Pulling loan-lifecycle records out of Ví Vàng

A Ví Vàng borrower's whole loan sits behind one phone-number login: the application, the automated approval decision, the amount that lands in a personal bank account, and the repayment schedule that follows. That is the data a lender, a credit bureau, a debt-collection partner, or an aggregator wants in their own systems — not screenshotted, but queryable. This page maps what the app holds and the authorized route we use to reach it.

The bottom line: every field worth syncing here is per-borrower and lives behind that login, so the practical route is to model the app's own session and read the same endpoints the app reads, under the borrower's consent. Where Vietnam's new Open API pilot reaches Ví Vàng's operator, we migrate to it. Until then, consent-based interface integration is what actually runs.

What sits behind a borrower account

Each row below reflects a screen or step the app's own description spells out — registration, the basic-info form, the automated assessment, disbursement to a personal account, and the repayment terms. Amounts and rates are quoted as the app states them.

Routes to the data, and the one we would build first

Three authorized routes genuinely apply to Ví Vàng. They differ in effort and in how long they keep working without a touch.

Interface integration via documented protocol analysis

We capture the app's own traffic against a consenting test login, then reimplement the phone-OTP handshake and the loan endpoints it calls. Reach is total — every screen a borrower sees becomes a queryable field. Effort is moderate and front-loaded. Durability tracks the app's release cadence, so we account for change rather than assume stability. Access here is arranged with you during onboarding; the capture runs against a login we are allowed to use.

Borrower-consented session access

For production at scale, the same endpoints are driven per borrower, under that person's explicit consent, returning only their own records. Reach matches the data they can already see in-app. This holds well as long as consent is current, and it is the cleanest fit with Vietnam's consent-first data law.

Regulated Open API under the SBV sandbox

Decree 94/2025 opened a State Bank of Vietnam pilot that includes Open API data-sharing. It is pilot-stage, not an in-force standard, and it depends on Ví Vàng's operator or a partner credit institution joining. Where that happens, the schema stabilizes and maintenance drops, which makes it worth migrating to later.

For Ví Vàng we would start with the first route — mapping the app's traffic against a consenting login reaches every field and waits on no one's roadmap. The per-borrower consented session is what we then run in production. The Open API path is the one to revisit once the operator is inside the sandbox, because at that point the contract stops moving under us. That sequence is driven by what is reachable today, not by a fixed preference.

What lands in your repository

The deliverable is the working integration, not a report about it. For Ví Vàng that means:

• An OpenAPI / Swagger specification covering the phone-OTP auth flow plus the application-status, disbursement and repayment-schedule endpoints.
• A protocol and auth-flow report: how the session token is issued from the OTP exchange, how it is carried and refreshed, and the device-binding step.
• Runnable source for the key calls in Python and Node.js — login, application-status poll, repayment-schedule pull, fee accrual read.
• A normalized schema that maps Ví Vàng's amount, term, rate and penalty fields onto a common loan model, so sibling apps slot in without rework.
• Automated tests against a consenting account plus recorded fixtures, so the suite runs without live credentials.
• Interface documentation and data-retention guidance written against the 2025 data-protection rules.

Auth and a real surface, in code

Ví Vàng signs a borrower in by phone number and a one-time code, then carries a session token on each call. The sketch below shows the shape we map; exact paths and field names are confirmed during the build against a consenting login. Values follow the listing's own worked example — a 20,000,000 VND loan, 3% fee, 12% annual rate, netting 19,400,000 VND.

# Illustrative — paths and field names confirmed during the build.
# Step 1: exchange phone + OTP for a session token
POST /api/v1/auth/otp/verify
  { "phone": "+84xxxxxxxxx", "otp": "######", "device_id": "<app-install-id>" }
-> 200 { "access_token": "<jwt>", "expires_in": 3600, "borrower_id": "..." }

# Step 2: current application + automated decision state
GET /api/v1/loan/application/status
  Authorization: Bearer <jwt>
-> 200 {
     "application_id": "...",
     "state": "approved",          # submitted | under_review | approved | disbursed | rejected
     "approved_amount_vnd": 19400000,
     "term_days": 91,
     "annual_rate_pct": 12.0,
     "disbursed_at": "2026-..T..Z"
   }

# Step 3: per-installment repayment schedule
GET /api/v1/loan/{application_id}/repayments
-> 200 { "installments": [
     { "due_date": "...", "principal_vnd": 0, "interest_vnd": 0, "fee_vnd": 0, "status": "due" }
   ] }

# Handle 401 by re-running the OTP/refresh step, not by retrying blindly.
      

The legal ground we build on

Vietnam's Personal Data Protection Law (Law 91/2025/QH15) is in force since 1 January 2026, replacing the decree-level regime that ran from Decree 13/2023, per legal commentary on the new law. Its approach is consent-first: consent must be voluntary, specific and recorded, silence does not count, and credit information in particular cannot be processed without it. A breach touching financial data carries a 72-hour notification duty. That borrower consent is the dependable basis for everything we read.

Separately, Decree 94/2025 — effective 1 July 2025 — set up the State Bank of Vietnam sandbox for P2P lending, credit scoring and Open API data-sharing, with pilot licences running up to two years and all transactions in Vietnamese Dong. Reporting on the decree notes disbursements and repayments are expected to route through licensed credit-institution accounts or a licensed e-wallet. We treat the Open API limb as where the regime may go, not as settled sharing to rely on today. On our side, access is authorized and consented, calls and consent records are logged, fields are minimized to what a use case needs, and we work under an NDA where the project calls for one.

Things we account for on this build

Two details of Ví Vàng shape the engineering, and we handle them rather than hand them back as conditions.

• Session lifetime tied to OTP and device. The token comes from a phone-code exchange and is bound to a device; we build the client to acquire and refresh it, and to re-authenticate cleanly when the app forces a new binding, so a long sync does not silently drop.
• A time-sensitive decision, not a static record. The automated assessment moves an application through submitted, review, approved and disbursed states. We model that state machine so the integration reflects transitions, not a single stale snapshot.
• VND money math. Amounts are in dong and the overdue charge accrues daily and is capped; we normalize money and penalty fields with exact decimal handling so totals match the contract.

Front ends on these micro-loan apps change often, so we schedule a periodic re-check of the captured flows — a front-end change then surfaces as a failing test, not a quiet gap in your data. Whether the operator is registered under the new sandbox is not publicly disclosed and is not asserted here; because we work from the borrower's own consent, the route does not depend on it.

Cost and how it runs

A working pull of Ví Vàng's loan-status, disbursement and repayment records — with source you run yourself — starts at $300. You provide the app name and what you want from its data; access and any compliance paperwork are arranged with you as part of the work. Take delivery as a source-code package and pay after delivery, once the integration is in your hands and working — or call our hosted API and pay per call, with no upfront fee. A typical build runs one to two weeks. To scope yours, tell us about the app and the data you need and we will come back with a route and a timeline.

Keeping the sync honest

Data is real-time on pull — every call returns the borrower's current state, not a cache, which matters when an application can flip from review to approved within minutes of submission. We keep request rates polite so a sync does not look like abuse, back off on transient errors, and treat a 401 as a re-auth trigger rather than a failure. When the app ships an update that moves an endpoint, the scheduled re-check catches it before your pipeline notices.

Interface evidence

Store screenshots of the surfaces described above. Select to enlarge.

How this was checked

Mapped from Ví Vàng's own Play Store description (loan amounts, terms, fees, the registration and assessment flow) and the package identifier com.quick.loan.center.vay.mau as listed there, cross-read against Vietnam's current data and fintech rules. Checked 25 June 2026.

• Ví Vàng — Google Play listing
• Tilleke & Gibbins — Vietnam issues fintech sandbox Decree 94/2025
• VILAF — Decree 94 opens a sandbox for P2P lending and Open API
• Hogan Lovells — Vietnam's Personal Data Protection Law 2025

Notes compiled by the OpenBanking Studio integration desk, June 2026.

Other Vietnamese lending apps in the same picture

Neighbouring apps a unified loan integration tends to cover. Named for context, not ranked.

• MoMo Vay nhanh — the large e-wallet's in-app loan product, holding per-user application status and repayment records tied to bank partners.
• ZaloPay Vay nhanh — wallet-based lending with similar per-borrower loan and schedule data.
• Vietdong (Vay nhanh online) — a standalone small-ticket lender with application and repayment records per user.
• EasyCash — online installment loans with 91–182 day terms and per-borrower schedules.
• LoanHub Vietnam — an intermediary that routes applications to partner lenders, holding comparison and application data.
• Doctor Dong — short-term online cash loans with per-user application and contract records.
• Senmo — online installment lending with repayment schedules and fee data.
• RoboCash — instant-disbursement online loans with per-user loan, fee and repayment records.
• Tamo — online loan service holding application-status and repayment-schedule data.
• Cây Vàng — quick online loans up to roughly 10 million VND, with per-borrower loan records.

Questions integrators ask first

Which Ví Vàng screens hold data worth syncing?

The per-borrower screens: the registration profile, the submitted loan application and its automated decision state, the approved amount and disbursement record, and the repayment schedule with its fees and overdue charges. Those are the surfaces an integrator pulls, all behind the phone-number login.

Does Vietnam's 2025 fintech sandbox affect how you reach this data?

It can. Decree 94/2025, effective 1 July 2025, opened a State Bank of Vietnam pilot for P2P lending, credit scoring and Open API data-sharing. If Ví Vàng's operator or a partner credit institution joins that sandbox, a standardized Open API path becomes available; until then we build on the borrower's own consented access under the 2025 Personal Data Protection Law.

How do you authenticate when the app only logs in by phone-number OTP?

We model the OTP exchange the app itself uses — phone number, one-time code, device binding — to obtain the session token, then keep that token refreshed so a long-running sync does not drop mid-way. The flow is captured against a consenting test login during the build.

Can the repayment and overdue-fee fields be normalized across other Vietnamese loan apps?

Yes. We map Ví Vàng's amount, term, interest and penalty fields to a common loan model, so records from apps like MoMo Vay nhanh, EasyCash or Vietdong land in the same schema. That normalization is part of the delivered specification.