Serasa: Consulta CPF e Score — API integration & OpenFinance Brasil

1. Lending platform credit decisioning

A digital lender wires Serasa CPF + Score into its origination engine. On loan application, the system requests the user's consent, pulls the latest Score, debt lines and a 6-month score trend, and feeds those features to its risk model. The same pipeline writes back to a feature store for ongoing portfolio monitoring.

2. Real-time score uplift after Pix repayment

A debt-negotiation product needs to prove the score moves after a deal closes. After the user pays a settlement via Pix, our integration polls the Score endpoint within 20–60 seconds and shows the updated 0–1000 value back in the customer journey, mirroring Serasa's real-time score architecture launched in 2024.

3. Fraud & identity-protection app

A SaaS that watches CPFs for misuse subscribes to inquiry alerts and Dark Web leak events through webhook callbacks. When Serasa emits a new event, our connector normalises the payload and forwards it to the customer's notification service (email, SMS, push) with a deduplication key on inquirer + timestamp.

4. Personal finance dashboard

A PFM app shows Serasa wallet transactions alongside the user's bank statements pulled through Open Finance Brasil. Our integration normalises both feeds into a single transaction schema (id, posted_at, amount, type, category) so the dashboard can categorise spend and surface insights.

5. Marketplace credit offers

An affiliate marketplace ingests the Serasa "Ofertas" feed and combines it with the user's score band to recommend only realistic credit-card and loan offers. Conversion telemetry is pushed back so the marketplace can rank offers by accepted-rate per score band.

Auth: OAuth 2.0 + FAPI-style consent

POST /oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTH_CODE_FROM_CONSENT
&redirect_uri=https://your.app/cb
&client_id=CLIENT_ID
&code_verifier=PKCE_VERIFIER

Response:
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "REFRESH...",
  "consent_id": "urn:bcb:consent:01H..."
}

Read Serasa Score

GET /api/v1/serasa/score?cpf=12345678901
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: urn:bcb:consent:01H...

Response 200:
{
  "cpf": "123.***.***-01",
  "score": 742,
  "band": "BOM",
  "scale_max": 1000,
  "factors": [
    {"code":"PAY_HISTORY","weight":0.42},
    {"code":"NEG_RECORDS","weight":0.31},
    {"code":"AGE_OF_DATA","weight":0.18}
  ],
  "updated_at": "2026-05-09T14:21:08-03:00",
  "realtime": true
}

Webhook: CPF inquiry alert

POST https://your.app/serasa/webhooks/inquiry
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "cpf.inquiry",
  "event_id": "evt_01H9...",
  "cpf_masked": "123.***.***-01",
  "inquirer": {
    "name": "BANCO XYZ S/A",
    "cnpj": "00.000.000/0001-00"
  },
  "product": "credit_card",
  "occurred_at": "2026-05-09T16:02:45-03:00"
}

// Verify HMAC, dedupe on event_id, fan-out to user notifier.

List wallet transactions

POST /api/v1/serasa/wallet/transactions
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "types":     ["BILL_PAYMENT","MOBILE_TOPUP","PIX_OUT"],
  "page": 1, "page_size": 50
}

Response:
{ "page": 1, "total": 37, "items": [
    {"id":"tx_001","posted_at":"2026-04-03","amount": 89.90,
     "merchant":"ENEL SP","type":"BILL_PAYMENT","status":"OK"}
] }

Brazilian regulatory frame

Every flow we build references three pillars: the Banco Central do Brasil Open Finance regulation, Brazil's LGPD (Lei Geral de Proteção de Dados, Law 13.709/2018), and the Cadastro Positivo regime that governs Serasa, SPC, Boa Vista and Quod. Consent is explicit, time-bound and revocable; logs are persisted so an audit can trace every byte of CPF data.

Security profile

We follow the Open Finance Brasil FAPI security profile: TLS 1.2+, mTLS for server-to-server, signed JWTs and PKCE for mobile clients. CPF values are tokenized at rest, masked in logs (e.g. 123.***.***-01) and the access-token lifetime defaults to 15 minutes with refresh rotation.

Data minimisation

Each consent scope only requests the fields you actually need — for a credit-card marketplace that may be score band + offers feed; for collections it may be debt lines + repayment status. The consent UI shows the exact list before the user approves.

Data flow / architecture

Client app → OpenFinance Lab API gateway (mTLS, FAPI) → Serasa endpoints (developer.serasaexperian.com.br / Open Finance Brasil) → Encrypted storage (PII tokenized) → Your backend (REST/webhook). A consent ledger sits beside the gateway so every read can be traced back to a Banco Central consent ID.

SPC Brasil (SPC Consumidor)

The credit bureau run by CNDL with its own 0–1000 Score. Teams that pull Serasa often also need SPC for a second opinion on negative records, since lenders cross-check both bureaus.

Boa Vista (Acordo Certo)

Operator of SCPC and a major debt-negotiation marketplace. Useful when a project needs to surface settlement offers next to a customer's Serasa Score and debt list.

Quod

Bureau co-founded by the largest Brazilian banks, now shipping FICO-powered small-business scores. Sits naturally beside Serasa for SME credit decisioning.

Nubank

Largest digital bank in Latin America with 100M+ customers. Open Finance Brasil exports from Nubank pair well with Serasa Score to build full-picture credit dashboards.

PicPay

P2P wallet with 66M registered users; processed R$227.9B in H1 2025. Often wired up alongside Serasa for spend insights and identity verification flows.

Mercado Pago

MercadoLibre's financial arm with 78M monthly active users and $18.8B in assets. Combined with Serasa for marketplace lending and seller onboarding.

Banco Inter

Digital super-app covering banking, investments and shopping. A common counterpart in personal-finance integrations that want both bank statements and credit-score context.

C6 Bank

Full-service digital bank with global accounts and a strong investment side. Open Finance Brasil exports from C6 plus Serasa give a complete consumer credit picture.

Caixa Tem

State-owned banking app heavily used for social-program payouts. Important when projects target underbanked Brazilians whose primary financial footprint sits there alongside Serasa.

Neon

Digital bank focused on workers and small business. Frequently paired with Serasa for payroll-anchored credit underwriting.

Deliverables checklist

• OpenAPI / Swagger specification for every Serasa endpoint in scope
• Protocol and auth-flow report (OAuth 2.0 / FAPI / consent ledger)
• Runnable source code in Python and Node.js (login, CPF report, Score, wallet, webhooks)
• Postman collection plus a smoke-test suite with mocked responses
• LGPD compliance notes: consent UX, retention windows, deletion endpoints
• Optional managed endpoints on our infrastructure with per-call billing

Engagement workflow

1. Scope: which Serasa surfaces (CPF, Score, debts, alerts, wallet) and which downstream systems consume them.
2. Protocol analysis and API design — 2–5 business days.
3. Build and internal validation — 3–8 business days with daily updates.
4. Docs, samples and test cases — 1–2 business days.
5. First delivery in 5–15 business days; bureau approvals can extend timelines.

About OpenFinance Lab

We are an independent studio specialised in mobile app protocol analysis and authorized API integration, with hands-on experience across fintech, banking, e-commerce and travel. For Brazilian work we lean on engineers who have shipped against Serasa Experian, Open Finance Brasil, Pix and the four major credit bureaus. We deliver under either a source-code model (from $300, pay on acceptance) or pay-per-call hosted endpoints with no upfront cost.

• Authorized data only — no scraping, no credential reuse
• Production-grade error handling, idempotency keys, retry policies
• Source code delivered with full unit + integration tests
• Optional NDA, source escrow and on-call support packages

Contact

Send us the target app, the data surfaces you need and any constraints (region, compliance, latency). We respond within one business day with a scope estimate and timeline.

Open the contact page