout status (success / pending / failed), and emits webhook events into accounting or notification stacks.

Scenario A — Wealth dashboard roll-up

Business context: A neobank wants to show a unified "all goals" view that includes the user's Pluto Money balances next to their bank deposits and mutual-fund SIPs.

Data & APIs: GET /pluto/portfolio returns the four scheme cards (Fixed, Plus, Gold, Smart Savings) with principal, return-to-date, and lock-in flag. The neobank merges this with its Account Aggregator pull of bank balances.

OpenFinance mapping: Each scheme is normalised into the AA's FI_DEPOSIT / FI_INVESTMENT shape so it joins consent-based bank data without schema drift.

Scenario B — Autopay mandate reconciliation

Business context: A finance team needs to confirm that every Pluto debit on the corporate director's bank statement matches a live UMN; rogue debits trigger immediate revocation.

Data & APIs: GET /pluto/mandates returns UMN, frequency, max amount, status; webhook mandate.debited fires per debit and is matched against the bank statement feed.

OpenFinance mapping: Each UMN is treated as the canonical key; bank-side debits are joined on UTR, leveraging NPCI's UPI 2.0 e-mandate fields.

Scenario C — Digital gold & SGB comparison

Business context: A wealth advisor compares a client's 24K digital-gold position on Pluto with Sovereign Gold Bonds before recommending a tax-efficient swap.

Data & APIs: GET /pluto/gold/holdings returns gram balance and weighted-average buy rate; GET /pluto/gold/quote returns live sell rate. Combined with public SGB rates, the advisor scores tax/yield differentials.

OpenFinance mapping: Holdings serialise into a generic commodity_holding primitive consumable by any portfolio engine.

Scenario D — P2P concentration risk monitor

Business context: A family-office tracks total P2P-NBFC exposure across multiple platforms (Pluto Smart Savings, Liquiloans-style platforms, etc.) to stay under RBI's per-investor cap.

Data & APIs: GET /pluto/p2p/exposures returns pool-level allocations; the monitor sums them across platforms and alerts if the cap is approached.

OpenFinance mapping: Pool-level data is folded into a normalized p2p_exposure object aligned with the RBI NBFC-P2P circular's risk fields.

Scenario E — Compliance & AML audit

Business context: A compliance officer reviewing a client's KYC reuses Pluto's already-verified PAN linkage and produces a consent ledger for regulators.

Data & APIs: GET /pluto/kyc returns KYC stage, PAN linkage hash (not the PAN itself), and consent timestamps; the audit tool stores these as an immutable record.

OpenFinance mapping: Consent records mirror the AA's FIU_CONSENT shape, so existing AA tooling can render them without modification.

1. Phone-number login (start & verify)

POST /api/v1/pluto/auth/start
Content-Type: application/json

{
  "phone": "+91XXXXXXXXXX",
  "device_fingerprint": "<sha256>"
}

// 200 OK
{ "session_id": "ses_a1b2", "otp_sent": true, "ttl": 120 }

POST /api/v1/pluto/auth/verify
Authorization: Bearer <PARTNER_KEY>

{
  "session_id": "ses_a1b2",
  "otp": "482917"
}

// 200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rtk_...",
  "expires_in": 3600,
  "kyc_status": "verified"
}

2. Statement query (paged, by scheme)

POST /api/v1/pluto/statement
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "scheme": "PLUTO_GOLD",
  "from_date": "2026-01-01",
  "to_date": "2026-04-29",
  "page": 1,
  "page_size": 50
}

// 200 OK
{
  "page": 1,
  "total": 124,
  "rows": [
    {
      "ts": "2026-04-28T03:30:11+05:30",
      "type": "AUTOPAY_DEBIT",
      "amount": 100.00,
      "umn": "UPI/MNDT/...",
      "utr": "428913001234",
      "gold_grams": 0.0114,
      "rate": 8771.50
    }
  ]
}

3. Webhook — autopay mandate event

POST https://your-app.example.com/webhooks/pluto
X-Pluto-Signature: t=1714377600,v1=2c4a...
Content-Type: application/json

{
  "event": "mandate.debited",
  "mandate": {
    "umn": "UPI/MNDT/abcd1234",
    "frequency": "MONTHLY",
    "amount": 1000.00,
    "currency": "INR",
    "scheme": "PLUTO_FIXED",
    "status": "DEBIT_SUCCESS",
    "utr": "428913009999",
    "ts": "2026-04-29T05:00:00+05:30"
  }
}

// Verify HMAC-SHA256 over (timestamp + "." + raw_body)
// Reject if drift > 5 min or signature mismatch.

Deliverables checklist

• OpenAPI / Swagger spec covering auth, mandate, statement, gold, P2P, withdrawal endpoints
• Protocol & auth flow report (OTP login, token refresh, signature scheme)
• Runnable Python and Node.js source modules with unit tests
• HMAC-signed webhook receiver template plus replay-protection example
• Compliance brief covering AA, UPI 2.0 e-mandate, RBI NBFC-P2P, and DPDP 2023 alignment
• Postman collection and curl recipes for every endpoint

Engagement workflow

1. Scope confirmation — pick the modules you actually need (e.g. mandate sync only, or full portfolio).
2. Protocol analysis & API design (2–5 business days).
3. Build & internal validation (3–8 business days).
4. Documentation, sample clients, and test cases (1–2 business days).
5. Typical first delivery: 5–15 business days, depending on third-party approvals.

About our studio

We are an independent technical studio specialising in App interface integration and authorized API integration. Our engineers come from banks, payment gateways, protocol-analysis labs, and cloud infrastructure teams, and have shipped Indian-fintech integrations for years. We understand UPI 2.0, NPCI, RBI, and the Account Aggregator framework, and we ship end-to-end financial APIs under explicit privacy and compliance constraints.

• Coverage across payments, digital banking, insurtech, and cross-border clearing
• Enterprise API gateways, signature schemes, and security reviews
• Custom Python / Node.js / Go SDKs and test harnesses
• End-to-end pipeline: protocol analysis → build → validation → compliance
• Source code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted endpoints, pay only for the calls you make, no upfront cost

Contact

For quotes, sandbox access, or to submit your target app and requirements, open our contact page:

Contact page

We respond on the same business day in most cases. NDAs are available on request before any code or protocol material is exchanged.

FAQ

What do you need from me to start?

Do you handle compliance review?

How is data secured in transit and at rest?

Can I switch from source-code delivery to pay-per-call later?

Long-tail keywords this page targets

• Pluto Money API integration India
• UPI autopay mandate export OpenFinance
• Digital gold holdings statement API
• P2P RBI-certified scheme data extraction
• Account Aggregator-aligned micro-savings sync