Paisabazaar CIBIL score and loan APIs

PB Fintech Limited · Lending

Paisabazaar: Credit Score App is PB Fintech's India consumer-finance marketplace for free bureau credit scores and a side-by-side shop of credit cards, personal loans, business loans and home loans. The Android home grid surfaces credit score, credit cards, personal/business/home loans, BBPS bill pay, fixed deposits, NPS, insurance, PB Money and a credit-health report, with OTP, Truecaller and WhatsApp sign-in and bureau pulls from CIBIL, Experian, Equifax and CRIF Highmark. It competes with BankBazaar, CreditMantri, OneScore and Paytm's credit-score corner for Indian users who want a CIBIL-style score plus a place to apply for cards and loans without visiting each lender's site.

Bureau visitor login mints accessToken, customerId and visitorId once an authorizationCode from the OTP session is exchanged, and the same session carries a glssToken plus site-id on later calls.

SMS inbox uploads attach senderCode, msgAt and content under a device-bound deviceId, while Pukar consent rows pin contractId, contractName and bureau-specific contractTextBureau. Lenders reconciling bureau pulls, bill-pay SMS trails and consent versions can join those identifiers; openData Studio turns them into callable open data.

Screenshots

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

Create customer OTP

POST /v1/auth/otp/request osint

Sends a login OTP for the given mobileNo, productId, visitId and visitorId on the chosen channel.

Auth: site-id header naming the app site plus an authorization-key header carrying an encrypted key.

channel
mobileNo
productId
type
visitId
visitorId
status
statusCode
statusMessage

POST /v1/auth/otp/request HTTP/1.1
site-id: pb-android
authorization-key: <encrypted>
Content-Type: application/json

{
  "channel": ["SMS"],
  "mobileNo": "9876543210",
  "productId": 1,
  "type": "LOGIN",
  "visitId": "v-8f21",
  "visitorId": "vis-91ab"
}

{
  "status": true,
  "statusCode": "200",
  "statusMessage": "OTP sent",
  "response": {
    "mobileNo": "9876543210",
    "visitorId": "vis-91ab"
  }
}

Authorize SSO code

POST /v1/auth/authorize osint

Exchanges the OTP (or an existing glss_token) for an authorizationCode, customerId and a glssToken used on later product logins.

Auth: OAuth-style JSON body with client_id, redirect_uri, scope and siteId; the OTP or an existing glss_token rides on the same payload. site-id and encrypted authorization-key headers as on the OTP request.

client_id
redirect_uri
response_type
auth_type
glss_token
otp
mobileNo
visitorId
authorizationCode
customerId
glssToken
expireAt
glssTokenExpireAt
voiceOtpAllowed

POST /v1/auth/authorize HTTP/1.1
site-id: pb-android
authorization-key: <encrypted>
Content-Type: application/json

{
  "client_id": "consumer-app-android",
  "redirect_uri": "https://www.example.com/login/callback",
  "response_type": "code",
  "scope": "openid",
  "siteId": "pb-android",
  "state": "st-7c2a",
  "auth_type": "otp",
  "otp": "482913",
  "mobileNo": "9876543210",
  "visitorId": "vis-91ab",
  "visitId": "v-8f21"
}

{
  "authorizationCode": "ac-4d55",
  "customerId": "cust-10028441",
  "glssToken": "glss-eyJhbGciOi…",
  "visitorId": "vis-91ab",
  "voiceOtpAllowed": false,
  "mobileNo": "9876543210",
  "expireAt": "2026-10-16T12:30:00Z",
  "state": "st-7c2a",
  "glssTokenExpireAt": "2026-10-16T18:30:00Z",
  "redirectUri": "https://www.example.com/login/callback"
}

SSO logout
GET /v1/auth/logout osint
Ends the single-sign-on session minted by the authorize step.
Auth: site-id and encrypted authorization-key headers plus a query map of session keys after the authorize step.
- status
- statusCode
- statusMessage
```
GET /v1/auth/logout HTTP/1.1
site-id: pb-android
authorization-key: <encrypted>
```
```
{
  "status": true,
  "statusCode": "200",
  "statusMessage": "logged out"
}
```

Verify SSO QR code

POST /v1/auth/qr/verify osint

Confirms a cross-device QR login against the current glssToken.

Auth: site-id and encrypted authorization-key headers; the body carries the live glssToken.

glssToken
qrCode
status
statusCode
statusMessage

POST /v1/auth/qr/verify HTTP/1.1
site-id: pb-android
authorization-key: <encrypted>
Content-Type: application/json

{
  "glssToken": "glss-eyJhbGciOi…",
  "qrCode": "pb-qr-7c2a9e1b"
}

{
  "status": true,
  "statusCode": "200",
  "statusMessage": "verified"
}

Refresh app access token

POST /v1/auth/session/refresh osint

Refreshes the app session against site-id and glss-token and returns accessTokenExpiresAt.

Auth: site-id and glss-token headers; clientId in the JSON body.

clientId
accessTokenExpiresAt
status
statusCode

POST /v1/auth/session/refresh HTTP/1.1
site-id: pb-android
glss-token: glss-eyJhbGciOi…
Content-Type: application/json

{
  "clientId": "consumer-app-android"
}

{
  "status": true,
  "statusCode": "200",
  "response": {
    "accessTokenExpiresAt": "2026-10-16T18:30:00Z"
  }
}

Bureau product SSO login

POST /v1/bureau/session/login openfinance

Exchanges the SSO authorizationCode for a bureau-product accessToken, customerId, mobileNo and visitorId.

Auth: JSON body with the authorizationCode issued by the SSO authorize step.

authorizationCode
accessToken
accessTokenExpiresAt
customerId
mobileNo
visitorId

POST /v1/bureau/session/login HTTP/1.1
Content-Type: application/json

{
  "authorizationCode": "ac-4d55"
}

{
  "status": true,
  "statusCode": "200",
  "response": {
    "accessToken": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…",
    "accessTokenExpiresAt": "2026-10-16T18:30:00Z",
    "customerId": "cust-10028441",
    "mobileNo": "9876543210",
    "visitorId": "vis-91ab"
  }
}

SMS last-sent timestamp
GET /v1/insights/messages/watermark openfinance
Reads the last SMS-upload watermark (custId, ts) before the next inbox batch.
Auth: Signed-in session after SSO authorize; no extra headers beyond the session.
- custId
- ts
```
GET /v1/insights/messages/watermark HTTP/1.1
```
```
{
  "status": true,
  "statusCode": "200",
  "response": {
    "custId": "cust-10028441",
    "ts": 1729084800
  }
}
```

Upload SMS ledger

POST /v1/insights/messages openfinance

Uploads device SMS items (senderCode, msgAt, content) used for bill-pay and underwriting insights; defaults type=SMS and channel=app.

Auth: Signed-in session after SSO authorize; the body carries deviceId.

type
channel
deviceId
messages
senderCode
msgAt
content
custId

POST /v1/insights/messages HTTP/1.1
Content-Type: application/json

{
  "type": "SMS",
  "channel": "app",
  "deviceId": "android-8f21c0",
  "messages": [
    {
      "senderCode": "VK-HDFCBK",
      "msgAt": "2026-10-15T09:14:22+05:30",
      "content": "INR 12,400 spent on HDFC XX4321"
    }
  ]
}

{
  "status": true,
  "statusCode": "200",
  "response": {
    "custId": "cust-10028441"
  }
}

Fetch Pukar consent contract

POST /v1/consents/contract opendata

Loads the active Pukar consent contract (contractId, contractText, bureau-specific contractTextBureau) shown before a bureau pull.

Auth: JSON body; content-type application/json.

contractId
parentContractId
productId
languageCode
screenId
platform
contractName
contractText
contractTextBureau
contractVersionId
isActive
createdAt
updatedAt
status
statusCode
statusMessage

POST /v1/consents/contract HTTP/1.1
Content-Type: application/json

{
  "productId": 1,
  "platform": "android",
  "languageCode": "en"
}

{
  "status": true,
  "statusCode": "200",
  "statusMessage": "OK",
  "response": {
    "contractId": "pk-4412",
    "parentContractId": "pk-4400",
    "productId": 1,
    "languageCode": "en",
    "screenId": 12,
    "platform": "android",
    "contractName": "Bureau pull consent",
    "contractText": "I authorise Paisabazaar to fetch my credit report…",
    "contractTextBureau": "CIBIL / Experian / Equifax / CRIF Highmark…",
    "contractVersionId": "v3",
    "isActive": 1,
    "createdAt": "2026-01-11T00:00:00Z",
    "updatedAt": "2026-09-02T00:00:00Z"
  }
}

Record Pukar user consent
POST /v1/consents/approval opendata
Records that the signed-in user accepted the Pukar contract returned by the consent-contract fetch.
Auth: JSON body identifying the contract being approved.
- contractId
- contractVersionId
- productId
- platform
- status
- statusCode
- statusMessage
```
POST /v1/consents/approval HTTP/1.1
Content-Type: application/json

{
  "contractId": "pk-4412",
  "contractVersionId": "v3",
  "productId": 1,
  "platform": "android"
}
```
```
{
  "status": true,
  "statusCode": "200",
  "statusMessage": "approved"
}
```

Data categories

identity
credit-bureau
sms-insights
consents

Where teams use this data

Bureau-token reconciliation
Lenders join authorizationCode → accessToken → customerId / visitorId / mobileNo across the OTP session and the bureau product login so a CIBIL, Experian, Equifax or CRIF Highmark pull is attributed to one Paisabazaar visitor.
SMS-ledger underwriting
Bill-pay and thin-file models ingest senderCode, msgAt and content batches keyed by deviceId and custId, using the last-sent ts watermark to avoid duplicate SMS rows.
Pukar consent audit
Compliance stacks snapshot contractId, contractVersionId, contractTextBureau and isActive whenever a user accepts a bureau-pull contract, so later disputes can show the exact wording on screen.
Identity-graph matching
Fraud desks stitch visitorId, customerId, mobileNo, glssToken expiry and deviceId to detect recycled OTPs and shared devices across card and loan applications.

Frequently asked questions

What does Paisabazaar show after sign-in?

The home grid covers free bureau credit score, credit cards, personal/business/home loans, BBPS bills, fixed deposits, NPS, insurance, PB Money and a credit-health report, with OTP, Truecaller or WhatsApp login.

Which Indian bureaus does it pull?

CIBIL, Experian, Equifax and CRIF Highmark. A Pukar consent contract (contractId, contractTextBureau) is fetched and accepted before the bureau product login exchanges authorizationCode for accessToken.

What identifiers tie a visitor to a bureau pull?

The OTP session issues customerId, visitorId, mobileNo and glssToken; bureau product login adds accessToken and accessTokenExpiresAt for the same customerId.

Is Paisabazaar only for India?

Yes. The marketplace, bureaus, BBPS billers and loan/card offers are India-only, from PB Fintech (the Policybazaar group).

Apps similar to Paisabazaar: Credit Score App

BankBazaar — BankBazaar is an India personal-finance app for free Experian credit reports, instant-approval credit cards and a side-by-side shop of personal and home loans.
CreditFit — CreditFit by CreditMantri is an India app that shows a free Equifax and CRIF credit score, a credit-health plan, and matched personal-loan and credit-card offers from banks and NBFCs.
OneScore — OneScore is an India credit-score app from FPL Technologies that shows free Experian and CIBIL scores, repayment history and a score planner for building credit.
CRED — CRED is a members-only India app from Dreamplug for paying credit-card bills and UPI, with a free credit-score report used as the 750+ membership gate.
Paytm — Paytm is an India UPI super-app that also lets users check a credit score for free and apply for personal loans inside the same login.
Moneyview — Moneyview is an India finance app for personal and home loans, credit cards, UPI and a Credit Tracker that surfaces a free credit report with score insights.
Kissht: Instant Personal Loans — Kissht is an India digital-lending app for instant personal and business loans aimed at salaried and self-employed borrowers.

More Lending apps

Topics

paisabazaar
cibil score
credit score india
personal loan marketplace
credit card offers
pb fintech
experian india
crif highmark
bbps bills

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

NDA + SOW on every engagement
Delivery in 3–7 days
Payment only after acceptance
Work scoped to authorized use

Get a quote

Paisabazaar CIBIL score and loan APIs

Screenshots

API surface

Create customer OTP

Authorize SSO code

SSO logout

Verify SSO QR code

Refresh app access token

Bureau product SSO login

SMS last-sent timestamp

Upload SMS ledger

Fetch Pukar consent contract

Record Pukar user consent

Data categories

Where teams use this data

Bureau-token reconciliation

SMS-ledger underwriting

Pukar consent audit

Identity-graph matching

Frequently asked questions

Apps similar to Paisabazaar: Credit Score App

More Lending apps

Brigit: Cash Advance & Credit

Cairin: Pinjaman Daring Cepat

CASHe: Quick Personal Loan App

Dave: Credit, Cash & Money App

Topics

Need this app's data API integrated?

Paisabazaar CIBIL score and loan APIs

Screenshots

API surface

Create customer OTP

Authorize SSO code

SSO logout

Verify SSO QR code

Refresh app access token

Bureau product SSO login

SMS last-sent timestamp

Upload SMS ledger

Fetch Pukar consent contract

Record Pukar user consent

Data categories

Where teams use this data

Bureau-token reconciliation

SMS-ledger underwriting

Pukar consent audit

Identity-graph matching

Frequently asked questions

Related apps

Apps similar to Paisabazaar: Credit Score App

More Lending apps

Brigit: Cash Advance & Credit

Cairin: Pinjaman Daring Cepat

CASHe: Quick Personal Loan App

Dave: Credit, Cash & Money App

Topics

Need this app's data API integrated?