TSPH Credit Insight API Integration FAQs

QUESTIONS ANSWERS

Are you using cloud services for your TS Credit Yes, our TS Credit Insight system is hosted inside the Telco (Globe’s) infrastructure. They
Insight service? are using AWS cloud services in the SG region.

What do we need to provide for TS to create our For a TEST account, we need a signed DPIA.
TEST and PROD API accounts/credentials?
For a PROD account, we need a signed service contract.

When do we need to provide our public key to TS For the TEST environment, we will create the initial public and private keys for the score
for the score encryption? encryption/decryption and share these with you via the TS fileportal.

For the PROD environment, you may provide us with the public key you generated before
going live so we can set up the key in our system.

Is there a fixed frequency or any specific event after The keys are permanent and do not need to be refreshed. We do, however, require that you
which the keys have to be regenerated or change the account password every 90 days for security purposes.
refreshed?

Is the Credit Insight Service only for Philippine Yes, right now we have scores available only for Globe Telecom subscribers.
phone numbers?

In case of a failed response, should we try sending This depends on the verdict value. If you received “failure,” this could mean that the score
the same score request again? request timed out and we recommend sending the same score request once to see if it
becomes successful. Otherwise, if it still returns “failure,” there may be a system outage
and you should not retry again.

If you received, “unavailable_score” or “msisdn_not_found,” this means that the mobile

We do weekly refresh of the TSPH credit insights. This means these mobile numbers
might have a different value the following week.

In case we retry sending failed API calls, do we get We charge for every successful API request (status code 200).
charged again?.

What value should we use for the parameter In case of an audit from our telco partner or any government regulatory body, we will use
external_source_id? this external_source_id value to get a copy of the consent provided by the borrower/loan
applicant to you to get their telco score from TS.

This value should enable you to locate that consent, may it be a hard copy, or digital copy,
or table entries.

We recommend using the customer id, loan application id, or loan contract id plus the
timestamp when the loan applicant provided the consent.

What format should we use for the parameter Please follow this format - regex: ^()[a-zA-Z0-9_-]{1,63}$
external_source_id?
This regular expression is a string that is between 1 and 63 characters long, consisting
only of letters (both uppercase and lowercase), digits, underscores, and hyphens.

What is the timeout duration of the TS score The timeout is currently set at 32 seconds.
request?

Do you need to whitelist our IPs? Yes, please provide us with your IPs so we can whitelist them. Please provide the IPs for
both NON-PROD and PROD systems.

Do we need to whitelist your IPs? Yes, we currently use Cloudflare for Web Application Firewall. Please whitelist the
following IPs in this page: [Link]

Can you share sample mobile numbers that we can Yes, a list is provided in the TS fileportal. Filename is DEV TEST [Link] under
use in testing? 03-API_Integration_DEV folder. This list contains the test mobile numbers and their
corresponding TS scores.

Can we request actual mobile numbers to be added No, we only allow the mobile numbers in the list we provided for testing.
and used for testing?

What format should we use for the mobile Please use the 10-digit format (for example: 9176543210) before encrypting it with the

STRICTLY CONFIDENTIAL
numbers? Globe public key. Remove all leading 0’s and country code (+63).

Will you be providing us with any reports? We will send a report at the first week of the month containing the list of all the score
requests you made in the previous month. You may use this to reconcile the counts in your
system.

Our BD team will also provide you with a monthly report with details specific to your
account.

Should we generate a new token every time we No, you should not generate a new token every time you send a score request.
send a score request?
A token is valid for 24 hours. You need to generate this only once or twice a day and reuse
the same token for all the score requests.

What happens if I generate a new token every time The multiple authentication/token generation requests might trigger an alert in our system
we send a score request? that will then block your IP.

Is there a specific time that we should generate the It depends on your setup. For example, you might want to generate twice a day at 7AM
tokens? and 7PM. Or 12AM and 12NN. It’s up to you.

STRICTLY CONFIDENTIAL