Integrating Hạn Mức+: the loan-matching and repayment layer

Every loan offer a Hạn Mức+ user sees comes from a partner P2P lender; the platform matches, it never lends. That referral layer — who got matched to which product, at what amount and term — is the data worth integrating, and it lives only inside the app's own session traffic. The numbers it works with are narrow and documented: per the Play Store listing, loans run from 900,000 to 30,000,000 VND, the annual rate is capped at 18%, and terms sit between 91 and 365 days.

Because the app describes itself only as an intermediary, the interesting records are not balances or statements — they are matches and the math behind them. For Hạn Mức+ the match and repayment data exist nowhere but the app's own session, so the build we would actually run is authorized protocol analysis against a consenting test account, with that account holder's consent as the legal basis. The State Bank's Open API track is worth watching, but it is not yet a channel anyone can integrate against. Everything below is built around that judgment.

The data Hạn Mức+ holds, surface by surface

Each row is a surface the app actually presents to a user. Granularity reflects how the data is keyed once it is mapped.

Routes into the data

Three routes genuinely apply here. They differ in what they reach, how durable they are, and what we set up to run them.

Authorized protocol analysis of the app's traffic

This is the route that reaches the referral layer. We capture the session against a consenting test account, reconstruct the token-issue and refresh chain, and document the recommendation, catalog and repayment endpoints. Reach: everything the app shows that user. Effort: moderate. Durability: tied to the app version, so the parser is versioned and re-checked against new releases. We handle the capture environment and the account setup with you as the work starts.

Account-holder consented access

A consenting user authorizes us to pull their own match history and repayment records. Reach: that user's data only. This is the cleanest legal footing under the PDPL, and it is what underpins route one rather than competing with it — the consent is the basis, the protocol analysis is the mechanism.

The SBV Open API sandbox track (emerging)

Decree 94 names Open API data sharing as a sandbox category. If the platform or a partner lender joins that track, a standardized channel becomes possible. It is forward-looking: the technical standard is still a draft circular and participation is not in place, so we treat it as a path to revisit, not one to design against today.

The recommendation for Hạn Mức+ is plain: run authorized protocol analysis against a consenting account now, keep the consent record as the legal spine, and re-evaluate the Open API channel only when a partner actually enters the sandbox. Native export is not assumed; where a user-facing history view exists, we script its export as a supplement.

What the handoff includes

Each deliverable is tied to a surface above, not a generic checklist.

• OpenAPI / Swagger spec for the reconstructed recommendation, catalog and repayment endpoints — the contract your team codes against.
• Auth-flow report describing how Hạn Mức+ issues and refreshes its session token, and how the recommendation call carries it.
• Runnable client in Python or Node.js for the key calls: fetch matches, pull the partner-product pool, compute a repayment schedule.
• Normalized schema that maps VND amounts, the 18% APR cap and 91–365-day terms into one offer model, with the dot-grouped Vietnamese number format parsed correctly.
• Automated tests exercising the calls against the consenting account, so a future app change fails loudly.
• Interface documentation plus PDPL guidance on consent capture, data minimization and a retention window.

Inside a match-results call

Field and endpoint shapes below are illustrative — reconstructed during the build, not a published contract. They mirror the constants the app states for itself.

# Illustrative — endpoint shapes reconstructed during the build.

POST /api/v1/session/refresh
  Authorization: Bearer <access_token>
  -> 200 { "access_token": "...", "expires_in": 3600 }

GET /api/v1/recommendations?amount=2000000&term_days=120
  Authorization: Bearer <access_token>
  -> 200
  {
    "applicant_id": "u_8f...",        # per-user, hashed in our store
    "matches": [
      {
        "partner_id": "p_021",
        "product":    "Cho vay nhanh",
        "amount_min": 900000,         # VND, per listing
        "amount_max": 30000000,
        "apr_max":    18.0,           # %/yr, capped per listing
        "term_days":  [91, 365],
        "daily_rate": 0.0005          # 0.05%/day, per the worked example
      }
    ]
  }

# Error handling we build in:
#   401 -> run the refresh call, retry once
#   429 -> exponential backoff; the recommendation feed is rate-shaped
      

The worked example in the listing — 2,000,000 VND over 120 days, 30,000 VND interest a month, a 530,000 VND installment — is what we reconcile our amortization output against before sign-off.

What teams build with it

• A loan marketplace folds Hạn Mức+'s partner pool into a single comparison table, refreshed on a schedule.
• An affiliate or CRM tracks which referral converted, keyed to the per-user match record.
• A budgeting tool imports the repayment schedule so a borrower sees one consolidated installment view.
• A compliance dashboard watches application hand-off state to flag where a referral left the platform.

Authorization: Vietnam's sandbox rules and the PDPL

This is a Vietnamese consumer-finance app, so two instruments matter. Decree 94/2025/ND-CP, effective 1 July 2025 under the State Bank of Vietnam, sets up a regulatory sandbox whose three tracks are credit scoring, data sharing via Open APIs, and P2P lending — the category Hạn Mức+ sits next to as an introducer. The sandbox is real but selective, and the Open API standard underneath it is still being finalized as a draft circular. The dependable basis for our work is not that scheme; it is the account holder's own consent to access their own records.

Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) took effect on 1 January 2026, replacing the earlier Decree 13/2023 framework and treating financial information as sensitive personal data. We operate to it: access is authorized and logged, consent is recorded and revocable, only the fields the integration needs are pulled, and a retention window is agreed and documented. Where a non-disclosure agreement is appropriate, it is in place before any traffic is touched.

Where this build needs care

Three things about Hạn Mức+ shape how we engineer the integration, and we handle each rather than push it back to you.

• Per-user recommendations are not a fixed catalog. The app says different users get different suggestions, so we snapshot the offer pool separately from the per-user match. The unified product table stays stable even as the recommendation engine reshuffles what one account sees.
• The platform's interest math is an example, not every partner's terms. The 0.05%/day, 18%-APR-cap figures are the platform's illustration; individual P2P partners may apply their own. We reconcile the displayed amortization against each partner's actual schedule during the build so a downstream servicing view is accurate.
• Vietnamese formatting and app drift. Amounts use dot thousands separators (30.000.000) and diacritic-laden labels; we normalize encoding and currency parsing so values are not misread, and we keep the parser versioned so a redesigned match screen does not quietly break the feed.

Access to a consenting test account and any paperwork are arranged with you during onboarding; the build runs against that account or the platform's own flows, never against anyone's data without consent.

Screens we worked from

The store screenshots below show the surfaces the mapping is built on. Select one to enlarge.

What was checked, and when

The mapping draws on the app's own Google Play listing (loan range, APR cap, term window, operator and contact details), the legal write-ups of Decree 94/2025 and the State Bank's Open API draft circular, and the analyses of Vietnam's 2025 Personal Data Protection Law. Sources opened during this review:

• Hạn Mức+-Cho vay nhanh on Google Play — loan parameters, operator, stated eligibility.
• DFDL on Decree 94/2025/ND-CP — sandbox scope, effective date, the three tracks.
• VILAF on Decree 94, P2P and Open API — Open API data-sharing and CIC requirements.
• Tilleke & Gibbins on the 2025 PDPL — sensitive-data treatment and consent obligations.

Mapped by the OpenBanking Studio integration desk — June 2026.

Other Vietnamese lending and referral apps holding similar data

These sit in the same data space; an integrator unifying loan-referral or consumer-credit data would meet them alongside Hạn Mức+. Listed for context, not ranked.

• MFast — an introducer platform with an agent network; holds match records and partner hand-offs much like Hạn Mức+.
• LoanHub Vietnam — a loan comparison and selection app; carries a partner-product catalog and per-user selections.
• Tima — a P2P lending marketplace connecting borrowers and lenders; holds application and offer records.
• Doctor Dong — short-term consumer lending; per-user application, scoring and repayment data.
• MoneyCat — online cash-loan app; account, disbursement and repayment ledgers.
• Cashwagon — consumer micro-loans; KYC and loan-lifecycle records.
• Home Credit — installment and cash loans from a licensed lender; statements, schedules and account state.
• Kredivo — buy-now-pay-later and credit lines; limit, transaction and repayment data.
• FE Credit — a large consumer-finance lender; loan accounts, schedules and servicing data.

Questions integrators ask about Hạn Mức+

Hạn Mức+ doesn't lend — so what's actually worth pulling out of it?

The value is in the referral layer. Each session produces a per-user match record (which partner products surfaced, at what amount and term), a snapshot of the partner-product pool the platform draws from, and the repayment math behind any offer the user opens. We map all three to a normalized schema you can sync.

Does Vietnam's Decree 94 sandbox give us an Open API into Hạn Mức+ right now?

Not yet as something you can call. Decree 94 took effect on 1 July 2025 and names data sharing via Open APIs as one of three sandbox tracks, but the State Bank of Vietnam's Open API technical standard is still at draft-circular stage and depends on a platform joining the sandbox. Today the dependable route is authorized protocol analysis against a consenting account, with that account holder's consent as the legal basis.

How is a user's loan-match history handled under the Vietnamese PDPL?

We work from the account holder's own consent, pull only the fields the integration needs, and keep consent and access logs. Vietnam's Personal Data Protection Law took effect on 1 January 2026 and treats financial data as sensitive, so we minimize what is stored and document a retention window with you.

We only have the app name and a use case — can you still map the partner-product feed?

Yes. Give us Hạn Mức+ and what you want from its data; access to a consenting test account and any compliance paperwork are arranged with you as the work starts. A mapping like this runs about one to two weeks.

A Hạn Mức+ match-and-repayment integration ships in about one to two weeks. Take it as source-code delivery from $300 — the runnable client, OpenAPI spec, automated tests and interface docs, paid only after we deliver and you are satisfied — or skip the build and call our hosted endpoints instead, paying per call with nothing upfront. Tell us what you need from the data at /contact.html and we will scope it for this app.