API Service Platform

Snapshot

The Challenge

Indian lenders, NBFCs and background-verification firms need to check dozens of government and bureau data points before onboarding a customer or employee — PAN, Aadhaar, UAN/EPFO employment history, passport, voter ID, driving licence, CIBIL and other credit bureaus, and more. Each data point comes from a different third-party provider, each with its own authentication scheme, request format, error semantics, encryption requirements and quirks.

The client wanted to sit in the middle of that mess and offer customers one product: a single account, one balance, one audit trail, and one integration — whether the customer prefers to call an API or use a web portal. Customers should never see, sign contracts with, or even know the names of the upstream providers.

What I Build

A system of five independently deployable services:

1. Verification API engine

The public REST API. API-key authenticated, prepaid-wallet billed. Wraps every third-party provider behind a uniform request/response contract and a single catalogue of verification products.

Control Panel API

The internal back office: staff and client accounts, role-based access control, client onboarding, per-client pricing, wallet top-ups, and which verification products each client may use. Owns the shared database schema (49 versioned migrations).

Control Panel Web App

the Angular admin console for the team to run all of the above.

Customer Services API

A JWT-authenticated session layer for the portal, plus a period-over-period analytics dashboard computed over the shared data.

Customer portal

The Angular self-service web app where customers run single or bulk verifications, download reports, manage API keys, watch their wallet, and see their transaction history.

All three backend services share one PostgreSQL database and a common set of conventions (audited soft-deletable entities, a standard response envelope, constructor injection). Both Angular apps share an architecture: standalone components, feature-colocated NgRx state, and a transparent token-refresh HTTP layer.

Technical Highlights

Three-layer vendor abstraction

Public controllers delegate to an orchestration layer (billing, transaction logging, report generation), which delegates to per-provider HTTP clients that each mirror the provider's own endpoint tree. A single dispatch point maps 30+ verification products to the right provider call and normalises every provider'sresponse — successes, business failures and transport errors alike — into one shape.

Provider-grade security integration

One provider requires hybrid encryption on every payload (RSA-OAEP key exchange + AES-GCM) and OAuth token management with a multi-application credential model; I implemented the full crypto and token layer from their specification.

Vendor-identity confidentiality by design.

A defence-in-depth sanitiser scrubs every provider name, domain and product token out of all client-facing error messages; unhandled errors never echo their text at all.

Correct-by-construction billing

Two-tier pricing (catalogue default + per-client override), a prepaid wallet with a ledger row per movement, and one rule enforced identically on the single-call and bulk paths: the customer is charged only when the provider returns a successful result.

Asynchronous bulk processing

CSV upload → background job → per-record provider calls (fault-tolerant, resumes past provider timeouts) → ZIP of individual PDF reports → email notification, with live progress tracking.

Document report generation

Server-rendered HTML → PDF → PNG pipeline with full Devanagari script support, a rendered credit-score gauge, and per-client template versioning.

A real RBAC engine

Users → roles → privileges → permissions, each link independently toggleable, plus per-user allow/deny overrides with expiry, Redis-cached and fully audit-logged.

Account-security hardening

Short-lived JWTs with transparent refresh, a typed login-attempt audit log, opaque single-use password-reset tokens with reuse checks and anti-enumeration, per-client API-key management, and opt-in IP allow-listing enforced at authentication time.

Results

• A single developer delivered and operates a five-service platform covering the full verification lifecycle — API, portal, back office, billing, bulk processing and reporting.
• 3 upstream data providers integrated behind one contract, with additional providers in progress and no change required to the customer-facing API to add them.
• ~500 automated test cases, backend integration and end-to-end suites running against a real PostgreSQL database via Testcontainers.

Technology stack