Reaching the loan ledger inside CóLiền: Vay Online Uy Tín

A single CóLiền account is not one number. The app describes loans of 500,000 to 50,000,000 VND repaid over 90 to 365 days across as many as 12 periods, with the interest and principal for each period shown in-app — that is per its Play Store listing, where a worked example splits a 50,000,000 VND loan into four 30-day installments. Behind a logged-in borrower sit a credit-limit assessment, a repayment schedule, a cost breakdown, identity records tied to a Vietnamese citizen ID, and the bank account the disbursement lands in. That is the material worth integrating, and most of it never leaves the authenticated session unless something reads it deliberately.

The route we would take here is a consent-based read of the app's own traffic, normalized into a clean schema. Where a participant wants the integration to sit inside a supervised channel, the State Bank of Vietnam sandbox names Open API as a sanctioned path. Both lead to the same deliverable: a documented, runnable way to pull one borrower's loan state on demand.

What CóLiền holds per borrower

Each row maps to a screen a borrower already sees. The integration just makes the same fields readable to a system instead of an eye.

Authorized routes to the loan data

Consented protocol read

With the borrower's authorization, we analyze the request and response chain the app uses for login, limit assessment, loan state and schedule, then rebuild it as a small set of typed calls. This reaches the richest surface — the per-period schedule and cost breakdown — and tracks the app closely. It needs a re-validation step when the front end shifts, which we plan for. This is the route we recommend for CóLiền, because the value is in the installment-level detail and that detail lives inside the session.

Supervised Open API channel

Decree 94/2025/ND-CP, effective 1 July 2025, lets a banking-sector participant run an Open API solution inside the SBV sandbox for up to two years. Where the goal is a durable, supervised feed rather than a one-user read, we design the integration to fit that channel. Setup runs longer and is arranged with you and the relevant counterparties; the payoff is regulatory standing.

User-consented credential session

For a single borrower aggregating their own finances, a consented credential session against their account returns their loan and schedule directly. Narrow by design, and the cleanest basis under Vietnamese data rules.

A look at the request flow

Illustrative shape only — exact endpoints and token format are confirmed during the build against the live app, not asserted here.

# Consented read: authenticate, then pull one borrower's schedule
POST /api/auth/otp/verify
  { "phone": "+84•••", "otp": "######", "device_id": "<bound>" }
  -> 200 { "access_token": "...", "expires_in": 1800 }

GET /api/loan/active
  Authorization: Bearer <access_token>
  -> 200 {
       "loan_id": "...",
       "principal_vnd": 50000000,
       "term_days": 120,
       "periods": 4,
       "apr_pct": 18.25            # within the 36% cap the listing states
     }

GET /api/loan/{loan_id}/schedule
  -> 200 { "installments": [
       { "seq": 1, "due": "...", "principal_vnd": 12500000,
         "interest_vnd": 750000, "status": "due" }, ... ] }

# Handle: token refresh on 401, retry/backoff on 429,
# normalize VND integers, flag any period missing a due date.

The parser keeps amounts as integer dong, never floats, so reconciliation against the borrower's bank record stays exact.

What lands in your repo

• An OpenAPI specification covering the auth handshake, loan read and schedule read, with the VND field types pinned.
• A protocol and auth-flow report: the OTP-to-token sequence, refresh behavior, and the headers the session depends on.
• Runnable source for the key calls in Python or Node.js — limit status, active loan, installment schedule — with retry and token-refresh handled.
• A normalized schema that turns the schedule into one row per installment, ready to load.
• Automated tests built on captured request and response fixtures, so a future change fails loudly.
• Interface documentation plus a short note on consent records and data-retention so the read stays auditable under Vietnamese rules.

Consent and the Vietnamese rulebook

Consumer lending here sits under the State Bank of Vietnam, and personal data sits under the Personal Data Protection Law, in force from 1 January 2026 and built on Decree 13/2023. That framework keeps explicit, voluntary, withdrawable consent as the main legal basis and adds duties specific to finance and credit data. We work to it directly: the consent scope is recorded before any read, the integration is designed so a borrower's withdrawal stops the pull, and we take only the fields the use case needs — a reminders product does not need the full KYC record. Every read is logged, and we sign an NDA where a counterparty wants one. This is how we operate, not a queue of forms put in front of you.

Engineering realities we handle

Two things about CóLiền shape the build, and we account for both.

First, the loan economics are period-based, not a single APR line. The listing shows interest accruing per 30-day period on the outstanding principal. We model the schedule at period granularity so a mirrored ledger matches the app cent for cent, rather than back-computing from an annual rate and drifting.

Second, this is a fast disbursement product — the flow runs from a roughly 5-minute application to funds in the bound bank account, sometimes within minutes. State changes quickly early in a loan's life, so we tune the sync cadence to catch the assessment-to-disbursement transition and design idempotent reads so a retry never double-counts a period. Access for the build is arranged with you during onboarding, against a consenting account or a supervised sandbox, whichever fits the engagement.

Where teams use this

• A personal-finance aggregator showing a consenting user their CóLiền loan and upcoming installments next to other accounts.
• A lender or partner reconciling disbursed principal against the borrower's bank settlement record.
• An arrears or reminders service reading the schedule to flag a period before it falls due.

Screens we mapped against

Sources and review

Data domains come from the app's own Play Store listing and described flow; the regulatory points from the Vietnamese sandbox and data-protection sources below, opened June 2026. Identifiers and figures here are attributed to those sources, not asserted independently.

• CóLiền Google Play listing
• Indochine Counsel — Vietnam's fintech sandbox (Decree 94/2025)
• Hogan Lovells — Vietnam Personal Data Protection Law
• Watson Farley & Williams — Decree 13/2023

Mapped by the OpenBanking Studio integration desk, 25 June 2026.

Other Vietnamese lending and wallet apps in the same orbit

These hold comparable per-user financial state, which is why a single normalized integration layer over several of them is a common ask. Listed for context, not ranked.

• Home Credit Tài Chính Online — installment and cash loans with per-loan schedules and fee disclosure.
• FE ONLINE 2.0 — FE Credit's app, holding declining-rate loans and repayment plans.
• Cake by VPBank — a digital bank with accounts, cards and credit alongside lending.
• MoMo — a wallet with balances, transfers and embedded credit lines.
• Viettel Money — Viettel's wallet and financial services with transaction history.
• Doctor Đồng — short-term online cash loans with limit and schedule data.
• Robocash — automated small online loans, same-day disbursement, per-loan state.
• MoneyCat — installment cash lending with application and schedule records.
• Tima — a lending marketplace connecting borrowers with loan offers and repayment tracking.

Questions integrators ask about CóLiền

Does CóLiền expose installment schedules per borrower, or only a running balance?

Per its Play Store listing the app issues installment loans of 90 to 365 days across up to 12 periods, so each consented account carries a full schedule: principal per period, interest per period, due dates and paid status. A protocol build reads that schedule object, not just the headline outstanding figure, and normalizes it into a per-period structure you can sync.

Is the State Bank of Vietnam fintech sandbox relevant to reaching this app?

It can be. Decree 94/2025/ND-CP, effective 1 July 2025, names Open API as one of three permitted sandbox solutions in the banking sector alongside credit scoring and P2P lending. Where a participant wants a supervised, durable feed we design the integration to sit inside that path; where the need is a direct consented read of one borrower's data, we build against the app's own traffic under that user's authorization.

How does Vietnam's Personal Data Protection Law shape a consented integration?

The Personal Data Protection Law, effective 1 January 2026 and building on Decree 13/2023, keeps explicit, voluntary, withdrawable consent as the main legal basis and adds sector-specific duties for finance and credit data. We record the consent scope, design for revocation, minimize what we pull to the fields the use case needs, and keep an access log so the basis for every read is auditable.

If CóLiền changes its app flow, does the integration stop working?

A consented protocol read tracks the live app, so a front-end or token-format change can shift fields. We isolate the auth and parsing layers so a change touches one module, capture request and response fixtures during the build, and include a re-validation step in maintenance so drift is caught before it reaches your data.

Engagements settle one of two ways for CóLiền. We deliver the runnable source — the OpenAPI spec, the loan and schedule calls, tests and interface docs — for a fixed fee from $300, and you pay only after delivery once it works to your satisfaction; or you skip the build and call our hosted endpoints, paying per call with nothing upfront. Either path runs on a 1 to 2 week cycle. Tell us the app and what you want out of its loan data on our contact page and we will scope it.