UBL Digital - Safe Banking: API integration & OpenBanking services

Account & Smart Account API

Mirror the in-app onboarding: CNIC submission, biometric verification (NADRA Verisys), Smart Account creation, and Debit card issuance status. Use case: digital lender onboarding pipelines that reuse the bank's KYC outcome instead of re-collecting documents.

Statement & mini-statement export

Pull full historical statements for any date range, plus the in-app "mini statement" (last 10 transactions). Output formats: JSON, CSV, Excel, and PDF. Use case: SME accounting tools that auto-reconcile UBL transactions with sales receipts.

Raast & IBFT transfer API

Initiate or replay funds transfers via account number, CNIC, mobile number (Raast ID), or QR. Returns Raast transaction reference, settlement timestamp, and beneficiary echo. Use case: payroll runs, bulk vendor payments, and embedded treasury inside ERPs.

Bill payment & scheduled payments

Wraps the in-app utility, government, and education biller catalog plus scheduled / recurring payment configuration. Returns biller code, due amount, and consumer reference. Use case: BPM systems that automate utility settlement for property managers and SMEs.

Card controls & limits

Lock/unlock debit cards, raise per-channel limits (up to PKR 10 million), enable/disable NetBanking access, and request new cards or chequebooks. Use case: corporate spend dashboards that enforce policy windows on employee cards.

Branch, ATM & promo discovery

Geo-filtered branch and ATM locator plus card-discount and promotion alerts. Returns lat/lng, services, opening hours, and promo metadata. Use case: in-app maps for fintech partners and travel super-apps that surface UBL ATMs alongside their own services.

1. SME accounting reconciliation

A Pakistan-based bookkeeping SaaS connects its merchant clients' UBL accounts, pulls ranged statements daily, and matches each Raast/IBFT credit to an open invoice. Data involved: statement.transaction stream + biller / payer text. OpenBanking mapping: AISP-style account information service exposed as an internal REST endpoint with consent records.

2. Embedded payroll for a payroll fintech

A payroll product issues bulk Raast transfers to thousands of employees. Each call returns a transaction reference and final settlement state. Data involved: transfer.raast + transfer.status webhook. OpenBanking mapping: PISP-style payment initiation, with idempotency keys and retry-safe envelopes.

3. Diaspora remittance dashboard

A remittance aggregator surfaces inbound credits from UBL's 100+ global partners (e.g. Western Union, MoneyGram, exchange houses) inside its own app, with FX rate, sender country, and fee. Data involved: remittance.inbound events. OpenBanking mapping: account information + value-added FX analytics layer.

4. Corporate card & limit policy engine

A corporate finance platform programmatically locks debit cards outside business hours, raises limits ad-hoc for travel, and audits NetBanking access changes. Data involved: card.controls + audit log. OpenBanking mapping: customer-consented control APIs with logged justification per change.

5. UBL Digital UAE / cross-border treasury

Multinational SMEs running UBL Digital UAE, Qatar, and Pakistan accounts get a single consolidated cash position. Data involved: balance.multi_account + FX rates. OpenBanking mapping: aggregator endpoint that normalizes per-jurisdiction accounts into a unified cash report.

Login & session refresh

// Login (UBL Digital protocol-analysis wrapper)
POST /api/v1/ubl/auth/login
Content-Type: application/json
X-Device-Id: <device_fingerprint>

{
  "username": "92300xxxxxxx",
  "password_enc": "<RSA-OAEP encrypted>",
  "biometric_token": "<optional, from Android Keystore>"
}

// Response
{
  "access_token": "ey...",
  "refresh_token": "rt...",
  "expires_in": 900,
  "session_state": "ACTIVE",
  "step_up_required": false
}

Statement query (date-ranged)

POST /api/v1/ubl/statement
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: stmt-2026-04-001

{
  "iban": "PK36UNIL0109000XXXXXXXX",
  "from_date": "2026-03-01",
  "to_date":   "2026-03-31",
  "format":    "json",  // or "xlsx" / "pdf"
  "channels":  ["RAAST","IBFT","ATM","POS","BILL"]
}

// Response (truncated)
{
  "balance_close": 1834500.21,
  "currency": "PKR",
  "items": [
    {"id":"T1","ts":"2026-03-04T10:21:00+05:00",
     "channel":"RAAST","amount":-25000,
     "counterparty":"AHMED A. (raast:0300xxxxxxx)",
     "ref":"RAAST-2026030412345"}
  ],
  "page": {"next": null}
}

Raast transfer + webhook

// Initiate transfer
POST /api/v1/ubl/transfer/raast
Authorization: Bearer <ACCESS_TOKEN>
Idempotency-Key: pay-2026-04-28-001

{
  "from_iban":  "PK36UNIL0109000XXXXXXXX",
  "to_raast_id":"03001234567",
  "amount":     1500.00,
  "purpose":    "VENDOR",
  "remarks":    "April invoice #INV-1182"
}

// Webhook (status update)
POST <your_webhook_url>
{
  "event": "transfer.raast.settled",
  "ref":   "RAAST-2026042899012",
  "status":"SETTLED",
  "fee":   0.00,
  "settled_at":"2026-04-28T11:02:11+05:00"
}

// Errors are returned as RFC 7807 problem+json
// e.g. 409 duplicate_idempotency_key, 422 limit_exceeded

Deliverables checklist

• API specification (OpenAPI 3.1 / Swagger) covering login, statement, Raast, bill pay, and card controls
• Protocol and auth flow report (token chain, device binding, biometric step-up, certificate pinning notes)
• Runnable source for login, statement, and Raast clients (Python / Node.js / Go on request)
• Automated tests, sandbox fixtures, and end-to-end API documentation
• Compliance guidance aligned with SBP, PDPL (UAE), and PSD2-style patterns for UBL UK

Engagement workflow

1. Scope confirmation: target flows (login, statement, Raast, card controls, etc.)
2. Protocol analysis and API design (2–5 business days)
3. Build and internal validation against real-world payloads (3–8 business days)
4. Docs, samples, and test cases (1–2 business days)
5. Typical first delivery: 5–15 business days; bank-side approvals may extend timelines.

Recent change worth noting

In 2024–2025 UBL Digital added an in-app mini statement (last 10 transactions for a quick snapshot), direct download of Account Maintenance and Account Balance certificates, expanded ESFCA-to-PKR funds transfer, and broader Wear OS tiles for balance checks and favorite payments. We track these flows and add them to integrations as customers request them.

About us

We are an independent technical service studio focused on App interface integration and authorized API integration, with hands-on experience across mobile applications and fintech. Our team has shipped protocol analysis, OpenData / OpenBanking integration, and third-party API work for banking, payments, e-commerce, OTT media, and travel apps. We understand SBP expectations in Pakistan, UAE / Qatar central bank rules, and broader privacy regimes such as GDPR.

• Banking, payments, remittance, and cross-border clearing integrations
• Protocol analysis (reverse engineering of mobile auth and transaction flows under authorization)
• Custom Python / Node.js / Go SDKs, test harnesses, and OpenAPI specs
• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted API and pay only per call, no upfront cost; useful for teams that prefer usage-based pricing

Contact

For quotes or to submit your target app and requirements, open our contact page:

Contact page

Two engagement models: (1) source code delivery from $300 with payment after satisfaction, (2) pay-per-call hosted API with no upfront fee.

FAQ

What do you need from me?

How long does delivery take?

How do you handle compliance?

Do you cover the Wear OS subset?

Long-tail keywords we target

• UBL Digital statement API integration Pakistan
• UBL Digital Raast transfer API and webhooks
• UBL Digital OpenBanking SBP regulatory sandbox
• UBL Digital Smart Account onboarding KYC API
• UBL Digital UAE / Qatar / UK cross-border consolidation