API reference

POST
/api/v1/report
<sha256 of the body bytes, lowercase hex>
2026-09-17T08:15:59.212Z
9f1c2b7e4d0a4c3b8e6f1a2d3c4b5a69
KE/LENDER/3002

import { createHash, randomBytes } from "node:crypto";
import { ed25519 } from "@noble/curves/ed25519.js";

const BASE = "https://interchange.servicesuitecloud.com";
const MEMBER = "KE/LENDER/3002";
const SECRET_KEY_HEX = process.env.INTERCHANGE_SECRET_KEY; // 32-byte Ed25519 seed, hex

export async function interchange(path, payload) {
  const body = JSON.stringify(payload);
  const timestamp = new Date().toISOString();
  const nonce = randomBytes(16).toString("hex");
  const canonical = [
    "POST",
    path,
    createHash("sha256").update(body, "utf8").digest("hex"),
    timestamp,
    nonce,
    MEMBER,
  ].join("\n");
  const signature = Buffer.from(
    ed25519.sign(new TextEncoder().encode(canonical), Buffer.from(SECRET_KEY_HEX, "hex")),
  ).toString("hex");

  const res = await fetch(BASE + path, {
    method: "POST",
    headers: {
      "content-type": "application/json",
      "x-interchange-member": MEMBER,
      "x-interchange-timestamp": timestamp,
      "x-interchange-nonce": nonce,
      "x-interchange-signature": signature,
    },
    body, // send exactly the bytes you hashed
  });
  return res;
}

// dotnet add package BouncyCastle.Cryptography
using System.Security.Cryptography;
using System.Text;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Crypto.Signers;

static HttpRequestMessage Sign(string path, string body, string member, string secretKeyHex, string baseUrl)
{
    var timestamp = DateTime.UtcNow.ToString("yyyy-MM-dd'T'HH:mm:ss.fff'Z'");
    var nonce = Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLowerInvariant();
    var digest = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(body))).ToLowerInvariant();
    var canonical = string.Join("\n", "POST", path, digest, timestamp, nonce, member);

    var signer = new Ed25519Signer();
    signer.Init(true, new Ed25519PrivateKeyParameters(Convert.FromHexString(secretKeyHex), 0));
    var bytes = Encoding.UTF8.GetBytes(canonical);
    signer.BlockUpdate(bytes, 0, bytes.Length);
    var signature = Convert.ToHexString(signer.GenerateSignature()).ToLowerInvariant();

    var req = new HttpRequestMessage(HttpMethod.Post, baseUrl + path)
    {
        Content = new StringContent(body, Encoding.UTF8, "application/json"),
    };
    req.Headers.Add("x-interchange-member", member);
    req.Headers.Add("x-interchange-timestamp", timestamp);
    req.Headers.Add("x-interchange-nonce", nonce);
    req.Headers.Add("x-interchange-signature", signature);
    return req;
}

# pip install cryptography requests
import hashlib, json, os, secrets, requests
from datetime import datetime, timezone
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

BASE = "https://interchange.servicesuitecloud.com"
MEMBER = "KE/LENDER/3002"
KEY = Ed25519PrivateKey.from_private_bytes(bytes.fromhex(os.environ["INTERCHANGE_SECRET_KEY"]))

def interchange(path, payload):
    body = json.dumps(payload, separators=(",", ":"))
    timestamp = datetime.now(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
    nonce = secrets.token_hex(16)
    canonical = "\n".join(["POST", path, hashlib.sha256(body.encode()).hexdigest(), timestamp, nonce, MEMBER])
    signature = KEY.sign(canonical.encode()).hex()
    return requests.post(BASE + path, data=body.encode(), headers={
        "content-type": "application/json",
        "x-interchange-member": MEMBER,
        "x-interchange-timestamp": timestamp,
        "x-interchange-nonce": nonce,
        "x-interchange-signature": signature,
    })

<?php
// Requires the sodium extension (bundled with PHP 7.2+).
function interchange(string $path, array $payload): string {
    $base = "https://interchange.servicesuitecloud.com";
    $member = "KE/LENDER/3002";
    $seed = hex2bin(getenv("INTERCHANGE_SECRET_KEY"));          // 32-byte seed
    $secret = sodium_crypto_sign_secretkey(sodium_crypto_sign_seed_keypair($seed));

    $body = json_encode($payload, JSON_UNESCAPED_SLASHES);
    $timestamp = gmdate("Y-m-d\\TH:i:s.v\\Z");
    $nonce = bin2hex(random_bytes(16));
    $canonical = implode("\n", ["POST", $path, hash("sha256", $body), $timestamp, $nonce, $member]);
    $signature = bin2hex(sodium_crypto_sign_detached($canonical, $secret));

    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $body,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            "content-type: application/json",
            "x-interchange-member: $member",
            "x-interchange-timestamp: $timestamp",
            "x-interchange-nonce: $nonce",
            "x-interchange-signature: $signature",
        ],
    ]);
    return curl_exec($ch);
}

{
  "report_type": 12,
  "identity_number": "880000088",
  "identity_type": "001",
  "loan_amount": 8000,
  "report_reason": 1,
  "consent_ref": "csn_…",
  "format": "json"
}

{
  "has_error": false,
  "api_code": null,
  "api_code_description": null,
  "api_version": "v1",
  "reference": "IX-69RQ-JBKC-20260918",
  "report": {
    "type": 2,
    "name": "Delinquency Status",
    "product": "bureau_direct"
  },
  "report_date": "2026-09-18 14:17:45 EAT",
  "requested_by": {
    "person": "Sample Analyst",
    "organisation": "Sample Lender Limited",
    "member_code": "KE/LENDER/SAMPLE"
  },
  "subject": {
    "identity_type": {
      "code": "001",
      "label": "National ID"
    },
    "identity_number": "880000088"
  },
  "provenance": {
    "provider": "Metropol Credit Reference Bureau",
    "bureau_report_types": [
      2
    ],
    "bureau_transaction_ids": [
      "07b8de7d-377a-4146-a818-3bb85687b00c"
    ],
    "responses": [
      {
        "report_type": 2,
        "sha256": "44dde58b5e1ddb223557140e067b09b8f9d0ddac0a3534bc5cee37e08aa9d51d",
        "capture": "unwrapped"
      }
    ],
    "interchange_role": "Retrieved, kept unchanged, and presented. The Interchange is not a credit reference bureau."
  },
  "data": {
    "delinquency": {
      "code": "004",
      "label": "Currently delinquent",
      "meaning": "At least one account is non-performing right now."
    }
  },
  "reading": {},
  "notices": {
    "regulation_40_1": "…",
    "bureau_disclaimer": [
      "…"
    ],
    "interchange": "…"
  },
  "verify": {
    "url": "https://interchange.servicesuitecloud.com/verify/IX-69RQ-JBKC-20260918",
    "content_sha256": "3a12270f60885014644722769aa54aef118c068a3355b5c54f2dff4592f8a34f"
  },
  "sample": true
}