Multi-Bureau Credit Report Fetch

Endpoint Overview

POST /api/v1/services/multi-bureau/fetch

Description

The Multi-Bureau Credit Report Fetch API enables businesses to retrieve comprehensive credit reports from multiple credit bureaus — including Equifax and Experian — in a single, unified API call. By aggregating data from multiple sources simultaneously, this endpoint eliminates the need for separate integrations with each bureau, dramatically reducing complexity and latency in credit decisioning workflows.

This API is particularly valuable for lenders, fintech platforms, and financial institutions that require a holistic view of a borrower's creditworthiness before making underwriting or eligibility decisions. With built-in consent management, the endpoint ensures regulatory compliance by capturing user consent before any credit data is fetched.

Key Benefits

Multi-Bureau Coverage: Fetch credit data from Equifax and Experian simultaneously in a single request, reducing API overhead and improving decision accuracy.

Unified Response Format: Receive all bureau data in a standardized, normalized response structure — no need to handle differing response schemas per bureau.

Built-in Consent Management: Consent capture is integral to the request payload, ensuring every credit pull is fully auditable and regulatory-compliant.

Faster Credit Decisioning: Parallel bureau data retrieval significantly reduces total turnaround time compared to sequential individual bureau calls.

Use Cases

Lending & NBFCs

Fintech & Neo-Banks

Insurance & Verification

Perform multi-bureau credit checks during personal loan or business loan origination to assess risk from multiple data sources before approval.

Run simultaneous bureau pulls for co-applicant verification to evaluate joint liability and household creditworthiness.

Automate bureau refresh cycles for existing borrowers during loan renewal or limit enhancement workflows.

Technical Implementation

Authentication

All requests to the Finpass API must be authenticated using a combination of X-API-Key and X-API-Secret headers. These credentials are environment-specific and must not be mixed across sandbox and production.

Obtain API Credentials: Register on the Finpass platform to receive your X-API-Key and X-API-Secret.

Include in Every Request: Pass both headers with every API call as shown below.

Keep Credentials Secure: Never expose your X-API-Secret in client-side code, logs, or version control.

Different credentials are issued per environment:

Sandbox: Used for testing and integration; no real bureau data is returned.

Production: https://api.finpass.ai — returns live bureau data; requires production credentials.

Authentication Headers

Header	Required	Description
`X-API-Key`	Yes	Your unique Finpass API key for identifying the calling application.
`X-API-Secret`	Yes	Your secret credential used alongside the API key for request authentication.
`Content-Type`	Yes	Must be set to `application/json` for all requests.

Request Parameters

Request Headers

Header	Required	Description
`X-API-Key`	Yes	Finpass-issued API key for the calling application.
`X-API-Secret`	Yes	Finpass-issued secret paired with the API key.
`Content-Type`	Yes	Set to `application/json`.

Request Body

Parameter	Type	Required	Description
`pan`	`string`	Yes	The Permanent Account Number (PAN) of the individual whose credit report is being fetched. Must be a valid 10-character alphanumeric PAN (e.g., `HDFPK7601L`).
`name`	`string`	Yes	Full legal name of the individual as it appears on official documents. Used for identity matching at the bureau.
`mobile_number`	`string`	Yes	10-digit mobile number of the individual (without country code). Used for identity verification and bureau matching.
`consent`	`string`	Yes	Explicit user consent flag. Must be `"Y"` to indicate the individual has consented to their credit data being pulled. Requests with `"N"` will be rejected.
`gender`	`string`	Yes	Gender of the individual. Accepted values: `"male"`, `"female"`. Required by certain bureaus for identity matching.
`bureaus`	`array`	Yes	List of bureaus from which credit data should be fetched. Accepted values: `"equifax"`, `"experian"`, `"cibil"`, `"crif"`. At least one bureau must be specified.

Example Request

{
    "pan": "HDFPK7601L",
    "name": "Ashok Kumar",
    "mobile_number": "9876543210",
    "consent": "Y",
    "gender": "male",
    "bureaus": [
        "equifax",
        "experian",
        "cibil",
        "crif"
    ]
}

Process Response

Response Parameters

The response returns a unified object containing credit data from each requested bureau. Each bureau's data is scoped under its respective key within the response payload.

Parameter	Type	Description
`status`	`string`	Overall status of the API request. `"success"` indicates data was retrieved; `"error"` indicates a failure.
`status_code`	`integer`	HTTP-compatible status code for the response (e.g., `200`, `400`, `401`, `500`).
`message`	`string`	Human-readable message describing the outcome of the request.
`data`	`object`	Root data object containing bureau-specific credit report results.
`data.equifax`	`object`	Credit report data returned by Equifax (present only if `"equifax"` was included in the request).
`data.experian`	`object`	Credit report data returned by Experian (present only if `"experian"` was included in the request).
`data.cibil`	`object`	Credit report data returned by CIBIL (present only if `"cibil"` was included in the request).
`data.crif`	`object`	Credit report data returned by CRIF High Mark (present only if `"crif"` was included in the request).
`data.equifax.score`	`integer`	Credit score as reported by Equifax.
`data.equifax.report`	`object`	Detailed credit report object from Equifax, including accounts, inquiries, and payment history.
`data.experian.score`	`integer`	Credit score as reported by Experian.
`data.experian.report`	`object`	Detailed credit report object from Experian, including accounts, inquiries, and payment history.
`data.cibil.score`	`integer`	Credit score as reported by CIBIL (TransUnion).
`data.cibil.report`	`object`	Detailed credit report object from CIBIL, including accounts, inquiries, and payment history.
`data.crif.score`	`integer`	Credit score as reported by CRIF High Mark.
`data.crif.report`	`object`	Detailed credit report object from CRIF High Mark, including accounts, inquiries, and payment history.
`request_id`	`string`	Unique identifier for the API request. Use this for debugging and support escalations.
`timestamp`	`string`	ISO 8601 timestamp indicating when the response was generated.

Example Successful Response

{
    "status": "success",
    "status_code": 200,
    "message": "Credit reports fetched successfully.",
    "request_id": "fp_req_9a3f72bc1e4d",
    "timestamp": "2024-11-15T10:32:45Z",
    "data": {
        "equifax": {
            "score": 748,
            "report": {
                "name": "Ashok Kumar",
                "pan": "HDFPK7601L",
                "accounts": [],
                "inquiries": [],
                "payment_history": []
            }
        },
        "experian": {
            "score": 731,
            "report": {
                "name": "Ashok Kumar",
                "pan": "HDFPK7601L",
                "accounts": [],
                "inquiries": [],
                "payment_history": []
            }
        },
        "cibil": {
            "score": 762,
            "report": {
                "name": "Ashok Kumar",
                "pan": "HDFPK7601L",
                "accounts": [],
                "inquiries": [],
                "payment_history": []
            }
        },
        "crif": {
            "score": 719,
            "report": {
                "name": "Ashok Kumar",
                "pan": "HDFPK7601L",
                "accounts": [],
                "inquiries": [],
                "payment_history": []
            }
        }
    }
}

Possible Error Responses

400 Bad Request

401 Unauthorized

422 Unprocessable Entity

500 Internal Server Error

{
    "status": "error",
    "status_code": 400,
    "message": "Invalid request payload. 'consent' must be 'Y' to proceed.",
    "request_id": "fp_req_7b2c91ae5d3f"
}

Returned when the request body is malformed, missing required fields, or contains invalid values (e.g., consent not set to "Y", invalid PAN format, or no bureaus specified).

Integration Best Practices

Security Recommendations

Never expose credentials client-side: Your X-API-Key and X-API-Secret must only be used server-side. Never embed them in mobile apps, browser JavaScript, or public repositories.

Rotate credentials regularly: Periodically regenerate your API credentials from the Finpass dashboard, especially after team member offboarding or suspected compromise.

Use environment-specific credentials: Maintain separate X-API-Key / X-API-Secret pairs for sandbox and production environments to prevent accidental live data access during testing.

Implement request logging: Log request_id values for every API call to enable rapid debugging and audit trail maintenance.

Validate PAN format before calling: Pre-validate PAN format client-side (10-character alphanumeric, 5th character must be a letter) to avoid unnecessary API calls and reduce costs.

User Experience Guidelines

Explicit consent capture: Always display a clear, plain-language consent statement to the user before initiating a bureau pull. Record the timestamp and consent text version for compliance audits.

Graceful degradation: If one bureau returns an error, present the available data from the successful bureau rather than failing the entire flow.

Transparent communication: Inform users that a credit inquiry is being performed and which bureaus will be queried, in line with RBI and data protection guidelines.

Retry with backoff: Implement exponential backoff for 500-level errors. Do not retry 400 or 401 errors without resolving the underlying issue.

Minimize data retention: Store only the credit data fields required for your business logic. Avoid persisting full bureau report objects longer than necessary.

Code Samples

cURL

Python

Node.js

Java

Related APIs

Single Bureau Credit Report Fetch — Fetch a credit report from a single specified bureau (Equifax or Experian) using the individual's PAN and personal details.

Credit Score Check — Retrieve a summarized credit score from one or more bureaus without pulling the full detailed credit report.

PAN Verification — Validate a PAN card number against the NSDL/UTIITSL database to confirm identity before initiating a bureau pull.

Aadhaar eKYC — Perform Aadhaar-based eKYC for identity verification as part of a broader onboarding or credit assessment workflow.

Bank Statement Analysis — Analyze uploaded bank statements to derive income, cash flow, and repayment capacity signals to complement bureau data.

Compliance and Legal Considerations

Explicit User Consent Required: Under the Credit Information Companies (Regulation) Act, 2005 (CICRA) and RBI guidelines, credit information can only be accessed with the explicit written or digital consent of the individual. The consent field must always be "Y", and the platform must maintain a verifiable consent audit trail including timestamp, consent text version, and user identification.

Data Localization: All credit data fetched via this API must be stored and processed within India in compliance with applicable data localization requirements under Indian law.

Purpose Limitation: Credit report data must be used solely for the purpose disclosed to the user at the time of consent. Repurposing bureau data for unrelated use cases (e.g., marketing profiling) is prohibited.

Data Minimization & Retention: Retain only the minimum credit data fields necessary for your business purpose. Define and enforce a data retention policy — bureau reports should not be stored indefinitely.

Soft vs. Hard Inquiry Disclosure: Inform users whether the bureau pull will be recorded as a hard inquiry (which may impact their credit score) or a soft inquiry. Disclose this clearly before initiating the request.

DPDP Act 2023 Compliance: Comply with India's Digital Personal Data Protection Act, 2023, including obligations around data fiduciary responsibilities, grievance redressal mechanisms, and data principal rights.

Multi-Bureau Fetch

Multi-Bureau Credit Report Fetch#

Description#

Use Cases#

Technical Implementation#

Authentication Headers#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses