SAIB Mobile API integration services (KSA OpenBanking / OpenFinance)

Deliverables checklist

• API specification in OpenAPI / Swagger form, covering login, accounts, transactions, cards, finance and loyalty resources
• Protocol and authorization report: token lifecycle, refresh flow, mTLS / certificate chain, consent scopes
• Runnable source code for account, statement and card endpoints in Python and Node.js (Go on request)
• Automated test suite, sandbox fixtures and Postman / HTTP collection
• Compliance pack: SAMA Open Banking alignment notes, consent and SCA handling, data-minimization and retention guidance
• Operations notes: rate limits, pagination, error codes, retry and idempotency strategy

Two engagement models

Source code delivery from $300: we hand over runnable API source code plus full documentation and tests; you pay after delivery once you are satisfied.

Pay-per-call hosted API: connect to our managed endpoints and pay only for the calls you make, with no upfront fee — suited to teams that prefer usage-based pricing or want to validate a flow before committing to a full build.

Both models support Android and iOS targets and ship with the same documentation and test plan.

1. Accounting & ERP reconciliation

Context: a Saudi SME wants its SAIB current account and card spend reflected automatically in its accounting suite. Data/API: the account list and transaction statement endpoints, pulled nightly with a date-range cursor. OpenFinance mapping: a SAMA-style Account Information consent grants read-only access; transactions are normalized to a ledger schema and pushed to the ERP, eliminating manual statement uploads.

2. Personal finance & account aggregation

Context: a budgeting app shows a customer all their balances across SAIB and other Saudi banks. Data/API: balances, categorized transactions, card limits and loan schedules. OpenBanking mapping: the customer authorizes data sharing through SAIB Mobile or internet banking; the aggregator reads via consented AIS scopes and refreshes on a schedule, with the customer able to revoke at any time.

3. Lending & affordability decisioning

Context: a lender or BNPL provider needs verified income and obligations before approving credit. Data/API: 6–12 months of transaction statements plus existing finance-product repayment schedules and overdue flags. OpenFinance mapping: a time-boxed consent returns the data; we compute inflow stability and debt-service ratios server-side so the lender only stores derived scores, not raw statements.

4. Treasury & multi-account dashboards

Context: a corporate finance team monitors several SAIB accounts plus cards in one screen. Data/API: account balances polled intraday, transaction deltas, and a webhook for new postings. OpenData mapping: a Client App → Ingestion API → time-series store → BI layer pipeline turns raw postings into liquidity and burn-rate views.

5. Loyalty & rewards reconciliation

Context: a partner running a co-branded offer needs to confirm point accrual and redemption against SAIB's loyalty marketplace. Data/API: loyalty points balance, accrual/redemption history and available vouchers. OpenData mapping: a periodic export feeds a reconciliation job that matches partner-side transactions to bank-side point events and flags discrepancies.

A. Authorize & obtain an access token

// Step 1: exchange an authorization grant for a scoped token (pseudocode)
POST /open-banking/oauth2/token
Content-Type: application/x-www-form-urlencoded
// mutual TLS: client presents its X.509 certificate

grant_type=authorization_code
&code=<AUTH_CODE_FROM_CUSTOMER_CONSENT>
&redirect_uri=https://app.example.com/callback
&client_id=<TPP_CLIENT_ID>

200 OK
{
  "access_token": "<ACCESS_TOKEN>",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "<REFRESH_TOKEN>",
  "scope": "accounts:read transactions:read cards:read",
  "consent_id": "cns_8f21a0"
}

B. Fetch a transaction statement

// Step 2: paged transaction history for a consented account
GET /open-banking/accounts/{accountId}/transactions
  ?fromBookingDate=2026-03-01
  &toBookingDate=2026-03-31
  &page=1&pageSize=100
Authorization: Bearer <ACCESS_TOKEN>
x-consent-id: cns_8f21a0

200 OK
{
  "accountId": "SA03-XXXX-1042",
  "currency": "SAR",
  "page": 1, "pageSize": 100, "totalPages": 3,
  "transactions": [
    {
      "transactionId": "txn_55012",
      "bookingDate": "2026-03-04",
      "valueDate": "2026-03-04",
      "amount": -239.50, "currency": "SAR",
      "creditDebit": "DEBIT",
      "channel": "POS", "category": "groceries",
      "counterparty": "Carrefour Riyadh",
      "balanceAfter": 8421.10
    }
  ]
}

C. Card list & webhook for new postings

// Cards with limits (pseudocode)
GET /open-banking/cards
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{ "cards": [
  { "cardId":"crd_7781","type":"mada","maskedPan":"•••• 4417",
    "status":"ACTIVE","availableLimit":3500.00,"currency":"SAR" },
  { "cardId":"crd_8820","type":"credit","maskedPan":"•••• 9032",
    "status":"ACTIVE","creditLimit":20000.00,"outstanding":4310.75 }
]}

// Webhook delivered to your endpoint when a new transaction posts
POST https://app.example.com/hooks/saib
X-Signature: sha256=<HMAC>
{ "event":"transaction.created","accountId":"SA03-XXXX-1042",
  "transactionId":"txn_55013","amount":-89.00,"currency":"SAR" }

// Error handling: 401 -> refresh token; 403 consent_expired -> re-consent;
// 429 -> honour Retry-After; 5xx -> exponential backoff with idempotency key

Regulatory alignment

Integrations follow the Saudi Central Bank (SAMA) Open Banking Framework — launched for Account Information Services in November 2022, extended to Payment Initiation Services in September 2024 — which mandates explicit customer consent, Strong Customer Authentication, Third-Party Provider verification and standardized APIs. SAIB's own developer portal secures access with mutual TLS and X.509 client certificates. We also align handling with Saudi Arabia's Personal Data Protection Law (PDPL) and, for cross-border or EU-touching flows, with PSD2/GDPR-equivalent practices. Background reading: Open banking (Wikipedia).

How we keep data safe

• Authorized or documented public APIs only — no unauthorized access
• Scoped, time-boxed consent; tokens refreshed, never over-collected
• Full request/response logging and tamper-evident audit trail
• Data minimization: store only what the use case needs, masked or tokenized at rest
• Configurable retention and deletion; NDA and DPA available
• Consent revocation honoured immediately, mirroring the in-app control

About us

We are an independent technical studio focused on app interface integration and authorized API work for fintech and banking products. Our engineers come from retail banks, payment gateways, protocol-analysis teams and cloud platforms, and we have hands-on experience with open banking programmes across the Gulf and beyond.

• Coverage: digital banking, cards, lending, wealth, and loyalty/rewards integrations
• Enterprise API gateways, security reviews and consent management design
• Custom Python / Node.js / Go SDKs, test harnesses and sandbox fixtures
• Full pipeline: protocol analysis → build → validation → compliance documentation
• Source code delivery from $300 — runnable API source plus documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — access our endpoints and pay only per call, no upfront cost

Contact

Send us your target app and requirements — for SAIB Mobile that means which data you need (balances, statements, card transactions, loan schedules, investments, loyalty points), the volume, and any sandbox or TPP onboarding you already hold. We reply with scope, timeline and a quote.

Contact page

Engagement workflow

1. Scope confirmation: target screens, data types and API needs (login, accounts, statements, cards, finance, loyalty).
2. Protocol analysis and API design — 2–5 business days depending on complexity.
3. Build and internal validation against sandbox or authorized endpoints — 3–8 business days.
4. Documentation, sample code and test cases — 1–2 business days.
5. Typical first delivery: 5–15 business days; regulator or third-party approvals may extend the timeline.

FAQ

What do you need from me to start a SAIB Mobile integration?

How long does delivery take?

How do you handle compliance and customer consent?

Do you deliver source code or a hosted API?