Finpass API Collection
  1. Bureau
  • Introduction
  • Bureau
    • Commercial Credit Report
      POST
    • Multi-Bureau Fetch
      POST
  • Bank Statement Analyser
    • Batch Upload Statements
      POST
    • Batch Result
      GET
    • Upload Statement
      POST
    • Statement Result
      GET
  • Account Aggregator
    • Initialize
      POST
    • Fetch JSON Report
      POST
    • Fetch PDF Report
      POST
    • Refresh Data
      POST
  • Corporate
    • CIN Lookup
      POST
    • LLPIN
      POST
    • PAN Lookup
      POST
    • Company Autocomplete
      POST
  • EPFO
    • Fetch EPFO Data by Mobile Number
      POST
    • EPFO-CRIF Combined Report
      POST
  • ITR Analyzer
    • Initialize
      POST
    • Status
      POST
    • ITR Analyzer — Get Full Data
      POST
    • Create ITR Login Client
      POST
    • Check Credential
      POST
    • Generate 2FA
      POST
    • Submit 2FA OTP
      POST
    • Initiate ITR Password Reset
      POST
    • Confirm Password Reset (Submit OTP)
      POST
  • AA-BSA Analyzer
    • Initialize
    • Status
    • AA BSA — Statement Result
    • AA BSA — Analysis JSON
  • GST Analyser
    • Analyze
    • Status
    • GST Data
  • Hosted Collection
    • Create ITR Collection Session
    • Create GST Collection Session
  1. Bureau

Commercial Credit Report

POST
/api/v1/services/credit-report-commercial/fetch

Commercial Credit Report#

Endpoint Overview
POST /api/v1/services/credit-report-commercial/fetch

Description#

The Commercial Credit Report API enables businesses to fetch comprehensive credit reports for commercial entities using their business name and PAN (Permanent Account Number). This API retrieves detailed credit information about a business, including credit history, outstanding loans, payment behavior, credit utilization, and overall creditworthiness assessment.
This endpoint is essential for financial institutions, lenders, and businesses that need to perform due diligence on commercial entities before extending credit, entering into partnerships, or making investment decisions. The API delivers credit reports in HTML format, making it easy to embed and render directly within web applications and dashboards.
Key Benefits
Comprehensive Credit Assessment: Get detailed insights into a business's credit history and financial behavior in a single API call.
Web-Ready HTML Output: Receive credit reports as HTML for seamless embedding into web portals and applications.
Risk Mitigation: Make informed lending and partnership decisions backed by authoritative credit data.
Streamlined Due Diligence: Reduce manual verification time and accelerate business onboarding workflows.

Use Cases#

Banking & Lending
NBFCs & Fintech
B2B Marketplaces
Evaluate commercial loan applications by analyzing the business's credit history and repayment behavior.
Determine credit limits and interest rates for business credit cards and lines of credit.
Conduct periodic credit reviews of existing commercial borrowers to monitor risk exposure.

Technical Implementation#

1
Authentication
All API requests require authentication using API Key credentials. Authentication follows these steps:
1.
Obtain API Credentials: Register with Finpass to receive your X-API-KEY and X-API-Secret.
2.
Include in Request Headers: Add both credentials to every request as HTTP headers.
3.
Secure Storage: Store credentials securely on your backend; never expose them in client-side code.
The production base URL for all requests is:
Production: https://api.finpass.ai
2
Request Parameters

Request Headers#

HeaderRequiredDescription
Content-TypeYesMust be set to application/json.
X-API-KEYYesYour unique API key issued by Finpass.
X-API-SecretYesYour API secret issued by Finpass for request authentication.

Request Body#

ParameterTypeRequiredDescription
business_namestringYesThe registered name of the business entity. Must be at least 2 characters long.
panstringYesThe 10-character PAN (Permanent Account Number) of the business. Format: ABCDE1234F (5 uppercase letters, 4 digits, 1 uppercase letter).
consentstringNoIndicates whether the user has provided consent to fetch the credit report. Accepted values: Y (Yes) or N (No). Defaults to Y.
report_typestringNoThe format in which the credit report should be returned. Only html is currently supported. Defaults to html.

Example Request#

{
    "business_name": "Acme Pvt Ltd",
    "pan": "ABCDE1234F",
    "consent": "Y",
    "report_type": "html"
}
3
Process Response

Response Parameters#

ParameterTypeDescription
statusstringIndicates the status of the API request (e.g., success or failed).
messagestringA human-readable message describing the outcome of the request.
dataobjectContains the credit report details and metadata.
data.business_namestringThe business name as submitted in the request.
data.panstringThe PAN submitted in the request.
data.report_typestringThe format of the returned report. Currently always html.
data.reportstringThe credit report content as an HTML string, ready to be rendered in a browser or web application.
data.report_urlstringA URL to download or view the generated credit report.
data.generated_atstringISO 8601 timestamp indicating when the report was generated.

Example Successful Response#

{
    "status": "success",
    "message": "Credit report fetched successfully",
    "data": {
        "business_name": "Acme Pvt Ltd",
        "pan": "ABCDE1234F",
        "report_type": "html",
        "report": "<html>...credit report content...</html>",
        "report_url": "https://api.finpass.ai/reports/abc123.html",
        "generated_at": "2026-05-21T10:30:00Z"
    }
}

Possible Error Responses#

Invalid PAN
Missing Consent
Authentication Error
Business Not Found
{
    "status": "failed",
    "message": "Invalid PAN format. Expected format: ABCDE1234F",
    "error_code": "INVALID_PAN"
}
This error occurs when the provided PAN does not match the required 10-character format (5 uppercase letters, followed by 4 digits, followed by 1 uppercase letter).

Integration Best Practices#

Security Recommendations
Store API credentials (X-API-KEY and X-API-Secret) in secure environment variables or a secrets manager; never hard-code them in source code or expose them in client-side applications.
Always transmit requests over HTTPS to ensure data is encrypted in transit.
Implement IP whitelisting on your Finpass account where possible to restrict API access to trusted servers.
Log all credit report requests with timestamps and user identifiers for audit and compliance purposes, but never log full API secrets or sensitive PAN data in plaintext.
User Experience Guidelines
Obtain explicit, informed consent from the business owner or authorized representative before initiating a credit report fetch, and store proof of consent.
Display a clear loading indicator while the credit report is being generated, as bureau responses may take several seconds.
Render the HTML report within a styled container or iframe that matches your application's design for a seamless user experience.
Handle error responses gracefully with user-friendly messages, especially for cases like missing credit history where the user may need guidance on next steps.

Code Samples#

cURL
Python
Node.js
Related APIs
Consumer Credit Report API: Fetches credit reports for individual consumers using their PAN and personal details, useful for retail lending and personal loan underwriting.
PAN Verification API: Validates the authenticity of a PAN and returns basic registration details, often used as a pre-check before fetching credit reports.
GSTIN Verification API: Verifies a business's GST registration status and details, complementing credit reports for comprehensive business due diligence.
Business Profile API: Retrieves company registration details, directors, and corporate structure information for enriched business verification workflows.
Compliance and Legal Considerations
Fetching commercial credit reports involves accessing sensitive financial information and is governed by various data protection and credit bureau regulations. Ensure the following compliance measures are in place:
Consent Management: Obtain and document explicit consent from authorized representatives of the business before fetching their credit report. The consent field must reflect actual user authorization.
Data Protection: Comply with applicable data protection laws (such as India's Digital Personal Data Protection Act) when storing, processing, or sharing credit report data.
Credit Bureau Regulations: Adhere to the Credit Information Companies (Regulation) Act, 2005, and related RBI guidelines governing access to and use of credit information in India.
Purpose Limitation: Use credit reports only for the specific lawful purpose for which consent was obtained (e.g., loan underwriting, partnership evaluation) and avoid secondary use without fresh consent.
Data Retention: Define and enforce clear data retention policies for credit reports, securely deleting them after their purpose is fulfilled or as required by law.
Audit Trail: Maintain detailed logs of all credit report requests, including the requestor, purpose, timestamp, and consent records, to support regulatory audits.

Request

Header Params

Body Params application/jsonRequired

Examples

Responses

🟢200Success
application/json
Bodyapplication/json

Request Request Example
Shell
JavaScript
Java
Swift
curl --location 'https://api.finpass.ai/api/v1/services/credit-report-commercial/fetch' \
--header 'x-api-key;' \
--header 'x-api-secret;' \
--header 'Content-Type: application/json' \
--data '{
    "business_name": "Acme Pvt Ltd",
    "pan": "ABCDE1234F",
    "consent": "Y",
    "report_type": "html"
}'
Response Response Example
{}
Previous
Introduction
Next
Multi-Bureau Fetch
Built with