AECB credit report (UAE)

A mock of Al Etihad Credit Bureau's CRIF Message Gateway: the SOAP service UAE lenders call for a New Application Enquiry (product NAE) that returns the Consumer Score 3.0. Point your AECB client at it in place of the bureau's test gateway, and it answers with the same envelope, result codes and NAE_RES document.

Testlie is not affiliated with, endorsed by or sponsored by Al Etihad Credit Bureau or CRIF. The names are used only to say which API this mock is compatible with.

Synthetic subjects only: no real person's credit file is in the mock. Scores are made up from the Emirates ID you send, and the response never repeats the subject's details. Use made-up Emirates IDs, names and birth dates.

#Connect

Create an AECB credit report (UAE) under Banking. Its credentials are the gateway's member login: user domain (AECB_UD, TESTLIE), user id (AECB_UID) and password (AECB_UPWD). The user id and password are checked on every call. The user domain may be sent empty; if you send one, it must match.

Configure your client like this:

The real gateway also asks for a TLS client certificate. Testlie serves a publicly trusted certificate and does not ask for one, so a client that offers one when asked still connects.

#The request

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <Message xmlns="urn:crif-message:2006-08-23" GId="…" MId="…" MTs="2026-10-29T10:00:00Z">
      <C UD="$AECB_UD" UId="$AECB_UID" UPwd="$AECB_UPWD"/>
      <P SId="CB" PId="NAE" PNs="urn:uae-message:2014-06-01"/>
      <Tx TxNs="urn:crif-messagegateway:2006-08-23"/>
    </Message>
  </soap:Header>
  <soap:Body>
    <MGRequest xmlns="urn:crif-messagegateway:2006-08-23">&lt;NAE_REQ xmlns="urn:NAE"&gt;…&lt;/NAE_REQ&gt;</MGRequest>
  </soap:Body>
</soap:Envelope>

MGRequest holds the NAE_REQ document as escaped text. One CDATA section also works. NAE_REQ needs:

• ConsentFlag set to 1;
• Application/ProviderApplicationNo, unique per enquiry (up to 40 letters, digits, -, _ or .);
• Application/ContractType;
• Application/NotInstallment/CreditLimit or an Application/Installment block;
• Role: A, C or G;
• Subject/Individual with NameEN/FirstName, NameEN/LastName, Gender (M, F or U), DOB (DDMMYYYY), EmiratesId (784-YYYY-NNNNNNN-N, dashes optional) and optionally PrimaryMobileNo.

#The answer

The gateway's result is in the header, as <P …><R C="S" D="Success"/></P>, followed by the same <R> in <Tx>. On success, the body's MGResponse holds the escaped NAE_RES:

<NAE_RES xmlns="urn:NAE">
  <ResponseId>RID-…</ResponseId>
  <NewApplication><CBContractId>CB…</CBContractId></NewApplication>
  <Score><Data><Index>591</Index><Range>M2</Range></Data></Score>
</NAE_RES>

CBContractId is the contract the bureau opened for the application. It is present whenever the enquiry was processed, so treat it as billed, even when no score came out. Score/Error (Number, Description) replaces Score/Data when no score could be given. NAE_RES/Error (No, Description) replaces both when the application was refused. A refused application has no NewApplication.

Application errors (R C="S", NAE_RES/Error, not billed):

The V01/V02, 2 and 3 codes and the 100 to 199 contract range are the mock's own rules, not AECB's.

#Synthetic subjects

The score is stable for an Emirates ID: the same ID always gets the same band and index, on every mock. The band follows the Consumer Score 3.0 bands (M0 to M9 for a mature file, 300 to 850; N0 to N9 for new to credit, 300 to 650), and the index always falls inside its band.

The last four digits of the seven-digit serial pick a profile. For example, 784-1990-0009999-1 has the serial 0009999:

#Scenarios

The Outcome scenario overrides the magic serials for every call:

• Succeed gives every subject a mature-file score.
• Decline answers with the chosen code: NO_HIT (the default), LOW_SCORE, SCORE_EXCLUSION, SCORE_TECHNICAL_ERROR, APPLICATION_REFUSED, SERVICE_ERROR or AUTH. These calls count as ordinary calls.

The generic API failure, latency and Next time scenarios also apply. API failure, and the Next time server error, rate limit, unavailable (HTTP 503) and not-found rules, answer a gateway SE result in the same envelope. The Next time timeout answers HTTP 504 with a body that is not SOAP, and malformed answers deliberately broken, non-XML content. Next time rules apply only to calls that carry the mock's user id or password.

#What is kept

Each enquiry is stored with its ResponseId, CBContractId, outcome and the subject's enquiry count on this mock, so you can see repeats. The Emirates ID itself is not stored: only a keyed hash of it (HMAC with a server-side secret) is. In the call log, the password (UPwd), names, nationality, birth date, Emirates ID, mobile number and application number are masked in requests, and the score's Index and Range are masked in responses.

Not implemented: other AECB products (credit reports, commercial enquiries), passport-only subjects, and the full credit report sections.