Integrating Hạn Mức+: loan eligibility & partner data

<<<<<<< HEAD

App: Hạn Mức+-Cho vay nhanh (com.creditamount.plus, per its Play Store listing)
Operator: Truong Nguyen Thinh Phat Company Limited, Quận 12, TPHCM (per the listing)
What it is: Online loan-referral platform routing users to partner P2P institutions — not a direct lender
Primary market: Vietnam (Vietnamese-language product, VND amounts)
Working route: Consent-based interface integration of the app's eligibility and application traffic, framed against Circular 64 AIS/LOS
Data subject law: Decree 13/2023; PDPL 91/2025 (in force 1 Jan 2026)
Commission: From $300 source delivery, or pay-per-call — full terms below

The product worth reading here is not a balance — it is a decision. A user enters an amount and a term; the platform returns an approved limit and a ranked set of partner offers. That eligibility result, plus the application record and KYC inputs that produced it, is what a partner lender, a comparison service, or the operator's own back office would want to query programmatically.

We treat the consented capture of that flow as the route to build against, and reconstruct the amortization the app already publishes. The detail below maps each surface to what an integrator does with it.

What the app actually stores per user

Every row here comes from the published product behaviour, not a generic loan-app template. Numbers in this table are as the app's own listing describes its recommended products.

Data domain	Where it originates	Granularity	Integrator use
Identity & KYC	Registration; valid national ID (CCCD) required at 18+ per the eligibility terms	Per user	Verify applicant, key the rest of the record
Loan application	Request form — amount 900,000–30,000,000 VND, term 91–365 days	Per application	Pull request state and status transitions
Eligibility / approved limit	Server-side matching engine	Per user, per decision	Read the decision and the credit ceiling granted
Partner product matches	Recommendation engine over cooperating P2P institutions	Per user (varies by profile)	Route the applicant to the right partner offer
Repayment schedule	Amortization off amount, term and APR (≤18%/year per the listing)	Per loan	Reproduce instalments; reconcile against partner
Income & profile	Self-declared stable-income field at onboarding	Per user	Feed underwriting and offer filtering

Authorized routes to that data

Consented interface integration (the one we would run)

We map the app's own login, OTP exchange and data calls as it makes them, capture against a consenting account, and rebuild the eligibility and application endpoints as a clean interface. This reaches the live decision flow — the part that matters — and stays accurate as long as the front-end contract holds. Access to a test account is arranged with you during onboarding; nothing about that is yours to clear first.

Regulated Open API alignment

Circular 64/2024/TT-NHNN brings Account Information and Loan Origination services under a consent-based Open API regime. Where a partner institution behind Hạn Mức+ exposes a compliant channel, we align the integration to it, so the data path matches the regulator's consent and security model rather than sitting beside it.

User-consented credential access

For a back-office or comparison use case where the end user authorizes it, we drive the authenticated session directly and pull the application history and offer set on the user's behalf, with the consent record retained.

For this app the first route carries the build. The decision engine is the asset, it lives on the platform's own servers, and capturing the consented session is the most direct way to reach it; the Circular 64 alignment is what we layer on where a partner channel exists, and direct credential access covers the operator-side cases.

What lands in your hands

OpenAPI specification for the eligibility, application-status and partner-match endpoints, with the VND amount and term constraints encoded.
Auth-flow report documenting the login, OTP and session-token chain as the app performs it, including token lifetime and refresh.
Runnable source in Python or Node.js for the key calls — submit an application, read the approved limit, list partner offers, derive the repayment schedule.
Amortization module that reproduces the listing's worked example (2,000,000 VND / 120 days / 18% APR → 530,000 VND monthly) and is asserted in tests.
Automated tests covering the happy path and the rejection and ineligible-age branches.
Interface documentation plus data-retention and consent-record guidance aligned to Decree 13/2023 and the PDPL.

A sample of the eligibility call

Illustrative shapes — exact field names are confirmed during the build against a consenting account.

POST /v1/applications/eligibility        # illustrative
Authorization: Bearer <session token from the app login + OTP exchange>
Content-Type: application/json

{
  "applicant": { "national_id": "<CCCD>", "age": 27, "monthly_income_vnd": 12000000 },
  "request":   { "amount_vnd": 2000000, "term_days": 120 }
}

200 OK
{
  "decision": "matched",
  "approved_limit_vnd": 2000000,
  "apr_pct": 18.0,
  "schedule": { "term_days": 120, "monthly_payment_vnd": 530000, "total_repay_vnd": 2120000 },
  "partner_offers": [
    { "partner_ref": "p2p_partner_a", "monthly_payment_vnd": 530000, "term_days": 120 }
  ]
}

# applicant.age < 18 -> 422 { "decision": "ineligible", "reason": "minor" }

The build rests on the user's own explicit consent to share their records — voluntary, informed, and revocable, which is exactly what Decree 13/2023 and the Personal Data Protection Law 91/2025 (in force 1 January 2026) require. Consent scope is limited to the application and eligibility data needed; the income and ID fields are minimized to what the integration uses. SBV Circular 64, effective 1 March 2025, is the channel-level frame: it phases AIS, consent-based access and payment initiation in over its compliance window, and it sets the security baseline (strong authentication, TLS, recognized data-exchange standards) we design the integration to sit comfortably within. We keep consent records and request logs, work under NDA where the engagement needs it, and retain nothing beyond the agreed scope.

Things we account for on this app

Because Hạn Mức+ is an intermediary, a single applicant can map to several partner offers at once. We model the partner-match set as a list keyed to the decision, so an integration does not collapse it into one phantom lender.
The OTP and session step is the gate on every data call. We document the token lifetime and build the sync so it re-authenticates cleanly rather than failing silently when a session expires.
Offer composition is profile-dependent — the listing states different users get different recommendations. We scope the integration to read the returned set per user rather than assume a fixed catalogue.
Front-end contracts on referral apps shift between releases; we set up a re-check pass so a field rename in a later version surfaces as a test failure, not as quietly wrong data.

Where this gets used

A partner lender wants a clean feed of the applications routed to it — amount, term, approved limit, applicant KYC reference — instead of a manual hand-off.
A comparison or aggregator service reconciles the partner offers Hạn Mức+ returns against its own rate table.
The operator's back office exports application and repayment-schedule records for reporting and reconciliation.

Keeping it accurate

The eligibility decision is real-time and the application record is event-driven, so the integration polls or webhooks the status transitions rather than batching a stale copy. The amortization is deterministic, so it never drifts; only the front-end contract does, which the re-check pass catches.

How this was checked

Reviewed against the app's public Play Store listing for its product terms (amounts, 18% APR cap, 91–365 day terms, the worked repayment example) and its operator details, then cross-read against primary regulatory sources for the route and the data law. Checked June 2026.

Mapped by the OpenBanking Studio integration desk, June 2026.

Same category, named to widen the picture — neutral, not a ranking.

Tin Vay Plus (VietCredit) — installment-credit app holding per-user credit lines and repayment records.
Cake by VPBank — digital bank offering loans alongside accounts and card data.
Doctor Dong — short-term consumer-loan platform with per-user application history.
Tima — peer-to-peer lending marketplace connecting borrowers and lenders.
Senmo — small-ticket online loans (GOFINGO Vietnam) with application and KYC records.
Home Credit — established consumer finance with installment and limit data.
FE Credit — large consumer-lender with loan accounts and repayment schedules.
Vietdong — fast online-loan app holding per-user request and status data.
LoanHub Vietnam — referral-style lending app similar in shape to Hạn Mức+.

Each holds the same broad shape of data — applications, eligibility, repayment — which is why a single normalized interface across several of them is a common request.

Interface evidence

=======

Every loan offer a Hạn Mức+ user sees comes from a partner P2P lender; the platform matches, it never lends. That referral layer — who got matched to which product, at what amount and term — is the data worth integrating, and it lives only inside the app's own session traffic. The numbers it works with are narrow and documented: per the Play Store listing, loans run from 900,000 to 30,000,000 VND, the annual rate is capped at 18%, and terms sit between 91 and 365 days.

Because the app describes itself only as an intermediary, the interesting records are not balances or statements — they are matches and the math behind them. For Hạn Mức+ the match and repayment data exist nowhere but the app's own session, so the build we would actually run is authorized protocol analysis against a consenting test account, with that account holder's consent as the legal basis. The State Bank's Open API track is worth watching, but it is not yet a channel anyone can integrate against. Everything below is built around that judgment.

The data Hạn Mức+ holds, surface by surface

Each row is a surface the app actually presents to a user. Granularity reflects how the data is keyed once it is mapped.

Data domain	Where it originates in the app	Granularity	What an integrator does with it
Borrower profile & declared eligibility	Registration / KYC step (age 18+, stable income, valid ID, per the listing's stated conditions)	Per user	Pre-fill a partner onboarding form; de-duplicate applicants across sources
Loan-match / referral records	The recommendation screen that surfaces partner products	Per user, per session	Attribution and conversion tracking across the partner pool
Partner-product catalog	The offer pool the platform draws on (900k–30M VND, APR ≤18%, 91–365 days)	Per product	Sync a unified offer table; compare terms across lenders
Repayment schedule	The in-app loan calculator (principal, monthly installment, total interest)	Per application	Feed a servicing or budgeting view with a real amortization
Application hand-off state	The point a user is referred out to a partner institution	Per application	Drive pipeline state in a CRM or risk dashboard
Partner-institution mapping	The platform's backend lender partnerships	Per partner	Route each record to the correct downstream lender system

Routes into the data

Three routes genuinely apply here. They differ in what they reach, how durable they are, and what we set up to run them.

Authorized protocol analysis of the app's traffic

This is the route that reaches the referral layer. We capture the session against a consenting test account, reconstruct the token-issue and refresh chain, and document the recommendation, catalog and repayment endpoints. Reach: everything the app shows that user. Effort: moderate. Durability: tied to the app version, so the parser is versioned and re-checked against new releases. We handle the capture environment and the account setup with you as the work starts.

Account-holder consented access

A consenting user authorizes us to pull their own match history and repayment records. Reach: that user's data only. This is the cleanest legal footing under the PDPL, and it is what underpins route one rather than competing with it — the consent is the basis, the protocol analysis is the mechanism.

The SBV Open API sandbox track (emerging)

Decree 94 names Open API data sharing as a sandbox category. If the platform or a partner lender joins that track, a standardized channel becomes possible. It is forward-looking: the technical standard is still a draft circular and participation is not in place, so we treat it as a path to revisit, not one to design against today.

The recommendation for Hạn Mức+ is plain: run authorized protocol analysis against a consenting account now, keep the consent record as the legal spine, and re-evaluate the Open API channel only when a partner actually enters the sandbox. Native export is not assumed; where a user-facing history view exists, we script its export as a supplement.

What the handoff includes

Each deliverable is tied to a surface above, not a generic checklist.

OpenAPI / Swagger spec for the reconstructed recommendation, catalog and repayment endpoints — the contract your team codes against.
Auth-flow report describing how Hạn Mức+ issues and refreshes its session token, and how the recommendation call carries it.
Runnable client in Python or Node.js for the key calls: fetch matches, pull the partner-product pool, compute a repayment schedule.
Normalized schema that maps VND amounts, the 18% APR cap and 91–365-day terms into one offer model, with the dot-grouped Vietnamese number format parsed correctly.
Automated tests exercising the calls against the consenting account, so a future app change fails loudly.
Interface documentation plus PDPL guidance on consent capture, data minimization and a retention window.

Inside a match-results call

Field and endpoint shapes below are illustrative — reconstructed during the build, not a published contract. They mirror the constants the app states for itself.

# Illustrative — endpoint shapes reconstructed during the build.

POST /api/v1/session/refresh
  Authorization: Bearer <access_token>
  -> 200 { "access_token": "...", "expires_in": 3600 }

GET /api/v1/recommendations?amount=2000000&term_days=120
  Authorization: Bearer <access_token>
  -> 200
  {
    "applicant_id": "u_8f...",        # per-user, hashed in our store
    "matches": [
      {
        "partner_id": "p_021",
        "product":    "Cho vay nhanh",
        "amount_min": 900000,         # VND, per listing
        "amount_max": 30000000,
        "apr_max":    18.0,           # %/yr, capped per listing
        "term_days":  [91, 365],
        "daily_rate": 0.0005          # 0.05%/day, per the worked example
      }
    ]
  }

# Error handling we build in:
#   401 -> run the refresh call, retry once
#   429 -> exponential backoff; the recommendation feed is rate-shaped

The worked example in the listing — 2,000,000 VND over 120 days, 30,000 VND interest a month, a 530,000 VND installment — is what we reconcile our amortization output against before sign-off.

What teams build with it

A loan marketplace folds Hạn Mức+'s partner pool into a single comparison table, refreshed on a schedule.
An affiliate or CRM tracks which referral converted, keyed to the per-user match record.
A budgeting tool imports the repayment schedule so a borrower sees one consolidated installment view.
A compliance dashboard watches application hand-off state to flag where a referral left the platform.

Authorization: Vietnam's sandbox rules and the PDPL

This is a Vietnamese consumer-finance app, so two instruments matter. Decree 94/2025/ND-CP, effective 1 July 2025 under the State Bank of Vietnam, sets up a regulatory sandbox whose three tracks are credit scoring, data sharing via Open APIs, and P2P lending — the category Hạn Mức+ sits next to as an introducer. The sandbox is real but selective, and the Open API standard underneath it is still being finalized as a draft circular. The dependable basis for our work is not that scheme; it is the account holder's own consent to access their own records.

Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) took effect on 1 January 2026, replacing the earlier Decree 13/2023 framework and treating financial information as sensitive personal data. We operate to it: access is authorized and logged, consent is recorded and revocable, only the fields the integration needs are pulled, and a retention window is agreed and documented. Where a non-disclosure agreement is appropriate, it is in place before any traffic is touched.

Where this build needs care

Three things about Hạn Mức+ shape how we engineer the integration, and we handle each rather than push it back to you.

Per-user recommendations are not a fixed catalog. The app says different users get different suggestions, so we snapshot the offer pool separately from the per-user match. The unified product table stays stable even as the recommendation engine reshuffles what one account sees.
The platform's interest math is an example, not every partner's terms. The 0.05%/day, 18%-APR-cap figures are the platform's illustration; individual P2P partners may apply their own. We reconcile the displayed amortization against each partner's actual schedule during the build so a downstream servicing view is accurate.
Vietnamese formatting and app drift. Amounts use dot thousands separators (30.000.000) and diacritic-laden labels; we normalize encoding and currency parsing so values are not misread, and we keep the parser versioned so a redesigned match screen does not quietly break the feed.

Access to a consenting test account and any paperwork are arranged with you during onboarding; the build runs against that account or the platform's own flows, never against anyone's data without consent.

Screens we worked from

The store screenshots below show the surfaces the mapping is built on. Select one to enlarge.

>>>>>>> da5ddccd7411b0cc491bc19181a35e6620c0b130

<<<<<<< HEAD

Questions an integrator tends to ask

Does Hạn Mức+ hold the lending decision, or do its P2P partners?

Both, at different layers. The app describes itself as an intermediary that does not lend directly, so the underlying contract sits with a partner financial institution. But the matching and eligibility result — the requested amount, the approved limit, the recommended product set — is computed and stored on the Hạn Mức+ side, and that is the surface an integrator actually reads.

Which Vietnamese rule covers pulling this data with consent?

SBV Circular 64/2024/TT-NHNN, in force since 1 March 2025, sets the consent-based Open API framework covering Account Information and Loan Origination services. Personal data handling falls under Decree 13/2023 and the Personal Data Protection Law 91/2025, effective 1 January 2026. The dependable basis for the build is the user's own explicit consent to share their records.

Can the repayment schedule be reproduced from the app's data?

Yes. The listing publishes a worked example — a 2,000,000 VND loan over 120 days at 18% APR producing a 530,000 VND monthly instalment — so the amortization is deterministic once amount, term and rate are read from the application record. We reproduce that calculation in code and validate it against the partner offer the app returns.

How do you handle the OTP and session step during the build?

We map the login and OTP exchange as the app performs it and treat the resulting session token as the credential the data calls carry. Capture runs against a consenting test account that you and we set up together, so the replay is reproducible and the token lifecycle is documented in the auth-flow report.

Commissioning the work

A working Hạn Mức+ integration lands on a 1–2 week cycle. The source-delivery option hands you runnable code for the eligibility and application endpoints, the OpenAPI spec, the auth-flow report and tests, from $300 — billed only after delivery, once you have looked it over and are satisfied. If you would rather not host anything, call our endpoints instead and pay per call with nothing upfront. You give us the app name and what you want out of its data; access and the compliance paperwork are arranged together as part of the engagement. Start the conversation at /contact.html.

App profile — factual recap

Hạn Mức+-Cho vay nhanh (package com.creditamount.plus, per its Play listing) is a Vietnamese online loan-referral platform operated by Truong Nguyen Thinh Phat Company Limited in Quận 12, Ho Chi Minh City. It positions itself as an intermediary rather than a direct lender, matching users to cooperating P2P institutions. Its recommended products, as the listing describes them, run from 900,000 to 30,000,000 VND, with APR capped at 18% per year and terms of 91 to 365 days. Eligibility requires applicants to be 18 or older, with stable income and valid identity documents.

Mapping reviewed 2026-06-26.