Five minutes to your first score. One REST surface, sandbox keys on demand. Integrate directly over HTTPS today — signed requests, webhook delivery, cost meters — with official Python, Node and Java SDKs in preparation. Every model card linkable at /models; every response replayable.
# Score a credit application over raw HTTPS TS=$(date +%s) BODY='{"features":{"monthly_income_inr":65000}}' SIG=$(printf "%s" "$BODY" | openssl dgst -sha256 -hmac "$MUKODI_HMAC_SECRET" | sed 's/^.* //') curl -X POST https://api.mukodi.com/api/v1/b2b/credit-score \ -H "X-API-Key: $MUKODI_API_KEY" \ -H "X-HMAC-Signature: $SIG" \ -H "X-Request-Timestamp: $TS" \ -H "Content-Type: application/json" \ -d "$BODY" # → score, shap_top_5, counterfactuals, decision_lineage
Export your key as MUKODI_API_KEY (and the HMAC secret as MUKODI_HMAC_SECRET) and run any of the calls below. Every response returns a JSON envelope with a request_id and processing_time_ms under metadata.
# POST · /api/v1/b2b/credit-score (LIVE)
TS=$(date +%s)
BODY='{"features":{"monthly_income_inr":65000,"loan_amount_inr":350000,"tenure_months":24}}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$MUKODI_HMAC_SECRET" | sed 's/^.* //')
curl -sS -X POST https://api.mukodi.com/api/v1/b2b/credit-score \
-H "Content-Type: application/json" \
-H "X-API-Key: $MUKODI_API_KEY" \
-H "X-HMAC-Signature: $SIG" \
-H "X-Request-Timestamp: $TS" \
-d "$BODY"# GET · /api/v1/b2b/health-score/{user_id} (LIVE)
# GET is not HMAC-gated — only X-API-Key is required. Subject consent
# (b2b_data_sharing) is enforced server-side; missing consent → 403.
curl -sS https://api.mukodi.com/api/v1/b2b/health-score/3f9c1b6e-... \
-H "X-API-Key: $MUKODI_API_KEY"# POST · /api/v1/b2b/document-verify (LIVE · multipart) # HMAC over a multipart body is impractical from a shell; use the # JSON POST endpoints (credit-score / spending-analytics) for the # signing walkthrough. document-verify accepts the uploaded file # under the "file" field and is capped at 25 MiB. curl -sS -X POST https://api.mukodi.com/api/v1/b2b/document-verify \ -H "X-API-Key: $MUKODI_API_KEY" \ -F "[email protected]"
Official Python, Node and Java SDKs — generated from the same OpenAPI 3.1 spec — are being prepared and are not published yet. Nothing is on PyPI, npm or Maven Central today. Integrate directly over HTTPS using the curl examples on this page; we will announce SDK availability in the partner newsletter.
Do not run install commands that claim to be the Mukodi SDK — no pip, npm or Maven artifact has been published by Nilfee Fintech. Any package matching those names is not ours. When the SDKs ship they will be announced here and in the partner newsletter, generated from the OpenAPI 3.1 spec, and versioned semantically. Until then, the raw HTTPS calls above are the supported integration path.
The filtered public B2B surface. No authentication required to download.
Every request carries an X-API-Key. POST requests add an X-HMAC-Signature (lowercase-hex HMAC-SHA256 of the exact body bytes) and an X-Request-Timestamp accepted within ±300 s. There is no Bearer token on the B2B surface. A missing or invalid key returns 403; a bad signature or missing/expired timestamp returns 401.
# 1. serialize the body ONCE, then sign those exact bytes TS=$(date +%s) BODY='{"features":{"monthly_income_inr":65000}}' SIG=$(printf "%s" "$BODY" | openssl dgst -sha256 -hmac "$MUKODI_HMAC_SECRET" | sed 's/^.* //') # 2. send the UNCHANGED bytes (do not re-serialize after signing) curl -X POST https://api.mukodi.com/api/v1/b2b/credit-score \ -H "X-API-Key: $MUKODI_API_KEY" \ -H "X-HMAC-Signature: $SIG" \ -H "X-Request-Timestamp: $TS" \ -d "$BODY"
Register a callback URL and declare the event_types you want. We deliver signed callbacks — each carries an HMAC-SHA256 signature of the raw body computed with your webhook secret. Manage your registration with the live endpoints below.
POST /api/v1/b2b/webhooks/registerSupply the callback URL and the event_types you want. The HMAC secret is returned once in the response body — store it in your secret manager. A signed webhook.registered confirmation is delivered to the URL.
GET /api/v1/b2b/webhooksReturns your registered callback URL and the event_types echoed from your latest registration. Empty if you have not registered.
DELETE /api/v1/b2b/webhooks/{id}Removes your registered webhook. The id is the one returned by register; a mismatched or absent id returns 404.
Signed deliveryEvery delivered callback carries an HMAC-SHA256 signature (lowercase hex) of the raw body, computed with your webhook secret. Verify it before trusting the payload — see the snippet below.
# Verify a delivered webhook: HMAC-SHA256 (lowercase hex) of the raw body.
import hmac, hashlib, os
def verify(body: bytes, header_signature: str) -> bool:
secret = os.environ["MUKODI_WEBHOOK_SECRET"].encode()
expected = hmac.new(secret, body, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, header_signature)Per-tenant cost budgets enforce themselves. We soft-warn at 80%, hard-pause at 100% — no rolling overage. Every limit is visible at the partner portal.
Sandbox keys are issued through the partner-registration flow. The application captures GSTIN, PAN, address, a tech contact and a fingerprint; once approved by the partner control center, the portal exposes a sandbox key and a production key behind the same panel.
This page is a static export, so it makes no live claims. The realtime status page — per-service health, incidents, and history — lives in the partner portal next to your keys; the SLA is published per partner MSA. A nightly HMAC-chain verification job (a chain, not a Merkle tree) exits non-zero on any break.
Sandbox keys land in minutes. Production review takes a week. Get the team you have, integrating with the team you wish you had.