The Boubyan App API integration services (OpenBanking / OpenData)

Deliverables checklist

• API specification (OpenAPI / Swagger) for every modelled Boubyan flow
• Protocol and auth-flow report: device binding, OTP/login, token refresh, cookie/header chain
• Runnable source for login, account list, transaction history and statement export (Python and Node.js)
• WAMD send/receive client plus webhook receiver for settlement events
• Automated test suite, Postman collection and a deployment guide
• Compliance pack: consent records, data-minimisation notes, retention guidance, PCI DSS handling for card fields

Two engagement models

• Source-code delivery from $300 — you receive runnable API source and full documentation; pay after delivery once you are satisfied.
• Pay-per-call hosted API — call our managed endpoints and pay only per request, no upfront cost; good for teams that want usage-based pricing and no maintenance.
• Both models include a scoping call, a sandbox walkthrough and 30 days of integration support.

1 · Month-end reconciliation for a Kuwaiti SME

Business context: a trading company keeps its operating accounts at Boubyan and closes books monthly in an ERP. Data/API involved: POST /v1/boubyan/auth for a consented session, then GET /v1/boubyan/accounts and GET /v1/boubyan/transactions?from=&to= with paging. OpenBanking mapping: this mirrors a PSD2-style "account information service" — read-only access to balances and dated transactions, scoped by explicit user consent, returned as normalised JSON the ERP ingests nightly.

2 · WAMD payout automation

Business context: a marketplace refunds sellers and gig workers who only share a mobile number. Data/API involved: POST /v1/boubyan/wamd/transfers with recipient_mobile, amount, reference; settlement arrives via webhook: wamd.transfer.settled. OpenBanking mapping: this is a "payment initiation service" pattern on top of Kuwait's KNET WAMD real-time rail — the integrator never touches card data, only initiates and reconciles credit transfers.

3 · Statement export for lending & KYC

Business context: a fintech underwrites consumer finance and needs six months of verified statements. Data/API involved: POST /v1/boubyan/statements returning a signed PDF + structured Excel for the requested period; transactions are also streamed as JSON for scoring. OpenBanking mapping: account verification and affordability checks built on consented, machine-readable statements rather than uploaded screenshots — auditable and tamper-evident.

4 · Cross-border remittance dashboard

Business context: a corporate treasury sends supplier payments abroad and via Western Union from Boubyan. Data/API involved: GET /v1/boubyan/remittances with corridor, FX rate, status and MTCN; status updates via webhook: remittance.status.changed. OpenBanking mapping: an OpenFinance "transaction data" feed extended to international flows, feeding an FX and compliance dashboard with screening logs.

5 · Card lifecycle & deposit maturity automation

Business context: a wealth app wants to remind users before a fixed deposit matures and surface card issues. Data/API involved: GET /v1/boubyan/cards, POST /v1/boubyan/cards/{id}/pin (change request), GET /v1/boubyan/deposits with maturity dates and instalment schedules. OpenBanking mapping: product-data plus a limited "action" surface — read product state, raise a card request or PIN change, never store sensitive material beyond the session.

Login & session (pseudocode)

POST /v1/boubyan/auth
Content-Type: application/json

{
  "civil_id": "2890XXXXXXXX",
  "device_id": "bnd-7f3c...",
  "otp": "481920"
}

200 OK
{
  "access_token": "eyJhbGci...",      // ~15 min TTL
  "refresh_token": "rt_9a2b...",       // rotated each use
  "consent_id": "cns_3d1e...",
  "scopes": ["accounts.read","tx.read","statements.read","wamd.write"]
}

// Errors: 401 invalid_otp · 423 device_not_bound · 429 too_many_attempts

Transaction history (pseudocode)

GET /v1/boubyan/transactions?account_id=KW81BBYN...&from=2026-04-01&to=2026-04-30&page=1&page_size=100
Authorization: Bearer <ACCESS_TOKEN>
X-Consent-Id: cns_3d1e...

200 OK
{
  "account_id": "KW81BBYN...",
  "currency": "KWD",
  "page": 1, "page_size": 100, "has_more": true,
  "items": [
    {
      "txn_id": "t_88f1",
      "booked_at": "2026-04-27T11:04:00+03:00",
      "amount": -12.500,
      "direction": "debit",
      "counterparty": "TALABAT KUWAIT",
      "category": "food_delivery",          // enriched
      "running_balance": 842.375,
      "channel": "card_pos"
    }
  ]
}

WAMD transfer + webhook (pseudocode)

POST /v1/boubyan/wamd/transfers
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: 5b1f-...

{
  "from_account": "KW81BBYN...",
  "recipient_mobile": "+9655XXXXXXX",
  "amount": 25.000,
  "currency": "KWD",
  "reference": "refund-INV-3391"
}

202 Accepted
{ "transfer_id": "wamd_a91c", "status": "pending" }

// Later, to your endpoint:
POST https://your-app/webhooks/boubyan
{ "event": "wamd.transfer.settled",
  "transfer_id": "wamd_a91c", "status": "settled",
  "settled_at": "2026-04-27T11:05:12+03:00" }
// Verify HMAC in X-Signature header before processing.

Statement export (pseudocode)

POST /v1/boubyan/statements
Authorization: Bearer <ACCESS_TOKEN>

{ "account_id": "KW81BBYN...",
  "from": "2025-11-01", "to": "2026-04-30",
  "formats": ["pdf","xlsx","json"] }

200 OK
{
  "statement_id": "st_44de",
  "pdf_url":  "https://files.../st_44de.pdf?exp=...",
  "xlsx_url": "https://files.../st_44de.xlsx?exp=...",
  "json": { "opening_balance": 1320.000, "closing_balance": 842.375, "lines": [ ... ] }
}
// 404 account_not_found · 422 range_too_large · 409 statement_pending

Regulatory alignment

We operate only under customer authorization or documented, authorized interfaces. Boubyan is supervised by the Central Bank of Kuwait, whose digital-payment guidance and the KNET-operated WAMD real-time scheme rules govern instant transfers. Personal data handling follows Kuwait's CITRA Data Privacy Protection Regulation; any card data touched in scope is handled per PCI DSS; cross-border remittances respect AML/CFT screening obligations. Where applicable to non-resident or UK-linked flows (for example via Boubyan's Nomo digital bank), we also align with UK FCA and UK GDPR expectations.

What we build in by default

• Explicit consent capture with a consent_id stamped on every read; consents are revocable and time-boxed.
• Data minimisation — only the fields you scoped are returned; PANs stay masked unless a justified, logged exception applies.
• Immutable audit log of every API call (who, when, which consent, which records).
• Retention windows you control, plus a documented deletion path; NDAs and a DPA on request.

Kuwait digital banking apps

• Weyay Bank — NBK's digital-only neobank for younger users; holds account, card and instant-payment data. Customers who use Boubyan and Weyay often want one unified transaction export across both.
• NBK Mobile Banking — National Bank of Kuwait's flagship app with accounts, cards, loans and WAMD; a common second connector in corporate reconciliation projects.
• KFH Online — Kuwait Finance House's feature-rich Islamic banking app (payments, QR, KFH Pay over KNet); similar deposit and finance-schedule data shapes to Boubyan.
• Tam (by KFH) — KFH's youth-focused neobank; balances, cards and P2P transfers that map cleanly onto the same OpenData schema.
• Gulf Bank Mobile Banking — strong digital platform with accounts, cards and a WAMD phone-number transfer feature; another GCC connector for treasury dashboards.

More banking apps in the ecosystem

• Warba Bank app — digital-first Islamic bank in Kuwait; current accounts, finance products and instant transfers that benefit from the same statement-export tooling.
• Burgan Bank app — retail and corporate banking with WAMD instant payments; frequently bundled into multi-bank cash-management integrations.
• KIB (Kuwait International Bank) app — Islamic banking with accounts, cards and bill payments; comparable data inventory for reconciliation use cases.
• Nomo Bank — Boubyan-majority-owned UK Islamic digital bank (GBP/USD accounts, Mastercard debit, Apple Pay); relevant when a customer needs Kuwait and UK balances in one view.
• boubyan Boonus — the bank's rewards/loyalty companion; loyalty-point and redemption data that pairs with transaction data for spend analytics.

About us

We are an independent technical studio focused on mobile app interface integration and authorized API integration, with a fintech and open-data specialism. Our engineers come from banks, payment processors, protocol-analysis backgrounds and cloud platforms, and we have shipped account, card, statement and payment APIs for clients across the GCC and beyond.

• Digital banking, payments, remittances, insurtech and cross-border clearing
• Enterprise API gateways, SDKs (Python / Node.js / Go) and security reviews
• End-to-end delivery: protocol analysis → build → validation → compliance pack
• Source-code delivery from $300 — runnable API source plus full docs; pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing, no upfront cost, no maintenance burden on your side

Contact

To request a quote or submit your target app and requirements, open our contact page. Tell us which Boubyan data you need (transactions, balances, statements, WAMD, deposits) and your preferred engagement model.

Contact page

Engagement workflow

1. Scope confirmation — which Boubyan flows you need (login, accounts, transactions, statements, WAMD, cards, deposits) and the engagement model.
2. Protocol analysis and API design — device binding, auth, token refresh, endpoint mapping (2–5 business days, complexity-dependent).
3. Build and internal validation against sandbox / authorized access (3–8 business days).
4. Documentation, Postman collection, sample apps and automated tests (1–2 business days).
5. Handover and 30 days of support; first delivery typically 5–15 business days, longer for real-time webhooks or multi-account corporate flows.

FAQ

What do you need from me to start a Boubyan App integration?

How long does delivery take?

How do you handle compliance and privacy?

Can you cover WAMD instant payments and Western Union transfers?