Ximple: Crece tu negocio — API integration & OpenFinance services

What this page covers

This is a technical positioning page for teams that need programmatic access to data held inside Ximple: Crece tu negocio. It maps the app's features onto OpenData, OpenFinance and OpenBanking patterns, lists the data we can surface, walks through realistic integration scenarios, and shows the kind of request/response shapes and authentication flow we deliver. Everything here is framed around authorized access — customer-consented account data, documented public endpoints, or partner-brand credentials you already hold — not unauthorized scraping.

Ximple was founded in early 2024 by Daniel Sujo, Rodrigo Aparicio, Juan Pablo Salem and Joao Ramos, and runs a 100% digital onboarding flow that needs only an INE (Mexican national ID) and no physical collateral. In February 2025 the company launched a credit card built with DOCK and Mastercard so catalog sellers can extend credit to their own buyers — a change that adds card-level transaction data on top of the original loan ledger, and one of the main reasons an integration today is worth more than it would have been a year earlier.

Feature modules we build

Data available for integration (OpenData perspective)

The table below summarizes the structured data Ximple holds that is realistically exposable through an authorized API layer, where in the app it originates, how granular it is, and what teams typically do with it. Field names are illustrative — the exact schema is confirmed during scoping.

Typical integration scenarios

Technical implementation

Below are representative request/response shapes from a delivered Ximple integration layer. Authentication is OAuth 2.0 bearer tokens issued after an authorized consent step; tokens are short-lived and refreshed. All responses are JSON; list endpoints are cursor-paginated; webhooks are HMAC-signed.

POST /api/v1/auth/token
Content-Type: application/json

{
  "grant_type": "authorization_code",
  "code": "<CONSENT_CODE>",
  "client_id": "<CLIENT_ID>",
  "client_secret": "<CLIENT_SECRET>"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 1800,
  "refresh_token": "rt_9f2c...",
  "scope": "loans:read repayments:read disbursements:read"
}

GET /api/v1/merchants/MX-48211/credit-line
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "merchant_id": "MX-48211",
  "currency": "MXN",
  "limit": 150000,
  "drawn": 92400,
  "available": 57600,
  "apr": 0.0,            // illustrative
  "status": "active",
  "loans": [
    {
      "loan_id": "LN-7731",
      "principal": 92400,
      "term_days": 105,
      "origination_date": "2026-04-02",
      "state": "current",
      "schedule": [
        {"n":1,"due_date":"2026-05-02","amount":31200,"paid_date":"2026-05-01","dpd":0},
        {"n":2,"due_date":"2026-06-01","amount":31200,"paid_date":null,"dpd":0},
        {"n":3,"due_date":"2026-07-01","amount":31200,"paid_date":null,"dpd":0}
      ]
    }
  ]
}

POST https://your-app.example/webhooks/ximple
X-Ximple-Signature: sha256=3b8a...
Content-Type: application/json

{
  "event": "loan.disbursed",
  "event_id": "evt_01HZX...",
  "occurred_at": "2026-05-09T17:24:05Z",
  "data": {
    "loan_id": "LN-7731",
    "merchant_id": "MX-48211",
    "amount": 92400,
    "currency": "MXN",
    "channel": "card_load",        // or "cash_out_location"
    "reference": "CARD-****4417"
  }
}

# Respond 2xx within 5s or the event is retried with backoff.
# Verify: HMAC-SHA256(raw_body, webhook_secret) == X-Ximple-Signature

import requests, time

BASE = "https://api.example/v1"
S = requests.Session()
S.headers["Authorization"] = f"Bearer {token}"

def repayments(since):
    cursor, out = None, []
    while True:
        r = S.get(f"{BASE}/repayments",
                  params={"since": since, "cursor": cursor})
        if r.status_code == 429:           # rate limited
            time.sleep(int(r.headers.get("Retry-After", "2")))
            continue
        r.raise_for_status()               # 4xx/5xx -> exception
        body = r.json()
        out += body["items"]
        cursor = body.get("next_cursor")
        if not cursor:
            return out

What we deliver

Compliance & privacy

Ximple operates inside Mexico's financial-technology framework. The Ley para Regular las Instituciones de Tecnología Financiera (Ley Fintech, 2018), supervised by the CNBV and Banxico, sets the open-finance model used here: data is classified as open, aggregated or transactional, and transactional data may only be shared through APIs with the user's explicit consent. In July 2024 the CNBV also tightened fraud-prevention rules for banking institutions, which raises the bar for how connected services handle authentication and monitoring.

Our integrations are built to that standard: we only use authorized access (customer-consented accounts, documented public endpoints, or partner-brand credentials the client legitimately holds), never unauthorized scraping or credential sharing. Personal data is handled under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP); consumer-facing transparency follows CONDUSEF expectations. Every delivery ships with consent logging, an access audit trail, scoped tokens, encryption-in-transit, and a data-minimization review so you collect only the fields a use case actually needs. NDAs and data-processing agreements are signed on request.

Data flow / architecture

A typical Ximple pipeline has four stages: (1) Client app / authorized session — the Ximple app or an authorized account session is the data origin (credit lines, repayments, disbursements, KYC status). (2) Ingestion / API layer — our adapter normalizes requests, manages OAuth tokens and request signing, polls list endpoints and receives signed webhooks. (3) Storage — events and snapshots land in your warehouse or our managed store, partitioned by merchant and date, with PII fields tokenized. (4) Output — a REST API, scheduled export (Excel/JSON/Parquet), or BI feed serves dashboards, collections systems, ERP reconciliation and risk models. Each hop is logged so the consent-and-audit plane the CNBV guidelines expect is satisfied end to end.

Market positioning & user profile

Ximple is a B2B2C fintech: its direct users ("Aliados") are micro-entrepreneurs in Mexico — predominantly women running catalog-sales businesses for major direct-selling brands, plus small neighborhood retailers ("tienditas") the company is expanding toward. They use an Android and iOS app to apply for merchandise credit and, increasingly, to extend credit to their own customers via the DOCK/Mastercard card launched in 2025. The indirect beneficiaries are those customers and the brand partners whose merchandise gets financed. Geographically the focus is Mexico today, with a stated ambition to scale across Latin America; the company has raised roughly US$2.7M in pre-seed equity (led by Alaya Capital, with Norte Ventures and Impact Ventures PSM) alongside a ~US$30M debt facility, and reports on the order of 15,000 active credit lines. For an integrator, that means the data set is growing fast, short-tenor (high event frequency), and built on alternative data rather than bureau files — a profile that rewards automated pipelines over manual exports.

Screenshots

Tap any screenshot to enlarge. These are the public Google Play store images for Ximple: Crece tu negocio and illustrate the screens that the data above originates from (onboarding, credit dashboard, repayments, customer financing).

Similar apps & the integration landscape

Teams that work with Ximple data usually touch other Mexican and Latin-American fintech apps too. The list below is here to map the ecosystem — not to rank or critique anyone — and to make clear that the same OpenData/OpenFinance plumbing (consented account access, transaction exports, reconciliation feeds) carries over from one platform to the next.

• Kueski / Kueski Pay — consumer microloans and buy-now-pay-later in Mexico; holds loan balances and BNPL transaction records that teams often want exported alongside Ximple repayment data.
• Konfío — SME lending and a business credit card; its loan and card-transaction data is a frequent companion to merchant-credit datasets like Ximple's.
• Clara — corporate spend management with locally issued cards and bill pay across Mexico, Brazil and Colombia; unified expense and card-transaction exports overlap with Ximple disbursement reconciliation.
• Stori — digital credit card for under-served Mexican users; repayment-history and statement data is the kind of feed an analytics layer pulls next to Ximple's.
• Xepelin — invoice financing, factoring and flexible credit for businesses; receivables and credit-line data complement a merchant working-capital view.
• Albo — neobank accounts and cards for individuals and businesses; account balances and card transactions are commonly merged with lending data for cash-flow analysis.
• Mercado Crédito (Mercado Pago) — embedded credit for sellers and buyers on the Mercado Libre ecosystem; loan and repayment records sit close to Ximple's customer-financing model.
• Covalto (formerly Credijusto) — SME loans and banking services in Mexico; structured loan and statement data is another natural source in a consolidated portfolio export.
• Aviva — credit and financial services aimed at small merchants and families in semi-urban Mexico; merchant credit-line data parallels Ximple's "Aliado" lines.
• R2 — embedded working-capital lending for SMEs through platforms; its drawdown and repayment events line up with the disbursement feeds described above.

If your roadmap involves unified transaction exports across two or more of these platforms, the adapter pattern shown in the technical section — OAuth consent, normalized schemas, signed webhooks, a shared warehouse — is the same one we reuse per app.

About our studio

Workflow & FAQ