feat(credit-bureau): CIC enquiry-alert dashboard and generic API Management hub (static UI)

Replace CIBIL fetch screens with a dashboard of our customers' loan enquiries
at other lenders (no lender name), CIC whitelist/API mapping, and a Vendor ->
Work -> API set management UI (IN/OUT, SMS, WhatsApp, CIC) with full HTTP detail
and JSON/cURL/Postman/HAR import.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/app/api-management/api-import.util.ts

@@ -0,0 +1,778 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { ApiMappingRow, KeyValue, kv } from './api-management.service';
+
+/**
+ * Reads what a vendor's documentation or a Postman / browser / cURL capture gives - in any of these shapes - and turns
+ * it into the pieces of an API: method, URL, path, query parameters, headers, content type, payload, response status,
+ * response headers, response body, and a first guess at the CBS field mapping. Nothing is sent anywhere.
+ *
+ * Understood:
+ *   - a cURL command
+ *   - a Postman collection or a single Postman request / item (with its saved responses)
+ *   - a HAR capture
+ *   - an "API definition" object: { method, url | path, query, headers, body, status, ... }
+ *   - a bare JSON payload (treated as the request body, or the response body on the response side)
+ *   - form text (a=1&b=2) and other raw text
+ *
+ * Credentials found in headers or query strings are never kept: the value is replaced by {{secret}} and the row is
+ * flagged as secret, so a key pasted from a sample cannot end up stored.
+ */
+
+export interface ImportedRequest {
+  source: string;
+  method?: string;
+  /** The full URL when the file had one. */
+  url?: string;
+  /** Scheme and host of the URL, when present. */
+  baseUrl?: string;
+  path?: string;
+  queryParams: KeyValue[];
+  headers: KeyValue[];
+  contentType?: string;
+  body?: string;
+  /** A response found in the same file (Postman saved response, HAR entry, definition object). */
+  response?: ImportedResponse;
+  notes: string[];
+}
+
+export interface ImportedResponse {
+  source: string;
+  status?: number;
+  headers: KeyValue[];
+  body?: string;
+  errorBody?: string;
+  notes: string[];
+}
+
+const SECRET_HEADERS =
+  /^(authorization|proxy-authorization|x-api-key|api-key|apikey|authkey|x-auth-token|auth-token|token|x-access-token|cookie|set-cookie|x-hub-signature(-256)?)$/i;
+const SECRET_QUERY = /^(key|api[-_]?key|apikey|token|access[-_]?token|auth[-_]?key|secret|password|signature)$/i;
+const SECRET = '{{secret}}';
+
+// ── small helpers ───────────────────────────────────────────────────────────
+
+function isObject(v: unknown): v is Record<string, any> {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+function tryJson(text: string): any {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+}
+
+function prettyJsonOrText(text: string): string {
+  const parsed = tryJson(text);
+  return parsed !== undefined && typeof parsed === 'object' ? JSON.stringify(parsed, null, 2) : text;
+}
+
+function bodyToText(body: unknown): string | undefined {
+  if (body === undefined || body === null) return undefined;
+  if (typeof body === 'string') return prettyJsonOrText(body);
+  return JSON.stringify(body, null, 2);
+}
+
+function toKeyValues(source: unknown, kind: 'header' | 'query' | 'plain'): KeyValue[] {
+  const out: KeyValue[] = [];
+  const add = (key: unknown, value: unknown, description = '', disabled = false) => {
+    const k = String(key ?? '').trim();
+    if (!k) return;
+    const secret = (kind === 'header' && SECRET_HEADERS.test(k)) || (kind === 'query' && SECRET_QUERY.test(k));
+    out.push({
+      key: k,
+      value: secret ? SECRET : value === undefined || value === null ? '' : String(value),
+      description,
+      enabled: !disabled,
+      secret
+    });
+  };
+  if (Array.isArray(source)) {
+    for (const item of source) {
+      if (isObject(item))
+        add(item.key ?? item.name, item.value, String(item.description ?? ''), item.disabled === true);
+    }
+  } else if (isObject(source)) {
+    for (const [
+      k,
+      v
+    ] of Object.entries(source)) add(k, v);
+  }
+  return out;
+}
+
+/** Splits a URL into its base, path and query without failing on {{placeholders}} or {path} parameters. */
+function splitUrl(raw: string): { baseUrl?: string; path: string; query: KeyValue[] } {
+  let rest = raw.trim();
+  let baseUrl: string | undefined;
+  const m = /^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/?#]+)(.*)$/.exec(rest);
+  if (m) {
+    baseUrl = m[1];
+    rest = m[2];
+  }
+  const hash = rest.indexOf('#');
+  if (hash >= 0) rest = rest.slice(0, hash);
+  let queryText = '';
+  const q = rest.indexOf('?');
+  if (q >= 0) {
+    queryText = rest.slice(q + 1);
+    rest = rest.slice(0, q);
+  }
+  const query: KeyValue[] = [];
+  for (const part of queryText.split('&')) {
+    if (!part) continue;
+    const eq = part.indexOf('=');
+    const key = safeDecode(eq >= 0 ? part.slice(0, eq) : part);
+    const value = eq >= 0 ? safeDecode(part.slice(eq + 1)) : '';
+    query.push(...toKeyValues([{ key, value }], 'query'));
+  }
+  return { baseUrl, path: rest || '/', query };
+}
+
+function safeDecode(s: string): string {
+  try {
+    return decodeURIComponent(s.replace(/\+/g, ' '));
+  } catch {
+    return s;
+  }
+}
+
+function detectContentType(
+  headers: KeyValue[],
+  body: string | undefined
+): { contentType?: string; headers: KeyValue[] } {
+  const ct = headers.find((h) => h.key.toLowerCase() === 'content-type');
+  const rest = headers.filter((h) => h.key.toLowerCase() !== 'content-type');
+  if (ct) return { contentType: ct.value.split(';')[0].trim(), headers: rest };
+  if (!body) return { headers: rest };
+  if (tryJson(body) !== undefined) return { contentType: 'application/json', headers: rest };
+  if (/^\s*</.test(body)) return { contentType: 'application/xml', headers: rest };
+  if (/^[^\s=&]+=[^&]*(&[^\s=&]+=[^&]*)*$/.test(body.trim()))
+    return { contentType: 'application/x-www-form-urlencoded', headers: rest };
+  return { contentType: 'text/plain', headers: rest };
+}
+
+/** Everything about a request is derived the same way once method / url / headers / body are known. */
+function finishRequest(
+  source: string,
+  method: string | undefined,
+  url: string | undefined,
+  pathOnly: string | undefined,
+  query: unknown,
+  headers: KeyValue[],
+  body: string | undefined,
+  contentTypeHint: string | undefined,
+  notes: string[]
+): ImportedRequest {
+  const parts = url ? splitUrl(url) : pathOnly ? splitUrl(pathOnly) : undefined;
+  const queryParams = [
+    ...(parts?.query ?? []),
+    ...toKeyValues(query, 'query')
+  ];
+  const detected = detectContentType(headers, body);
+  if (queryParams.some((q) => q.secret))
+    notes.push('A credential in the query string was replaced by {{secret}} - set it on the Connection tab.');
+  if (headers.some((h) => h.secret))
+    notes.push('Credentials in the headers were replaced by {{secret}} - set them on the Connection tab.');
+  return {
+    source,
+    method: method ? method.toUpperCase() : body ? 'POST' : undefined,
+    url,
+    baseUrl: parts?.baseUrl,
+    path: parts?.path,
+    queryParams,
+    headers: detected.headers,
+    contentType: contentTypeHint ?? detected.contentType,
+    body,
+    notes
+  };
+}
+
+// ── cURL ────────────────────────────────────────────────────────────────────
+
+/** Splits a shell command into words, honouring '…' "…" quotes and \ line continuations. */
+function shellWords(command: string): string[] {
+  const words: string[] = [];
+  let cur = '';
+  let quote: '"' | "'" | null = null;
+  let started = false;
+  const text = command.replace(/\\\r?\n/g, ' ').trim();
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (quote) {
+      if (c === quote) quote = null;
+      else if (c === '\\' && quote === '"' && i + 1 < text.length) cur += text[++i];
+      else cur += c;
+    } else if (c === '"' || c === "'") {
+      quote = c;
+      started = true;
+    } else if (/\s/.test(c)) {
+      if (started || cur) words.push(cur);
+      cur = '';
+      started = false;
+    } else if (c === '\\' && i + 1 < text.length) {
+      cur += text[++i];
+    } else {
+      cur += c;
+    }
+  }
+  if (started || cur) words.push(cur);
+  return words;
+}
+
+function parseCurl(text: string): ImportedRequest {
+  const words = shellWords(text);
+  const notes: string[] = [];
+  let method: string | undefined;
+  let url: string | undefined;
+  const headers: KeyValue[] = [];
+  const data: string[] = [];
+  let form = false;
+  let getMode = false;
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    const next = () => words[++i] ?? '';
+    if (w === 'curl') continue;
+    if (w === '-X' || w === '--request') method = next();
+    else if (w === '-H' || w === '--header') {
+      const h = next();
+      const c = h.indexOf(':');
+      if (c > 0) headers.push(...toKeyValues([{ key: h.slice(0, c), value: h.slice(c + 1).trim() }], 'header'));
+    } else if ([
+        '-d',
+        '--data',
+        '--data-raw',
+        '--data-binary',
+        '--data-ascii'
+      ].includes(w)) data.push(next());
+    else if (w === '--data-urlencode') {
+      data.push(next());
+      form = true;
+    } else if (w === '-F' || w === '--form') {
+      data.push(next());
+      form = true;
+      notes.push('Multipart form fields were read as name=value pairs.');
+    } else if (w === '--url') url = next();
+    else if (w === '-G' || w === '--get') getMode = true;
+    else if (w === '-u' || w === '--user') {
+      next();
+      headers.push({
+        key: 'Authorization',
+        value: SECRET,
+        description: 'Basic authentication from the cURL -u option',
+        enabled: true,
+        secret: true
+      });
+    } else if (w.startsWith('-')) {
+      // Flags that take a value we do not need.
+      if ([
+          '-o',
+          '--output',
+          '-A',
+          '--user-agent',
+          '-e',
+          '--referer',
+          '--connect-timeout',
+          '-m',
+          '--max-time',
+          '--proxy',
+          '-x'
+        ].includes(w)) next();
+    } else if (!url && /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(w)) url = w;
+    else if (!url && /^[\w.-]+(:\d+)?\//.test(w)) url = w;
+  }
+  let body = data.length ? data.join('&') : undefined;
+  if (body && getMode) {
+    url = url + (url?.includes('?') ? '&' : '?') + body;
+    body = undefined;
+  }
+  return finishRequest(
+    'cURL command',
+    method ?? (getMode ? 'GET' : body ? 'POST' : 'GET'),
+    url,
+    undefined,
+    undefined,
+    headers,
+    body ? prettyJsonOrText(body) : undefined,
+    form && !headers.some((h) => h.key.toLowerCase() === 'content-type')
+      ? 'application/x-www-form-urlencoded'
+      : undefined,
+    notes
+  );
+}
+
+// ── Postman / HAR / definition object ───────────────────────────────────────
+
+function findPostmanItem(node: any): any {
+  if (!node) return undefined;
+  if (node.request) return node;
+  if (Array.isArray(node.item)) {
+    for (const child of node.item) {
+      const found = findPostmanItem(child);
+      if (found) return found;
+    }
+  }
+  return undefined;
+}
+
+function postmanUrl(url: any): string | undefined {
+  if (!url) return undefined;
+  if (typeof url === 'string') return url;
+  if (typeof url.raw === 'string') return url.raw;
+  const host = Array.isArray(url.host) ? url.host.join('.') : url.host;
+  const path = Array.isArray(url.path) ? url.path.join('/') : url.path;
+  return `${url.protocol ? url.protocol + '://' : ''}${host ?? ''}/${path ?? ''}`;
+}
+
+function postmanResponse(r: any): ImportedResponse {
+  return {
+    source: 'Postman saved response',
+    status: typeof r?.code === 'number' ? r.code : undefined,
+    headers: toKeyValues(r?.header, 'header'),
+    body: bodyToText(r?.body),
+    notes: []
+  };
+}
+
+function fromPostman(item: any): ImportedRequest {
+  const req = item.request;
+  const notes: string[] = [];
+  let body: string | undefined;
+  let contentType: string | undefined;
+  const b = req?.body;
+  if (b?.mode === 'raw') {
+    body = bodyToText(b.raw);
+    const lang = b.options?.raw?.language;
+    if (lang === 'json') contentType = 'application/json';
+  } else if (b?.mode === 'urlencoded') {
+    body = (b.urlencoded ?? [])
+      .filter((p: any) => !p.disabled)
+      .map((p: any) => `${encodeURIComponent(p.key)}=${encodeURIComponent(p.value ?? '')}`)
+      .join('&');
+    contentType = 'application/x-www-form-urlencoded';
+  } else if (b?.mode === 'formdata') {
+    body = (b.formdata ?? []).map((p: any) => `${p.key}=${p.value ?? ''}`).join('&');
+    contentType = 'multipart/form-data';
+  }
+  const request = finishRequest(
+    'Postman request',
+    typeof req?.method === 'string' ? req.method : undefined,
+    postmanUrl(req?.url),
+    undefined,
+    undefined,
+    toKeyValues(req?.header, 'header'),
+    body,
+    contentType,
+    notes
+  );
+  if (Array.isArray(item.response) && item.response.length) request.response = postmanResponse(item.response[0]);
+  if (req?.auth)
+    notes.push('The request had an auth section; it was not read. Set authentication on the Connection tab.');
+  return request;
+}
+
+function fromHar(har: any): ImportedRequest {
+  const entry = har.log.entries[0];
+  const r = entry.request ?? {};
+  const body = r.postData?.text ? prettyJsonOrText(r.postData.text) : undefined;
+  const request = finishRequest(
+    'HAR capture',
+    r.method,
+    r.url,
+    undefined,
+    undefined,
+    toKeyValues(r.headers, 'header'),
+    body,
+    typeof r.postData?.mimeType === 'string' ? r.postData.mimeType.split(';')[0] : undefined,
+    []
+  );
+  const res = entry.response;
+  if (res) {
+    request.response = {
+      source: 'HAR capture',
+      status: typeof res.status === 'number' ? res.status : undefined,
+      headers: toKeyValues(res.headers, 'header'),
+      body: res.content?.text ? prettyJsonOrText(res.content.text) : undefined,
+      notes: []
+    };
+  }
+  return request;
+}
+
+function definitionResponse(def: any): ImportedResponse | undefined {
+  const r = def.response ?? def.responseDefinition;
+  const status = def.status ?? def.statusCode ?? def.successCode ?? r?.status ?? r?.statusCode ?? r?.code;
+  const headers = def.responseHeaders ?? r?.headers;
+  const body = def.responseBody ?? (isObject(r) ? (r.body ?? r.data) : r);
+  const errorBody = def.errorBody ?? def.errorResponse ?? r?.errorBody;
+  if (status === undefined && headers === undefined && body === undefined && errorBody === undefined) return undefined;
+  return {
+    source: 'API definition',
+    status: typeof status === 'number' ? status : status ? Number(status) || undefined : undefined,
+    headers: toKeyValues(headers, 'header'),
+    body: bodyToText(body),
+    errorBody: bodyToText(errorBody),
+    notes: []
+  };
+}
+
+function fromDefinition(def: any): ImportedRequest {
+  const body = def.body ?? def.payload ?? def.data ?? def.requestBody ?? def.request;
+  const bodyText = isObject(body) && ('method' in body || 'url' in body) ? undefined : bodyToText(body);
+  const url = def.url ?? def.endpoint ?? def.uri;
+  const request = finishRequest(
+    'API definition',
+    def.method ?? def.httpMethod,
+    typeof url === 'string' ? url : undefined,
+    typeof def.path === 'string' ? def.path : undefined,
+    def.query ?? def.queryParams ?? def.params,
+    toKeyValues(def.headers, 'header'),
+    bodyText,
+    typeof def.contentType === 'string' ? def.contentType : undefined,
+    []
+  );
+  request.response = definitionResponse(def);
+  return request;
+}
+
+// ── public: request side ────────────────────────────────────────────────────
+
+export function parseRequestText(text: string): ImportedRequest {
+  const t = (text ?? '').trim();
+  if (!t) throw new Error('Nothing to read - paste the request or choose a file.');
+  if (/^curl\b/i.test(t)) return parseCurl(t);
+
+  const parsed = tryJson(t);
+  if (parsed === undefined) {
+    // Not JSON: a cURL command in the middle of text, form data, or other raw text.
+    const curl = /curl\b[\s\S]*/i.exec(t);
+    if (curl && /https?:\/\//.test(curl[0])) return parseCurl(curl[0]);
+    const detected = detectContentType([], t);
+    return finishRequest('Raw text', undefined, undefined, undefined, undefined, [], t, detected.contentType, [
+      'The text is not JSON; it was kept as the request payload.'
+    ]);
+  }
+  if (isObject(parsed) && isObject(parsed.log) && Array.isArray(parsed.log.entries) && parsed.log.entries.length)
+    return fromHar(parsed);
+  if (isObject(parsed) && (parsed.item || parsed.info?.schema)) {
+    const item = findPostmanItem(parsed);
+    if (!item) throw new Error('The Postman collection has no request in it.');
+    return fromPostman(item);
+  }
+  if (
+    isObject(parsed) &&
+    isObject(parsed.request) &&
+    (parsed.request.url || parsed.request.method || parsed.request.header)
+  )
+    return fromPostman(parsed);
+  if (isObject(parsed) && [
+      'method',
+      'httpMethod',
+      'url',
+      'endpoint',
+      'uri',
+      'headers',
+      'queryParams',
+      'requestBody',
+      'payload'
+    ].some((k) => k in parsed) && !('statuses' in parsed)) {
+    return fromDefinition(parsed);
+  }
+  // A bare JSON payload.
+  return finishRequest(
+    'JSON payload',
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    [],
+    JSON.stringify(parsed, null, 2),
+    'application/json',
+    []
+  );
+}
+
+// ── public: response side ───────────────────────────────────────────────────
+
+export function parseResponseText(text: string): ImportedResponse {
+  const t = (text ?? '').trim();
+  if (!t) throw new Error('Nothing to read - paste the response or choose a file.');
+  const parsed = tryJson(t);
+  if (parsed === undefined) {
+    return {
+      source: 'Raw text',
+      headers: [],
+      body: t,
+      notes: ['The text is not JSON; it was kept as the response body.']
+    };
+  }
+  if (isObject(parsed) && isObject(parsed.log) && Array.isArray(parsed.log.entries) && parsed.log.entries.length) {
+    return (
+      fromHar(parsed).response ?? { source: 'HAR capture', headers: [], notes: ['The HAR entry has no response.'] }
+    );
+  }
+  if (isObject(parsed) && (parsed.item || parsed.info?.schema)) {
+    const item = findPostmanItem(parsed);
+    const res = item ? fromPostman(item).response : undefined;
+    if (!res) throw new Error('The Postman collection has no saved response.');
+    return res;
+  }
+  if (isObject(parsed) && Array.isArray(parsed.response) && parsed.response.length && (parsed.request || parsed.name)) {
+    return postmanResponse(parsed.response[0]);
+  }
+  if (isObject(parsed) && [
+      'status',
+      'statusCode',
+      'headers',
+      'responseHeaders',
+      'responseBody',
+      'errorBody'
+    ].some(
+      (k) => k in parsed
+    ) && ('body' in parsed || 'responseBody' in parsed || 'headers' in parsed || 'responseHeaders' in parsed || 'errorBody' in parsed || 'data' in parsed)) {
+    const r = definitionResponse({
+      status: parsed.status ?? parsed.statusCode,
+      responseHeaders: parsed.responseHeaders ?? parsed.headers,
+      responseBody: parsed.responseBody ?? parsed.body ?? parsed.data,
+      errorBody: parsed.errorBody
+    });
+    if (r) return r;
+  }
+  return { source: 'JSON body', headers: [], body: JSON.stringify(parsed, null, 2), notes: [] };
+}
+
+// ── JSON → mapping rows ─────────────────────────────────────────────────────
+
+export interface JsonLeaf {
+  path: string;
+  value: unknown;
+}
+
+/** Every value in a JSON document with its path: `a.b[0].c`. Only the first item of an array is walked. */
+export function flatten(json: unknown, prefix = ''): JsonLeaf[] {
+  const out: JsonLeaf[] = [];
+  if (Array.isArray(json)) {
+    if (json.length) out.push(...flatten(json[0], `${prefix}[0]`));
+  } else if (isObject(json)) {
+    for (const [
+      k,
+      v
+    ] of Object.entries(json)) {
+      out.push(...flatten(v, prefix ? `${prefix}.${k}` : k));
+    }
+  } else if (prefix) {
+    out.push({ path: prefix, value: json });
+  }
+  return out;
+}
+
+function lastKey(path: string): string {
+  const m = /([A-Za-z0-9_$-]+)(\[\d+\])*$/.exec(path);
+  return m ? m[1] : path;
+}
+
+const norm = (s: string) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+
+const REQUEST_GUESS: [RegExp, string, boolean][] = [
+  [
+    /^(mobile|mobiles|mobileno|mobilenumber|msisdn|phone|phoneno|phonenumber|to|destination|recipient|recipients|number|contact)$/,
+    'customer.mobile',
+    true
+  ],
+  [
+    /^(templateid|template|templatename|dlttemplateid|flowid)$/,
+    'message.templateId',
+    true
+  ],
+  [
+    /^(message|text|body|content|sms|msg|smstext|var1|messagetext)$/,
+    'message.text',
+    true
+  ],
+  [
+    /^(sender|senderid|from|source|shortcode)$/,
+    'bank.senderId',
+    false
+  ],
+  [
+    /^(email|emailid|mail|emailaddress)$/,
+    'customer.email',
+    false
+  ],
+  [
+    /^(customername|fullname|firstname|name)$/,
+    'customer.name',
+    false
+  ],
+  [
+    /^(otp|code|pin)$/,
+    'message.otp',
+    false
+  ],
+  [
+    /^(pan|pannumber)$/,
+    'customer.pan',
+    false
+  ],
+  [
+    /^(aadhaar|aadhar|aadhaarnumber)$/,
+    'customer.aadhaar',
+    false
+  ],
+  [
+    /^(dob|dateofbirth|birthdate)$/,
+    'customer.dob',
+    false
+  ],
+  [
+    /^(membercode|memberid|memberreference)$/,
+    'bank.memberCode',
+    false
+  ],
+  [
+    /^(accountno|accountnumber|acno|account)$/,
+    'account.number',
+    false
+  ],
+  [
+    /^(cif|customerid|clientid|cifno)$/,
+    'customer.cif',
+    false
+  ],
+  [
+    /^(amount|amt|txnamount|transactionamount)$/,
+    'txn.amount',
+    false
+  ],
+  [
+    /^(txnid|transactionid|transactionreference|txnref)$/,
+    'txn.reference',
+    false
+  ],
+  [
+    /^(txndate|transactiondate)$/,
+    'txn.date',
+    false
+  ],
+  [
+    /^(fromdate|startdate|datefrom)$/,
+    'request.fromDate',
+    false
+  ],
+  [
+    /^(todate|enddate|dateto)$/,
+    'request.toDate',
+    false
+  ],
+  [
+    /^(reference|referenceno|referencenumber|ref|requestid|clientreference|correlationid)$/,
+    'request.reference',
+    false
+  ],
+  [
+    /^(tenantidentifier|tenantid)$/,
+    'tenant.identifier',
+    false
+  ],
+  [
+    /^(providerid)$/,
+    'sms.providerId',
+    false
+  ]
+];
+
+function guessTransform(cbsField: string, value: unknown): string {
+  if (cbsField === 'customer.mobile') return 'DIGITS_ONLY';
+  if (cbsField === 'customer.email') return 'LOWER';
+  if (cbsField === 'bank.senderId') return 'UPPER';
+  if (cbsField === 'txn.amount') return 'NUMBER';
+  if (typeof value === 'boolean') return 'BOOLEAN';
+  if (typeof value === 'number') return 'NUMBER';
+  if (typeof value === 'string') {
+    if (/^\d{8}$/.test(value) && cbsField.includes('Date')) return 'DATE_DDMMYYYY';
+    if (/^\d{4}-\d{2}-\d{2}/.test(value)) return 'DATE_YYYY_MM_DD';
+  }
+  return 'NONE';
+}
+
+/**
+ * A first mapping for a request payload: each value that looks like a known CBS field (mobile, message, template,
+ * sender ...) becomes "CBS field → path"; every other value becomes a fixed value at its path, so the whole payload is
+ * reproduced. Review and adjust.
+ */
+export function guessRequestRows(bodyText: string): ApiMappingRow[] {
+  const parsed = tryJson(bodyText);
+  if (parsed === undefined || typeof parsed !== 'object' || parsed === null) return [];
+  const rows: ApiMappingRow[] = [];
+  const used = new Set<string>();
+  for (const leaf of flatten(parsed)) {
+    const key = norm(lastKey(leaf.path));
+    const hit = REQUEST_GUESS.find(([re]) => re.test(key));
+    if (hit && !used.has(hit[1])) {
+      used.add(hit[1]);
+      rows.push({
+        from: hit[1],
+        to: leaf.path,
+        transform: guessTransform(hit[1], leaf.value),
+        defaultValue: '',
+        mandatory: hit[2]
+      });
+    } else {
+      rows.push({
+        from: '',
+        to: leaf.path,
+        transform: guessTransform('', leaf.value),
+        defaultValue: leaf.value === null ? '' : String(leaf.value),
+        mandatory: false
+      });
+    }
+  }
+  return rows.filter((r) => r.from || r.defaultValue);
+}
+
+/**
+ * A first mapping for a response body: every value at its path → a CBS field named after the vendor and the key
+ * (`sms.messageId`). Ids / references are marked required.
+ */
+export function guessResponseRows(bodyText: string, vendorCode: string): ApiMappingRow[] {
+  const parsed = tryJson(bodyText);
+  if (parsed === undefined || typeof parsed !== 'object' || parsed === null) return [];
+  const prefix = vendorCode.toLowerCase().split('_')[0] || 'vendor';
+  const rows: ApiMappingRow[] = [];
+  const used = new Set<string>();
+  for (const leaf of flatten(parsed)) {
+    const key = lastKey(leaf.path);
+    const n = norm(key);
+    let target: string;
+    if (/^(messageid|msgid|id|reference|requestid|referenceid|messageid)$/.test(n)) target = 'reference';
+    else if (/^(status|state|result|type)$/.test(n)) target = 'status';
+    else if (/^(error|errormessage|errormsg|reason|detail|description)$/.test(n)) target = 'error';
+    else target = key.replace(/[^A-Za-z0-9]+(.)?/g, (_m, c: string) => (c ? c.toUpperCase() : ''));
+    let to = `${prefix}.${target}`;
+    for (let i = 2; used.has(to); i++) to = `${prefix}.${target}${i}`;
+    used.add(to);
+    rows.push({
+      from: leaf.path,
+      to,
+      transform: target === 'status' ? 'UPPER' : guessTransform('', leaf.value),
+      defaultValue: '',
+      mandatory: target === 'reference'
+    });
+  }
+  return rows;
+}
+
+export function secretNote(rows: KeyValue[]): string | null {
+  const n = rows.filter((r) => r.secret).length;
+  return n ? `${n} credential value(s) were hidden.` : null;
+}
+
+export { kv };

src/app/api-management/api-key-value-editor/api-key-value-editor.component.html

@@ -0,0 +1,61 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+@if (!rows.length) {
+  <div class="muted" style="font-size: 12px; margin-bottom: 6px">{{ emptyText }}</div>
+} @else {
+  <div class="cic-table-wrap">
+    <table class="cic-table">
+      <thead>
+        <tr>
+          <th style="width: 34px">On</th>
+          <th>{{ keyLabel }}</th>
+          <th>{{ valueLabel }}</th>
+          <th>Note</th>
+          <th style="width: 60px">Secret</th>
+          @if (!fixedKeys) {
+            <th style="width: 40px"></th>
+          }
+        </tr>
+      </thead>
+      <tbody>
+        @for (r of rows; track $index; let i = $index) {
+          <tr>
+            <td style="text-align: center">
+              <input type="checkbox" [(ngModel)]="r.enabled" style="width: auto" />
+            </td>
+            <td>
+              <input class="cic-mono" [(ngModel)]="r.key" [placeholder]="keyPlaceholder" [readonly]="fixedKeys" />
+            </td>
+            <td>
+              <input
+                class="cic-mono"
+                [type]="r.secret ? 'password' : 'text'"
+                [(ngModel)]="r.value"
+                [placeholder]="valuePlaceholder"
+                autocomplete="off"
+              />
+            </td>
+            <td><input [(ngModel)]="r.description" /></td>
+            <td style="text-align: center">
+              <input type="checkbox" [(ngModel)]="r.secret" style="width: auto" title="Show the value masked" />
+            </td>
+            @if (!fixedKeys) {
+              <td>
+                <button class="cic-btn sm danger" (click)="remove(i)">✕</button>
+              </td>
+            }
+          </tr>
+        }
+      </tbody>
+    </table>
+  </div>
+}
+@if (!fixedKeys) {
+  <button class="cic-btn sm" style="margin-top: 8px" (click)="add()">{{ addLabel }}</button>
+}

src/app/api-management/api-key-value-editor/api-key-value-editor.component.ts

@@ -0,0 +1,44 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, Input } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+
+import { KeyValue } from '../api-management.service';
+
+/** An editable table of name / value pairs: headers, query parameters, path parameters. Edits the array in place. */
+@Component({
+  selector: 'mifosx-api-key-value-editor',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule
+  ],
+  templateUrl: './api-key-value-editor.component.html',
+  styleUrls: ['../../credit-bureau/cic-shared.scss']
+})
+export class ApiKeyValueEditorComponent {
+  @Input() rows: KeyValue[] = [];
+  @Input() keyLabel = 'Name';
+  @Input() valueLabel = 'Value';
+  @Input() keyPlaceholder = '';
+  @Input() valuePlaceholder = '';
+  @Input() addLabel = '+ Add';
+  /** Path parameters come from the path itself; the names cannot be edited or removed. */
+  @Input() fixedKeys = false;
+  @Input() emptyText = 'None.';
+
+  add(): void {
+    this.rows.push({ key: '', value: '', description: '', enabled: true, secret: false });
+  }
+
+  remove(i: number): void {
+    this.rows.splice(i, 1);
+  }
+}

src/app/api-management/api-log-detail/api-log-detail.component.html

@@ -0,0 +1,55 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+@if (log) {
+  <div class="cic-modal-backdrop" (click)="closed.emit()">
+    <div class="cic-modal" style="width: min(1100px, 100%)" (click)="$event.stopPropagation()">
+      <h3>
+        {{ log.vendorName }} · {{ log.apiName }}
+        <span class="cic-badge" [class.brand]="log.direction === 'IN'" [class.ok]="log.direction === 'OUT'">{{
+          log.direction
+        }}</span>
+        <span class="cic-badge" [class.good]="log.result === 'SUCCESS'" [class.bad]="log.result === 'FAILED'">{{
+          log.result
+        }}</span>
+      </h3>
+      <dl class="cic-kv" style="grid-template-columns: 120px minmax(0, 1fr); margin-bottom: 12px">
+        <dt>Reference</dt>
+        <dd class="cic-mono">{{ log.reference }}</dd>
+        <dt>Call</dt>
+        <dd class="cic-mono">{{ log.method }} {{ log.url }}</dd>
+        <dt>Result</dt>
+        <dd>HTTP {{ log.httpStatus }} in {{ log.durationMs }} ms · {{ log.time | slice: 0 : 16 }}</dd>
+        @if (log.error) {
+          <dt>Error</dt>
+          <dd class="tone-bad">{{ log.error }}</dd>
+        }
+      </dl>
+      <div class="cic-split">
+        <div>
+          <h4 style="margin: 0 0 6px; font-size: 13px">
+            {{ log.direction === 'OUT' ? 'Request headers' : 'Headers received / sent' }}
+            <span class="muted" style="font-weight: 400">(credentials masked)</span>
+          </h4>
+          <pre class="cic-code" style="max-height: 160px">{{ log.requestHeaders }}</pre>
+          <h4 style="margin: 12px 0 6px; font-size: 13px">Request payload</h4>
+          <pre class="cic-code">{{ log.request || '(empty)' }}</pre>
+        </div>
+        <div>
+          <h4 style="margin: 0 0 6px; font-size: 13px">Response headers</h4>
+          <pre class="cic-code" style="max-height: 160px">{{ log.responseHeaders }}</pre>
+          <h4 style="margin: 12px 0 6px; font-size: 13px">Response body</h4>
+          <pre class="cic-code">{{ log.response || '(empty)' }}</pre>
+        </div>
+      </div>
+      <div class="foot">
+        <button class="cic-btn" (click)="closed.emit()">Close</button>
+      </div>
+    </div>
+  </div>
+}

src/app/api-management/api-log-detail/api-log-detail.component.ts

@@ -0,0 +1,25 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, EventEmitter, Input, Output } from '@angular/core';
+
+import { ApiLog } from '../api-management.service';
+
+/** One API call: what was sent and what came back. */
+@Component({
+  selector: 'mifosx-api-log-detail',
+  standalone: true,
+  imports: [CommonModule],
+  templateUrl: './api-log-detail.component.html',
+  styleUrls: ['../../credit-bureau/cic-shared.scss']
+})
+export class ApiLogDetailComponent {
+  @Input() log: ApiLog | null = null;
+  @Output() closed = new EventEmitter<void>();
+}

src/app/api-management/api-logs/api-logs.component.html

@@ -0,0 +1,122 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>API Call Logs</h1>
+      <p>Every API call the CBS made (OUT) or received (IN), across all vendors, with its request and response.</p>
+    </div>
+    <div class="cic-actions">
+      <a class="cic-btn" routerLink="/api-management/vendors">← All vendors</a>
+    </div>
+  </div>
+
+  <div class="cic-card">
+    <div class="cic-grid cols-4" style="align-items: end">
+      <div class="cic-field">
+        <label>Vendor</label>
+        <select [(ngModel)]="filter.vendorId">
+          <option value="">All vendors</option>
+          @for (v of vendors; track v.id) {
+            <option [value]="v.id">{{ v.name }}</option>
+          }
+        </select>
+      </div>
+      <div class="cic-field">
+        <label>Direction</label>
+        <select [(ngModel)]="filter.direction">
+          <option value="">IN and OUT</option>
+          <option value="IN">IN — received</option>
+          <option value="OUT">OUT — sent</option>
+        </select>
+      </div>
+      <div class="cic-field">
+        <label>Result</label>
+        <select [(ngModel)]="filter.result">
+          <option value="">All</option>
+          <option value="SUCCESS">Success</option>
+          <option value="FAILED">Failed</option>
+        </select>
+      </div>
+      <div class="cic-field">
+        <label>Search</label>
+        <input [(ngModel)]="filter.search" (keyup.enter)="apply()" placeholder="Reference, API, path" />
+      </div>
+    </div>
+    <div class="cic-actions" style="margin-top: 12px; justify-content: flex-end">
+      <button class="cic-btn" (click)="reset()">Reset</button>
+      <button class="cic-btn primary" (click)="apply()">Apply</button>
+    </div>
+  </div>
+
+  <div class="cic-card">
+    <h2>
+      {{ total }} call(s)
+      <span class="cic-card-sub">
+        <span class="tone-good">{{ success }} success</span> ·
+        <span [class.tone-bad]="failed > 0">{{ failed }} failed</span>
+      </span>
+    </h2>
+    @if (loading && !items.length) {
+      <div class="cic-empty">Loading…</div>
+    } @else if (!items.length) {
+      <div class="cic-empty">No call matches the filter.</div>
+    } @else {
+      <div class="cic-table-wrap">
+        <table class="cic-table">
+          <thead>
+            <tr>
+              <th>Time</th>
+              <th>Vendor</th>
+              <th>API</th>
+              <th>Direction</th>
+              <th>Call</th>
+              <th>HTTP</th>
+              <th class="num">ms</th>
+              <th>Result</th>
+              <th>Reference</th>
+            </tr>
+          </thead>
+          <tbody>
+            @for (l of items; track l.id) {
+              <tr class="clickable" (click)="openLog = l">
+                <td>{{ l.time | slice: 0 : 16 }}</td>
+                <td>{{ l.vendorName }}</td>
+                <td>{{ l.apiName }}</td>
+                <td>
+                  <span class="cic-badge" [class.brand]="l.direction === 'IN'" [class.ok]="l.direction === 'OUT'">{{
+                    l.direction
+                  }}</span>
+                </td>
+                <td class="cic-mono" style="font-size: 12px">{{ l.method }} {{ l.path }}</td>
+                <td>{{ l.httpStatus }}</td>
+                <td class="num">{{ l.durationMs }}</td>
+                <td>
+                  <span class="cic-badge" [class.good]="l.result === 'SUCCESS'" [class.bad]="l.result === 'FAILED'">{{
+                    l.result
+                  }}</span>
+                </td>
+                <td class="cic-mono" style="font-size: 12px">{{ l.reference }}</td>
+              </tr>
+            }
+          </tbody>
+        </table>
+      </div>
+      <div class="cic-pager">
+        <span>{{ offset + 1 }}–{{ offset + items.length }} of {{ total }}</span>
+        <span class="cic-actions">
+          <button class="cic-btn sm" (click)="page(-1)" [disabled]="offset === 0">Previous</button>
+          <button class="cic-btn sm" (click)="page(1)" [disabled]="offset + limit >= total">Next</button>
+        </span>
+      </div>
+    }
+  </div>
+</div>
+
+<mifosx-api-log-detail [log]="openLog" (closed)="openLog = null"></mifosx-api-log-detail>

src/app/api-management/api-logs/api-logs.component.ts

@@ -0,0 +1,77 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { ActivatedRoute, RouterModule } from '@angular/router';
+
+import { ApiLogDetailComponent } from '../api-log-detail/api-log-detail.component';
+import { ApiLog, ApiManagementService, ApiVendor } from '../api-management.service';
+
+/** Every API call, IN and OUT, across all vendors, with its request and response. */
+@Component({
+  selector: 'mifosx-api-logs',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    ApiLogDetailComponent
+  ],
+  templateUrl: './api-logs.component.html',
+  styleUrls: ['../../credit-bureau/cic-shared.scss']
+})
+export class ApiLogsComponent implements OnInit {
+  private service = inject(ApiManagementService);
+  private route = inject(ActivatedRoute);
+
+  vendors: ApiVendor[] = [];
+  filter = { vendorId: '', direction: '', result: '', search: '' };
+  items: ApiLog[] = [];
+  total = 0;
+  success = 0;
+  failed = 0;
+  offset = 0;
+  readonly limit = 15;
+  loading = false;
+  openLog: ApiLog | null = null;
+
+  ngOnInit(): void {
+    const vendorId = this.route.snapshot.queryParamMap.get('vendorId');
+    if (vendorId) this.filter.vendorId = vendorId;
+    this.service.vendors().subscribe((v) => (this.vendors = v));
+    this.load();
+  }
+
+  load(): void {
+    this.loading = true;
+    this.service.logs({ ...this.filter, offset: this.offset, limit: this.limit }).subscribe((r) => {
+      this.items = r.items;
+      this.total = r.total;
+      this.success = r.success;
+      this.failed = r.failed;
+      this.loading = false;
+    });
+  }
+
+  apply(): void {
+    this.offset = 0;
+    this.load();
+  }
+
+  reset(): void {
+    this.filter = { vendorId: '', direction: '', result: '', search: '' };
+    this.apply();
+  }
+
+  page(delta: number): void {
+    this.offset = Math.max(0, this.offset + delta * this.limit);
+    this.load();
+  }
+}

src/app/api-management/api-management-routing.module.ts

@@ -0,0 +1,58 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { NgModule } from '@angular/core';
+import { Routes, RouterModule } from '@angular/router';
+
+import { Route } from '../core/route/route.service';
+import { ApiVendorsComponent } from './api-vendors/api-vendors.component';
+import { ApiVendorSetupComponent } from './api-vendor-setup/api-vendor-setup.component';
+import { ApiLogsComponent } from './api-logs/api-logs.component';
+
+const routes: Routes = [
+  Route.withShell([
+    {
+      path: 'api-management',
+      data: { title: 'API Management', breadcrumb: 'API Management' },
+      children: [
+        {
+          path: '',
+          redirectTo: 'vendors',
+          pathMatch: 'full'
+        },
+        {
+          path: 'vendors',
+          data: { breadcrumb: 'Vendors' },
+          children: [
+            {
+              path: '',
+              component: ApiVendorsComponent,
+              data: { title: 'API Vendors & Setup' }
+            },
+            {
+              path: ':id',
+              component: ApiVendorSetupComponent,
+              data: { title: 'Vendor Setup', breadcrumb: 'Setup' }
+            }
+          ]
+        },
+        {
+          path: 'logs',
+          component: ApiLogsComponent,
+          data: { title: 'API Call Logs', breadcrumb: 'Call Logs' }
+        }
+      ]
+    }
+  ])
+];
+
+@NgModule({
+  imports: [RouterModule.forChild(routes)],
+  exports: [RouterModule]
+})
+export class ApiManagementRoutingModule {}

src/app/api-management/api-management.module.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { NgModule } from '@angular/core';
+
+import { SharedModule } from '../shared/shared.module';
+import { ApiManagementRoutingModule } from './api-management-routing.module';
+import { ApiVendorsComponent } from './api-vendors/api-vendors.component';
+import { ApiVendorSetupComponent } from './api-vendor-setup/api-vendor-setup.component';
+import { ApiLogsComponent } from './api-logs/api-logs.component';
+import { ApiLogDetailComponent } from './api-log-detail/api-log-detail.component';
+
+/** API Management: connect any outside API service (CIC, SMS, WhatsApp ...) - vendor, work, API set, IN / OUT. */
+@NgModule({
+  imports: [
+    SharedModule,
+    ApiManagementRoutingModule,
+    ApiVendorsComponent,
+    ApiVendorSetupComponent,
+    ApiLogsComponent,
+    ApiLogDetailComponent
+  ]
+})
+export class ApiManagementModule {}

src/app/api-management/api-vendor-setup/api-vendor-setup.component.html

@@ -0,0 +1,747 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>{{ vendor?.name || 'Vendor setup' }}</h1>
+      <p>{{ vendor?.work }}</p>
+    </div>
+    <div class="cic-actions">
+      @if (vendor) {
+        <span class="cic-badge" [class.good]="vendor.active">{{ vendor.active ? 'Active' : 'Switched off' }}</span>
+        <span
+          class="cic-badge"
+          [class.warn]="vendor.environment === 'SIMULATOR'"
+          [class.good]="vendor.environment === 'PRODUCTION'"
+          >{{ vendor.environment }}</span
+        >
+      }
+      <a class="cic-btn" routerLink="/api-management/vendors">← All vendors</a>
+    </div>
+  </div>
+
+  @if (error && !editing && !importOpen) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+  @if (info && !editing) {
+    <div class="cic-alert success">{{ info }}</div>
+  }
+  @if (loading && !vendor) {
+    <div class="cic-card cic-empty">Loading…</div>
+  }
+
+  @if (vendor) {
+    @if (vendor.configNote) {
+      <div class="cic-alert info">{{ vendor.configNote }}</div>
+    }
+    @if (vendor.links.length) {
+      <div class="cic-alert info">
+        {{ vendor.code }} also has its own screens:
+        @for (l of vendor.links; track l.route) {
+          <a class="cic-btn sm" style="margin-left: 6px" [routerLink]="l.route">{{ l.label }}</a>
+        }
+      </div>
+    }
+
+    <div class="cic-tabs">
+      <button [class.active]="tab === 'connection'" (click)="tab = 'connection'">1 · Connection</button>
+      <button [class.active]="tab === 'apis'" (click)="tab = 'apis'">2 · API set ({{ vendor.apis.length }})</button>
+      <button [class.active]="tab === 'test'" (click)="tab = 'test'">3 · Test</button>
+      <button [class.active]="tab === 'calls'" (click)="tab = 'calls'; loadCalls()">Recent calls</button>
+    </div>
+
+    <!-- CONNECTION -->
+    @if (tab === 'connection') {
+      <div class="cic-card">
+        <h2>Vendor and connection</h2>
+        <div class="cic-grid cols-2">
+          <div class="cic-field">
+            <label>Vendor name</label>
+            <input [(ngModel)]="form.name" />
+          </div>
+          <div class="cic-field">
+            <label>Environment</label>
+            <select [(ngModel)]="form.environment">
+              <option value="SIMULATOR">SIMULATOR — no network call</option>
+              <option value="UAT">UAT — vendor's test environment</option>
+              <option value="PRODUCTION">PRODUCTION — live</option>
+            </select>
+          </div>
+          <div class="cic-field" style="grid-column: 1 / -1">
+            <label>Work — what this vendor is used for</label>
+            <input [(ngModel)]="form.work" />
+          </div>
+          <div class="cic-field" style="grid-column: 1 / -1">
+            <label>Base URL</label>
+            <input class="cic-mono" [(ngModel)]="form.baseUrl" placeholder="https://api.vendor.example/v1" />
+            <span class="hint">Every OUT / pull API path is added to this. PRODUCTION needs https://.</span>
+          </div>
+          <div class="cic-field">
+            <label>Authentication</label>
+            <select [(ngModel)]="form.authType">
+              @for (a of authTypes; track a.key) {
+                <option [value]="a.key">{{ a.label }}</option>
+              }
+            </select>
+          </div>
+          @if (form.authType === 'BASIC') {
+            <div class="cic-field">
+              <label>User id</label>
+              <input [(ngModel)]="form.username" autocomplete="off" />
+            </div>
+          }
+          @if (form.authType === 'API_KEY') {
+            <div class="cic-field">
+              <label>API key header name</label>
+              <input class="cic-mono" [(ngModel)]="form.apiKeyHeader" />
+            </div>
+          }
+          @if (needsSecret()) {
+            <div class="cic-field">
+              <label>{{ secretLabel() }}</label>
+              <input
+                type="password"
+                [(ngModel)]="form.secret"
+                autocomplete="new-password"
+                [placeholder]="vendor.hasSecret ? '•••••• stored — leave blank to keep' : 'Enter to store (encrypted)'"
+              />
+              @if (vendor.hasSecret) {
+                <label style="display: flex; gap: 6px; align-items: center; font-weight: 500; font-size: 12px">
+                  <input type="checkbox" [(ngModel)]="form.clearSecret" style="width: auto" /> Remove the stored
+                  credential
+                </label>
+              }
+            </div>
+          }
+          <div class="cic-field">
+            <label>Sender / member id</label>
+            <input [(ngModel)]="form.senderId" />
+            <span class="hint"
+              >The bank's id at this vendor (SMS sender id, WhatsApp number id, CIC member code …).</span
+            >
+          </div>
+          <div class="cic-field">
+            <label>Timeout (ms)</label>
+            <input type="number" min="1000" max="300000" [(ngModel)]="form.timeoutMs" />
+          </div>
+          <div class="cic-field">
+            <label>Retries on failure</label>
+            <input type="number" min="0" max="5" [(ngModel)]="form.retries" />
+          </div>
+          <label style="display: flex; gap: 8px; align-items: center; font-size: 13px">
+            <input type="checkbox" [(ngModel)]="form.active" /> Vendor active
+          </label>
+        </div>
+
+        <h4 style="margin: 18px 0 6px; font-size: 13px">
+          Default headers
+          <span class="muted" style="font-weight: 400"
+            >— sent on every API of this vendor (an API can override one)</span
+          >
+        </h4>
+        <mifosx-api-key-value-editor
+          [rows]="form.defaultHeaders"
+          keyLabel="Header"
+          keyPlaceholder="Accept"
+          addLabel="+ Add header"
+          emptyText="No default header."
+        ></mifosx-api-key-value-editor>
+
+        <div class="cic-actions" style="margin-top: 16px">
+          <button class="cic-btn primary" (click)="saveConnection()" [disabled]="saving">
+            {{ saving ? 'Saving…' : 'Save connection' }}
+          </button>
+          <button class="cic-btn" (click)="tab = 'apis'">Next: API set →</button>
+        </div>
+      </div>
+    }
+
+    <!-- API SET -->
+    @if (tab === 'apis') {
+      <div class="cic-card">
+        <h2>
+          API set
+          <span class="cic-actions">
+            <button class="cic-btn sm" (click)="newApi('OUT')">+ OUT API (CBS calls vendor)</button>
+            <button class="cic-btn sm" (click)="newApi('IN')">+ IN API (data comes into CBS)</button>
+          </span>
+        </h2>
+        @if (!vendor.apis.length) {
+          <div class="cic-empty">
+            No API yet. Add one, then fill it in by hand or read it from a JSON / cURL / Postman file.
+          </div>
+        } @else {
+          <div class="cic-table-wrap">
+            <table class="cic-table">
+              <thead>
+                <tr>
+                  <th>API</th>
+                  <th>Direction</th>
+                  <th>Call</th>
+                  <th>Used for</th>
+                  <th>Headers / query</th>
+                  <th>Mapping</th>
+                  <th>Active</th>
+                  <th></th>
+                </tr>
+              </thead>
+              <tbody>
+                @for (a of vendor.apis; track a.id) {
+                  <tr>
+                    <td>
+                      <b>{{ a.name }}</b>
+                    </td>
+                    <td>
+                      <span class="cic-badge" [class.brand]="a.direction === 'IN'" [class.ok]="a.direction === 'OUT'">{{
+                        a.direction
+                      }}</span>
+                      @if (a.mode) {
+                        <span class="muted" style="font-size: 11px"> {{ a.mode === 'PULL' ? 'pull' : 'push' }}</span>
+                      }
+                    </td>
+                    <td class="cic-mono" style="font-size: 12px">{{ a.method }} {{ a.path }}</td>
+                    <td style="max-width: 260px; white-space: normal">{{ a.usedFor }}</td>
+                    <td>{{ a.headers.length }} / {{ a.queryParams.length }}</td>
+                    <td>{{ a.requestRows.length }} / {{ a.responseRows.length }}</td>
+                    <td>
+                      <span class="cic-badge" [class.good]="a.active">{{ a.active ? 'Yes' : 'Off' }}</span>
+                    </td>
+                    <td style="white-space: nowrap">
+                      <button class="cic-btn sm" (click)="editApi(a)">Edit</button>
+                      <button class="cic-btn sm danger" (click)="deleteApi(a)">✕</button>
+                    </td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </div>
+        }
+      </div>
+    }
+
+    <!-- TEST -->
+    @if (tab === 'test') {
+      <div class="cic-card">
+        <h2>
+          Test an API
+          <span class="cic-card-sub">simulated — nothing is sent to the vendor; the result is added to the logs</span>
+        </h2>
+        @if (!vendor.apis.length) {
+          <div class="cic-empty">Add an API first.</div>
+        } @else {
+          <div class="cic-field" style="max-width: 420px">
+            <label>API</label>
+            <select [(ngModel)]="testApiId" (ngModelChange)="fillTestBody()">
+              @for (a of vendor.apis; track a.id) {
+                <option [ngValue]="a.id">{{ a.direction }} · {{ a.name }}</option>
+              }
+            </select>
+          </div>
+          @if (testPreview; as p) {
+            <h4 style="margin: 14px 0 6px; font-size: 13px">The request</h4>
+            <pre class="cic-code" style="max-height: 200px">{{ p.method }} {{ p.url }}
+@for (h of p.headers; track h.key) {
+{{ h.key }}: {{ h.value }}
+}</pre>
+          }
+          <div class="cic-field" style="margin-top: 12px">
+            <label>Request body</label>
+            <textarea class="cic-mono" rows="9" [(ngModel)]="testBody"></textarea>
+          </div>
+          <button class="cic-btn primary" style="margin-top: 12px" (click)="runTest()" [disabled]="testing">
+            {{ testing ? 'Sending…' : 'Send test' }}
+          </button>
+        }
+      </div>
+      @if (testResult) {
+        <div class="cic-alert success">
+          {{ testResult.reference }} — HTTP {{ testResult.httpStatus }} in {{ testResult.durationMs }} ms
+        </div>
+        <div class="cic-split">
+          <div class="cic-card">
+            <h2>Response headers</h2>
+            <pre class="cic-code">{{ testResult.responseHeaders }}</pre>
+          </div>
+          <div class="cic-card">
+            <h2>Response body</h2>
+            <pre class="cic-code">{{ testResult.response || '(empty)' }}</pre>
+          </div>
+        </div>
+      }
+    }
+
+    <!-- RECENT CALLS -->
+    @if (tab === 'calls') {
+      <div class="cic-card">
+        <h2>
+          Recent calls
+          <a class="cic-btn sm" routerLink="/api-management/logs" [queryParams]="{ vendorId: vendor.id }">All logs</a>
+        </h2>
+        @if (!calls.length) {
+          <div class="cic-empty">No call yet.</div>
+        } @else {
+          <div class="cic-table-wrap">
+            <table class="cic-table">
+              <thead>
+                <tr>
+                  <th>Time</th>
+                  <th>API</th>
+                  <th>Direction</th>
+                  <th>HTTP</th>
+                  <th class="num">ms</th>
+                  <th>Result</th>
+                  <th>Reference</th>
+                </tr>
+              </thead>
+              <tbody>
+                @for (l of calls; track l.id) {
+                  <tr class="clickable" (click)="openLog = l">
+                    <td>{{ l.time | slice: 0 : 16 }}</td>
+                    <td>{{ l.apiName }}</td>
+                    <td>
+                      <span class="cic-badge" [class.brand]="l.direction === 'IN'" [class.ok]="l.direction === 'OUT'">{{
+                        l.direction
+                      }}</span>
+                    </td>
+                    <td>{{ l.httpStatus }}</td>
+                    <td class="num">{{ l.durationMs }}</td>
+                    <td>
+                      <span
+                        class="cic-badge"
+                        [class.good]="l.result === 'SUCCESS'"
+                        [class.bad]="l.result === 'FAILED'"
+                        >{{ l.result }}</span
+                      >
+                    </td>
+                    <td class="cic-mono" style="font-size: 12px">{{ l.reference }}</td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </div>
+        }
+      </div>
+    }
+  }
+</div>
+
+<!-- API editor -->
+@if (editing) {
+  <div class="cic-modal-backdrop" (click)="editing = null">
+    <div class="cic-modal" style="width: min(1100px, 100%)" (click)="$event.stopPropagation()">
+      <div style="display: flex; justify-content: space-between; gap: 12px; align-items: flex-start">
+        <h3 style="margin: 0">
+          {{ isNewApi ? 'New' : 'Edit' }} API
+          <span class="cic-badge" [class.brand]="editing.direction === 'IN'" [class.ok]="editing.direction === 'OUT'">{{
+            editing.direction
+          }}</span>
+          @if (editing.mode) {
+            <span class="muted" style="font-size: 12px; font-weight: 500">
+              {{ editing.mode === 'PULL' ? 'pull' : 'push' }}</span
+            >
+          }
+        </h3>
+        <button class="cic-btn sm primary" (click)="openImport()">⬆ Import from JSON / cURL / Postman</button>
+      </div>
+      <p class="muted" style="font-size: 12px; margin: 6px 0 10px">
+        @if (editing.direction === 'OUT') {
+          OUT — the CBS calls the vendor: fill the request it sends and the response it expects.
+        } @else if (editing.mode === 'PULL') {
+          IN (pull) — the CBS asks the vendor for data on a schedule: fill the request it sends and the response it
+          reads.
+        } @else {
+          IN (push) — the vendor calls a CBS path: fill what the vendor sends us and what we answer.
+        }
+        Type everything in, or read it from a file with the import button — then check each tab.
+      </p>
+
+      @if (info) {
+        <div class="cic-alert success">{{ info }}</div>
+      }
+      @if (error) {
+        <div class="cic-alert error">{{ error }}</div>
+      }
+
+      <div class="cic-tabs">
+        <button [class.active]="editorTab === 'basics'" (click)="editorTab = 'basics'">1 · Basics</button>
+        <button [class.active]="editorTab === 'request'" (click)="editorTab = 'request'">
+          2 · {{ outbound ? 'Request' : 'What the vendor sends' }}
+        </button>
+        <button [class.active]="editorTab === 'response'" (click)="editorTab = 'response'">
+          3 · {{ outbound ? 'Response' : 'Our answer' }}
+        </button>
+      </div>
+
+      <!-- BASICS -->
+      @if (editorTab === 'basics') {
+        <div class="cic-grid cols-4">
+          <div class="cic-field" style="grid-column: span 2">
+            <label>API name</label>
+            <input [(ngModel)]="editing.name" placeholder="e.g. Send SMS" />
+          </div>
+          <div class="cic-field">
+            <label>Direction</label>
+            <select [(ngModel)]="editing.direction" (ngModelChange)="directionChanged()">
+              <option value="OUT">OUT — CBS calls vendor</option>
+              <option value="IN">IN — data comes into CBS</option>
+            </select>
+          </div>
+          @if (editing.direction === 'IN') {
+            <div class="cic-field">
+              <label>How data arrives</label>
+              <select [(ngModel)]="editing.mode">
+                <option value="PULL">PULL — CBS asks on a schedule</option>
+                <option value="PUSH">PUSH — vendor calls a CBS path</option>
+              </select>
+            </div>
+          } @else {
+            <div></div>
+          }
+          <div class="cic-field">
+            <label>HTTP method</label>
+            <select [(ngModel)]="editing.method">
+              @for (m of methods; track m) {
+                <option [value]="m">{{ m }}</option>
+              }
+            </select>
+          </div>
+          <div class="cic-field" style="grid-column: span 3">
+            <label>{{ outbound ? "Vendor's API path (after the base URL)" : 'CBS path the vendor calls' }}</label>
+            <input
+              class="cic-mono"
+              [(ngModel)]="editing.path"
+              (ngModelChange)="pathChanged()"
+              placeholder="/messages/send"
+            />
+            <span class="hint"
+              >Use {{ '{' }}name{{ '}' }} for a value that changes, e.g. /v21.0/{{ '{' }}senderId{{
+                '}'
+              }}/messages.</span
+            >
+          </div>
+          <div class="cic-field" style="grid-column: span 3">
+            <label>When is it used</label>
+            <input [(ngModel)]="editing.usedFor" placeholder="e.g. OTP and transaction alerts" />
+          </div>
+          <div class="cic-field">
+            <label>Timeout for this API (ms)</label>
+            <input type="number" min="1000" max="300000" [(ngModel)]="editing.timeoutMs" placeholder="vendor's" />
+          </div>
+          <div class="cic-field">
+            <label>Retries for this API</label>
+            <input type="number" min="0" max="5" [(ngModel)]="editing.retries" placeholder="vendor's" />
+          </div>
+        </div>
+        <label style="display: flex; gap: 8px; align-items: center; font-size: 13px; margin: 12px 0">
+          <input type="checkbox" [(ngModel)]="editing.active" /> API active
+        </label>
+
+        @if (preview(editing); as p) {
+          <h4 style="margin: 14px 0 6px; font-size: 13px">
+            {{ outbound ? 'The call as it will go out' : 'The call the vendor will make to us' }}
+            <span class="muted" style="font-weight: 400"> (credentials masked)</span>
+          </h4>
+          <pre class="cic-code" style="max-height: 220px">{{ p.method }} {{ p.url }}
+@for (h of p.headers; track h.key) {
+{{ h.key }}: {{ h.value }}
+}
+{{ p.body }}</pre>
+        }
+      }
+
+      <!-- REQUEST -->
+      @if (editorTab === 'request') {
+        <h4 style="margin: 4px 0 6px; font-size: 13px">Path parameters</h4>
+        <mifosx-api-key-value-editor
+          [rows]="editing.pathParams"
+          keyLabel="Parameter"
+          valueLabel="Value (a CBS placeholder or fixed value)"
+          [fixedKeys]="true"
+          emptyText="The path has no {name} placeholder."
+        ></mifosx-api-key-value-editor>
+
+        <h4 style="margin: 16px 0 6px; font-size: 13px">Query parameters</h4>
+        <mifosx-api-key-value-editor
+          [rows]="editing.queryParams"
+          keyLabel="Parameter"
+          keyPlaceholder="version"
+          addLabel="+ Add query parameter"
+          emptyText="No query parameter."
+        ></mifosx-api-key-value-editor>
+
+        <h4 style="margin: 16px 0 6px; font-size: 13px">
+          Headers
+          <span class="muted" style="font-weight: 400"
+            >— this API's own; the vendor's default headers and its authentication are added automatically</span
+          >
+        </h4>
+        <mifosx-api-key-value-editor
+          [rows]="editing.headers"
+          keyLabel="Header"
+          keyPlaceholder="X-Request-Id"
+          valuePlaceholder="{{ '{{' }}request.reference{{ '}}' }}"
+          addLabel="+ Add header"
+          emptyText="No header of its own."
+        ></mifosx-api-key-value-editor>
+
+        <div class="cic-grid cols-4" style="margin-top: 16px">
+          <div class="cic-field" style="grid-column: span 2">
+            <label>Content type</label>
+            <select [(ngModel)]="editing.contentType">
+              @for (c of contentTypes; track c.key) {
+                <option [value]="c.key">{{ c.label }}</option>
+              }
+            </select>
+          </div>
+        </div>
+
+        <div class="cic-field" style="margin-top: 12px">
+          <label>{{ outbound ? 'Request payload' : 'Payload the vendor sends us' }}</label>
+          <textarea class="cic-mono" rows="10" [(ngModel)]="editing.requestBody"></textarea>
+          <span class="hint">
+            {{
+              outbound
+                ? 'The constant parts of the payload; the mapping below puts CBS values into it.'
+                : 'A sample of what arrives; the mapping reads values out of it.'
+            }}
+          </span>
+        </div>
+
+        <h4 style="margin: 16px 0 6px; font-size: 13px">
+          {{ mappingTitle('request') }}
+          <button class="cic-btn sm" style="margin-left: 8px" (click)="generateRows('request')">
+            Build rows from the payload
+          </button>
+        </h4>
+        <div class="cic-table-wrap">
+          <table class="cic-table">
+            <thead>
+              <tr>
+                <th>{{ fromLabel('request') }}</th>
+                <th>{{ toLabel('request') }}</th>
+                <th>Transform</th>
+                <th>Fixed / default value</th>
+                <th>Required</th>
+                <th style="width: 40px"></th>
+              </tr>
+            </thead>
+            <tbody>
+              @for (r of editing.requestRows; track $index; let i = $index) {
+                <tr>
+                  <td>
+                    @if (fromIsCbs('request')) {
+                      <select [(ngModel)]="r.from">
+                        <option value="">— fixed value (set it on the right) —</option>
+                        @for (f of cbsFields; track f.key) {
+                          <option [value]="f.key">{{ f.label }}</option>
+                        }
+                      </select>
+                    } @else {
+                      <input class="cic-mono" [(ngModel)]="r.from" />
+                    }
+                  </td>
+                  <td><input class="cic-mono" [(ngModel)]="r.to" /></td>
+                  <td>
+                    <select [(ngModel)]="r.transform">
+                      @for (t of transforms; track t.key) {
+                        <option [value]="t.key">{{ t.label }}</option>
+                      }
+                    </select>
+                  </td>
+                  <td><input [(ngModel)]="r.defaultValue" /></td>
+                  <td style="text-align: center">
+                    <input type="checkbox" [(ngModel)]="r.mandatory" style="width: auto" />
+                  </td>
+                  <td><button class="cic-btn sm danger" (click)="removeRow('request', i)">✕</button></td>
+                </tr>
+              }
+            </tbody>
+          </table>
+        </div>
+        <button class="cic-btn sm" style="margin-top: 8px" (click)="addRow('request')">+ Add field</button>
+      }
+
+      <!-- RESPONSE -->
+      @if (editorTab === 'response') {
+        <div class="cic-grid cols-4">
+          <div class="cic-field">
+            <label>Success status code(s)</label>
+            <input class="cic-mono" [(ngModel)]="editing.successCodes" placeholder="200, 202" />
+            <span class="hint">{{
+              outbound ? 'Codes the vendor answers with when it worked.' : 'Codes the CBS answers with.'
+            }}</span>
+          </div>
+        </div>
+
+        <h4 style="margin: 16px 0 6px; font-size: 13px">
+          {{ outbound ? 'Response headers' : 'Headers of our answer' }}
+        </h4>
+        <mifosx-api-key-value-editor
+          [rows]="editing.responseHeaders"
+          keyLabel="Header"
+          keyPlaceholder="Content-Type"
+          addLabel="+ Add header"
+          emptyText="No response header noted."
+        ></mifosx-api-key-value-editor>
+
+        <div class="cic-grid cols-2" style="margin-top: 16px">
+          <div class="cic-field">
+            <label>{{ outbound ? 'Success response body' : 'Our answer body' }}</label>
+            <textarea class="cic-mono" rows="10" [(ngModel)]="editing.responseBody"></textarea>
+          </div>
+          <div class="cic-field">
+            <label>Error response body</label>
+            <textarea class="cic-mono" rows="10" [(ngModel)]="editing.errorBody"></textarea>
+            <span class="hint"
+              >What comes back when it fails (wrong key, rate limit …) — shown in the logs for a failed call.</span
+            >
+          </div>
+        </div>
+
+        <h4 style="margin: 16px 0 6px; font-size: 13px">
+          {{ mappingTitle('response') }}
+          <button class="cic-btn sm" style="margin-left: 8px" (click)="generateRows('response')">
+            Build rows from the body
+          </button>
+        </h4>
+        <div class="cic-table-wrap">
+          <table class="cic-table">
+            <thead>
+              <tr>
+                <th>{{ fromLabel('response') }}</th>
+                <th>{{ toLabel('response') }}</th>
+                <th>Transform</th>
+                <th>Fixed / default value</th>
+                <th>Required</th>
+                <th style="width: 40px"></th>
+              </tr>
+            </thead>
+            <tbody>
+              @for (r of editing.responseRows; track $index; let i = $index) {
+                <tr>
+                  <td>
+                    @if (fromIsCbs('response')) {
+                      <select [(ngModel)]="r.from">
+                        <option value="">— fixed value (set it on the right) —</option>
+                        @for (f of cbsFields; track f.key) {
+                          <option [value]="f.key">{{ f.label }}</option>
+                        }
+                      </select>
+                    } @else {
+                      <input class="cic-mono" [(ngModel)]="r.from" />
+                    }
+                  </td>
+                  <td><input class="cic-mono" [(ngModel)]="r.to" /></td>
+                  <td>
+                    <select [(ngModel)]="r.transform">
+                      @for (t of transforms; track t.key) {
+                        <option [value]="t.key">{{ t.label }}</option>
+                      }
+                    </select>
+                  </td>
+                  <td><input [(ngModel)]="r.defaultValue" /></td>
+                  <td style="text-align: center">
+                    <input type="checkbox" [(ngModel)]="r.mandatory" style="width: auto" />
+                  </td>
+                  <td><button class="cic-btn sm danger" (click)="removeRow('response', i)">✕</button></td>
+                </tr>
+              }
+            </tbody>
+          </table>
+        </div>
+        <button class="cic-btn sm" style="margin-top: 8px" (click)="addRow('response')">+ Add field</button>
+      }
+
+      <div class="foot">
+        <button class="cic-btn" (click)="editing = null">Cancel</button>
+        <button class="cic-btn primary" (click)="saveApi()" [disabled]="savingApi">
+          {{ savingApi ? 'Saving…' : 'Save API' }}
+        </button>
+      </div>
+    </div>
+  </div>
+}
+
+<!-- Import from JSON / cURL / Postman / HAR -->
+@if (importOpen && editing) {
+  <div class="cic-modal-backdrop" style="z-index: 1100" (click)="importOpen = false">
+    <div class="cic-modal" style="width: min(1000px, 100%)" (click)="$event.stopPropagation()">
+      <h3>Import from JSON / cURL / Postman</h3>
+      <p class="muted" style="font-size: 12px; margin: 0 0 10px">
+        Paste it or choose a file —
+        {{ outbound ? 'the request and the response' : 'what the vendor sends us and what we answer' }}. Any of these
+        works: a <b>cURL</b> command, a <b>Postman</b> collection or request, a <b>HAR</b> capture, an API definition
+        (<code>{{ '{' }} method, url, headers, query, body, status … {{ '}' }}</code
+        >), or just the <b>JSON payload</b>. The method, URL / path, query parameters, headers, content type, payload,
+        status code, response headers, bodies and a first CBS mapping are filled in for you. Passwords, keys and tokens
+        are never kept.
+      </p>
+      @if (importError) {
+        <div class="cic-alert error">{{ importError }}</div>
+      }
+      <div class="cic-grid cols-2">
+        <div class="cic-field">
+          <label
+            >{{ outbound ? 'Request' : 'What the vendor sends us' }} — cURL, Postman, HAR, definition or payload</label
+          >
+          <textarea
+            class="cic-mono"
+            rows="12"
+            [(ngModel)]="importRequestText"
+            placeholder="curl -X POST 'https://api.vendor.in/v1/send' -H 'Content-Type: application/json' -d '{ ... }'"
+          ></textarea>
+          <div style="display: flex; gap: 8px; align-items: center">
+            <input
+              type="file"
+              accept=".json,.txt,.curl,.har,.sh,application/json,text/plain"
+              (change)="onFile($event, 'request')"
+            />
+            @if (importRequestFile) {
+              <span class="muted" style="font-size: 12px">{{ importRequestFile }}</span>
+            }
+          </div>
+        </div>
+        <div class="cic-field">
+          <label>{{ outbound ? 'Response' : 'Our answer' }} — JSON body, or with status and headers (optional)</label>
+          <textarea
+            class="cic-mono"
+            rows="12"
+            [(ngModel)]="importResponseText"
+            placeholder='{ "status": 200, "headers": { "Content-Type": "application/json" }, "body": { ... } }'
+          ></textarea>
+          <div style="display: flex; gap: 8px; align-items: center">
+            <input
+              type="file"
+              accept=".json,.txt,.har,application/json,text/plain"
+              (change)="onFile($event, 'response')"
+            />
+            @if (importResponseFile) {
+              <span class="muted" style="font-size: 12px">{{ importResponseFile }}</span>
+            }
+          </div>
+        </div>
+      </div>
+      <div style="display: flex; gap: 20px; flex-wrap: wrap; margin-top: 12px; font-size: 13px">
+        <label style="display: flex; gap: 6px; align-items: center">
+          <input type="checkbox" [(ngModel)]="importReplace" /> Replace what is there now (headers, query, mapping rows)
+          — untick to add to it
+        </label>
+        <label style="display: flex; gap: 6px; align-items: center">
+          <input type="checkbox" [(ngModel)]="importGenerate" /> Build the CBS field mapping from the payloads
+        </label>
+      </div>
+      <div class="foot">
+        <button class="cic-btn" (click)="importOpen = false">Cancel</button>
+        <button class="cic-btn primary" (click)="applyImport()">Read and fill in</button>
+      </div>
+    </div>
+  </div>
+}
+
+<mifosx-api-log-detail [log]="openLog" (closed)="openLog = null"></mifosx-api-log-detail>

src/app/api-management/api-vendor-setup/api-vendor-setup.component.ts

@@ -0,0 +1,546 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { ActivatedRoute, RouterModule } from '@angular/router';
+
+import { ApiKeyValueEditorComponent } from '../api-key-value-editor/api-key-value-editor.component';
+import { ApiLogDetailComponent } from '../api-log-detail/api-log-detail.component';
+import {
+  guessRequestRows,
+  guessResponseRows,
+  ImportedRequest,
+  ImportedResponse,
+  parseRequestText,
+  parseResponseText
+} from '../api-import.util';
+import {
+  API_AUTH_TYPES,
+  API_CBS_FIELDS,
+  API_CONTENT_TYPES,
+  API_METHODS,
+  API_TRANSFORMS,
+  ApiLog,
+  ApiManagementService,
+  ApiMappingRow,
+  ApiVendor,
+  blankApi,
+  buildRequestPreview,
+  callsVendor,
+  KeyValue,
+  pathParamNames,
+  RequestPreview,
+  VendorApi
+} from '../api-management.service';
+
+/**
+ * One vendor's setup: its connection (URL, authentication, default headers, credentials), its API set - each API IN or
+ * OUT with the full HTTP detail and the field mapping, typed in or read from a JSON / cURL / Postman / HAR file - a
+ * test call, and its recent calls.
+ */
+@Component({
+  selector: 'mifosx-api-vendor-setup',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    ApiLogDetailComponent,
+    ApiKeyValueEditorComponent
+  ],
+  templateUrl: './api-vendor-setup.component.html',
+  styleUrls: ['../../credit-bureau/cic-shared.scss']
+})
+export class ApiVendorSetupComponent implements OnInit {
+  private service = inject(ApiManagementService);
+  private route = inject(ActivatedRoute);
+
+  vendor: ApiVendor | null = null;
+  tab: 'connection' | 'apis' | 'test' | 'calls' = 'connection';
+  loading = false;
+  error: string | null = null;
+  info: string | null = null;
+
+  // connection
+  form: any = {};
+  saving = false;
+
+  // API set
+  editing: VendorApi | null = null;
+  isNewApi = false;
+  savingApi = false;
+  editorTab: 'basics' | 'request' | 'response' = 'basics';
+
+  // import from JSON / cURL / Postman / HAR
+  importOpen = false;
+  importRequestText = '';
+  importResponseText = '';
+  importRequestFile = '';
+  importResponseFile = '';
+  importReplace = true;
+  importGenerate = true;
+  importError: string | null = null;
+
+  // test
+  testApiId: number | null = null;
+  testBody = '';
+  testing = false;
+  testResult: ApiLog | null = null;
+
+  // calls
+  calls: ApiLog[] = [];
+  openLog: ApiLog | null = null;
+
+  readonly authTypes = Object.entries(API_AUTH_TYPES).map(
+    ([
+      key,
+      label
+    ]) => ({ key, label })
+  );
+  readonly contentTypes = Object.entries(API_CONTENT_TYPES).map(
+    ([
+      key,
+      label
+    ]) => ({ key, label })
+  );
+  readonly transforms = Object.entries(API_TRANSFORMS).map(
+    ([
+      key,
+      label
+    ]) => ({ key, label })
+  );
+  readonly cbsFields = Object.entries(API_CBS_FIELDS).map(
+    ([
+      key,
+      label
+    ]) => ({ key, label })
+  );
+  readonly methods = API_METHODS;
+
+  ngOnInit(): void {
+    this.load(Number(this.route.snapshot.paramMap.get('id')));
+  }
+
+  load(id: number): void {
+    this.loading = true;
+    this.service.vendor(id).subscribe({
+      next: (v) => {
+        this.vendor = v;
+        this.loading = false;
+        this.resetForm(v);
+        if (!this.testApiId || !v.apis.some((a) => a.id === this.testApiId)) this.testApiId = v.apis[0]?.id ?? null;
+        this.fillTestBody();
+        this.loadCalls();
+      },
+      error: (e) => {
+        this.loading = false;
+        this.error = e?.error?.defaultUserMessage ?? 'Could not load the vendor.';
+      }
+    });
+  }
+
+  private resetForm(v: ApiVendor): void {
+    this.form = {
+      name: v.name,
+      work: v.work,
+      environment: v.environment,
+      baseUrl: v.baseUrl,
+      authType: v.authType,
+      username: v.username,
+      apiKeyHeader: v.apiKeyHeader,
+      secret: '',
+      clearSecret: false,
+      senderId: v.senderId,
+      timeoutMs: v.timeoutMs,
+      retries: v.retries,
+      defaultHeaders: JSON.parse(JSON.stringify(v.defaultHeaders)),
+      active: v.active
+    };
+  }
+
+  loadCalls(): void {
+    if (!this.vendor) return;
+    this.service.logs({ vendorId: String(this.vendor.id), limit: 12 }).subscribe((r) => (this.calls = r.items));
+  }
+
+  // ── connection ──
+
+  needsSecret(): boolean {
+    return this.form.authType !== 'NONE';
+  }
+
+  secretLabel(): string {
+    const a = this.form.authType;
+    return a === 'BASIC'
+      ? 'Password'
+      : a === 'API_KEY'
+        ? 'API key'
+        : a === 'BEARER_TOKEN'
+          ? 'Bearer token'
+          : 'Client secret';
+  }
+
+  saveConnection(): void {
+    if (!this.vendor) return;
+    this.saving = true;
+    this.error = null;
+    this.info = null;
+    const body = { ...this.form };
+    if (!body.secret) delete body.secret;
+    this.service.saveVendor(this.vendor.id, body).subscribe({
+      next: (v) => {
+        this.saving = false;
+        this.vendor = v;
+        this.resetForm(v);
+        this.info = `${v.name} connection saved.`;
+      },
+      error: (e) => {
+        this.saving = false;
+        this.error = e?.error?.defaultUserMessage ?? 'Could not save the connection.';
+      }
+    });
+  }
+
+  // ── API set ──
+
+  newApi(direction: 'IN' | 'OUT'): void {
+    this.isNewApi = true;
+    this.error = null;
+    this.info = null;
+    this.editorTab = 'basics';
+    this.editing = blankApi(direction);
+  }
+
+  editApi(a: VendorApi): void {
+    this.isNewApi = false;
+    this.error = null;
+    this.info = null;
+    this.editorTab = 'basics';
+    this.editing = JSON.parse(JSON.stringify(a));
+  }
+
+  /** True when the CBS makes the HTTP call (OUT, or IN pull); false for an IN push webhook. */
+  get outbound(): boolean {
+    return !!this.editing && callsVendor(this.editing);
+  }
+
+  directionChanged(): void {
+    if (!this.editing) return;
+    this.editing.mode = this.editing.direction === 'IN' ? (this.editing.mode ?? 'PUSH') : undefined;
+  }
+
+  /** Keeps the path-parameter table in step with the {names} typed in the path. */
+  pathChanged(): void {
+    if (!this.editing) return;
+    const names = pathParamNames(this.editing.path);
+    const kept = this.editing.pathParams.filter((p) => names.includes(p.key));
+    for (const n of names) {
+      if (!kept.some((p) => p.key === n))
+        kept.push({ key: n, value: '', description: '', enabled: true, secret: false });
+    }
+    this.editing.pathParams = kept;
+  }
+
+  rowsOf(side: 'request' | 'response'): ApiMappingRow[] {
+    if (!this.editing) return [];
+    return side === 'request' ? this.editing.requestRows : this.editing.responseRows;
+  }
+
+  /** Whether the left column of a mapping table holds a CBS value (a pick list) or a path in the vendor's JSON. */
+  fromIsCbs(side: 'request' | 'response'): boolean {
+    return this.outbound ? side === 'request' : side === 'response';
+  }
+
+  mappingTitle(side: 'request' | 'response'): string {
+    if (this.outbound) return side === 'request' ? 'Request mapping (CBS → vendor)' : 'Response mapping (vendor → CBS)';
+    return side === 'request' ? 'Incoming data mapping (vendor → CBS)' : 'Answer mapping (CBS → vendor)';
+  }
+
+  fromLabel(side: 'request' | 'response'): string {
+    return this.fromIsCbs(side) ? 'CBS value' : "Vendor's JSON path";
+  }
+
+  toLabel(side: 'request' | 'response'): string {
+    if (this.fromIsCbs(side)) return side === 'request' ? "Vendor's request path" : 'Answer path';
+    return 'CBS field';
+  }
+
+  addRow(side: 'request' | 'response'): void {
+    this.rowsOf(side).push({ from: '', to: '', transform: 'NONE', defaultValue: '', mandatory: false });
+  }
+
+  removeRow(side: 'request' | 'response', i: number): void {
+    this.rowsOf(side).splice(i, 1);
+  }
+
+  /** Builds mapping rows from the payload typed or imported for that side. */
+  generateRows(side: 'request' | 'response'): void {
+    if (!this.editing || !this.vendor) return;
+    const body = side === 'request' ? this.editing.requestBody : this.editing.responseBody;
+    // Reading values OUT of a payload (vendor → CBS) vs putting values INTO one (CBS → vendor).
+    const reading = !this.fromIsCbs(side);
+    const rows = reading ? guessResponseRows(body, this.vendor.code) : guessRequestRows(body);
+    if (!rows.length) {
+      this.error = 'That payload has no JSON values to build a mapping from.';
+      return;
+    }
+    this.error = null;
+    const target = this.rowsOf(side);
+    const have = new Set(target.map((r) => r.to));
+    target.push(...rows.filter((r) => !have.has(r.to)));
+    this.info = `${rows.length} mapping row(s) read from the payload. Review the CBS fields and adjust.`;
+  }
+
+  saveApi(): void {
+    if (!this.vendor || !this.editing) return;
+    this.savingApi = true;
+    this.error = null;
+    this.service.saveApi(this.vendor.id, this.editing).subscribe({
+      next: (a) => {
+        this.savingApi = false;
+        this.info = `${a.name} saved.`;
+        this.editing = null;
+        this.load(this.vendor!.id);
+      },
+      error: (e) => {
+        this.savingApi = false;
+        this.error = e?.error?.defaultUserMessage ?? 'Could not save the API.';
+      }
+    });
+  }
+
+  deleteApi(a: VendorApi): void {
+    if (!this.vendor || !confirm(`Delete the API "${a.name}"?`)) return;
+    this.service.deleteApi(this.vendor.id, a.id).subscribe(() => {
+      this.editing = null;
+      this.info = `${a.name} deleted.`;
+      this.load(this.vendor!.id);
+    });
+  }
+
+  /** The request this API would send (or receive), as the Test tab and the editor show it. */
+  preview(a: VendorApi | null): RequestPreview | null {
+    return this.vendor && a ? buildRequestPreview(this.vendor, a) : null;
+  }
+
+  // ── import ──
+
+  openImport(): void {
+    this.importOpen = true;
+    this.importError = null;
+    this.importReplace = this.isNewApi;
+    this.importRequestText = '';
+    this.importResponseText = '';
+    this.importRequestFile = '';
+    this.importResponseFile = '';
+  }
+
+  onFile(event: Event, which: 'request' | 'response'): void {
+    const input = event.target as HTMLInputElement;
+    const file = input.files?.[0];
+    if (!file) return;
+    if (file.size > 5 * 1024 * 1024) {
+      this.importError = 'The file is larger than 5 MB.';
+      return;
+    }
+    const reader = new FileReader();
+    reader.onload = () => {
+      const text = String(reader.result ?? '');
+      if (which === 'request') {
+        this.importRequestText = text;
+        this.importRequestFile = file.name;
+      } else {
+        this.importResponseText = text;
+        this.importResponseFile = file.name;
+      }
+    };
+    reader.readAsText(file);
+    input.value = '';
+  }
+
+  applyImport(): void {
+    if (!this.editing || !this.vendor) return;
+    this.importError = null;
+    let req: ImportedRequest | null = null;
+    let res: ImportedResponse | null = null;
+    try {
+      if (this.importRequestText.trim()) req = parseRequestText(this.importRequestText);
+      if (this.importResponseText.trim()) res = parseResponseText(this.importResponseText);
+      else if (req?.response) res = req.response;
+    } catch (e: any) {
+      this.importError = e?.message ?? 'Could not read the file.';
+      return;
+    }
+    if (!req && !res) {
+      this.importError = 'Paste or choose a request, a response, or both.';
+      return;
+    }
+
+    const a = this.editing;
+    const done: string[] = [];
+    const notes: string[] = [
+      ...(req?.notes ?? []),
+      ...(res?.notes ?? [])
+    ];
+    const replace = this.importReplace;
+
+    const mergePairs = (target: KeyValue[], incoming: KeyValue[]): KeyValue[] => {
+      if (replace) return incoming;
+      const out = [...target];
+      for (const p of incoming) {
+        const i = out.findIndex((x) => x.key.toLowerCase() === p.key.toLowerCase());
+        if (i >= 0) out[i] = p;
+        else out.push(p);
+      }
+      return out;
+    };
+
+    if (req) {
+      if (req.method && this.methods.includes(req.method)) {
+        a.method = req.method as VendorApi['method'];
+        done.push(`method ${req.method}`);
+      }
+      if (req.path && req.path !== '/') {
+        a.path = this.stripVendorBasePath(req.path);
+        done.push(`path ${a.path}`);
+      }
+      if (req.baseUrl) {
+        if (!this.form.baseUrl) {
+          this.form.baseUrl = req.baseUrl;
+          notes.push(`Base URL ${req.baseUrl} was put on the Connection tab - save it there.`);
+        } else if (this.form.baseUrl.replace(/\/+$/, '') !== req.baseUrl) {
+          notes.push(
+            `The file's host (${req.baseUrl}) is not this vendor's base URL (${this.form.baseUrl}); only the path was used.`
+          );
+        }
+      }
+      if (req.queryParams.length) {
+        a.queryParams = mergePairs(a.queryParams, req.queryParams);
+        done.push(`${req.queryParams.length} query parameter(s)`);
+      }
+      if (req.headers.length) {
+        a.headers = mergePairs(a.headers, req.headers);
+        done.push(`${req.headers.length} header(s)`);
+      }
+      if (req.contentType) {
+        a.contentType = Object.keys(API_CONTENT_TYPES).includes(req.contentType) ? req.contentType : a.contentType;
+        done.push(`content type ${a.contentType}`);
+      }
+      if (req.body !== undefined) {
+        a.requestBody = req.body;
+        done.push('request payload');
+      }
+      if (!a.name.trim() && a.path) {
+        const last =
+          a.path
+            .split('/')
+            .filter((s) => s && !s.includes('{'))
+            .pop() ?? 'API';
+        a.name = last.charAt(0).toUpperCase() + last.slice(1).replace(/[-_]+/g, ' ');
+      }
+      this.pathChanged();
+    }
+
+    if (res) {
+      const failure = res.status !== undefined && (res.status < 200 || res.status > 299);
+      if (res.status !== undefined && !failure) {
+        a.successCodes = String(res.status);
+        done.push(`success code ${res.status}`);
+      }
+      if (res.headers.length) {
+        a.responseHeaders = mergePairs(a.responseHeaders, res.headers);
+        done.push(`${res.headers.length} response header(s)`);
+      }
+      if (res.body !== undefined) {
+        if (failure) {
+          a.errorBody = res.body;
+          done.push(`error body (HTTP ${res.status})`);
+        } else {
+          a.responseBody = res.body;
+          done.push('response body');
+        }
+      }
+      if (res.errorBody !== undefined) {
+        a.errorBody = res.errorBody;
+        done.push('error body');
+      }
+    }
+
+    if (this.importGenerate) {
+      const addRows = (side: 'request' | 'response', body: string) => {
+        const reading = !this.fromIsCbs(side);
+        const rows = reading ? guessResponseRows(body, this.vendor!.code) : guessRequestRows(body);
+        if (!rows.length) return;
+        const target = replace ? [] : this.rowsOf(side);
+        const have = new Set(target.map((r) => r.to));
+        const merged = [
+          ...target,
+          ...rows.filter((r) => !have.has(r.to))
+        ];
+        if (side === 'request') a.requestRows = merged;
+        else a.responseRows = merged;
+        done.push(`${rows.length} ${side === 'request' ? 'request' : 'response'} mapping row(s)`);
+      };
+      if (req?.body !== undefined) addRows('request', a.requestBody);
+      if (res?.body !== undefined && !(res.status !== undefined && (res.status < 200 || res.status > 299)))
+        addRows('response', a.responseBody);
+    }
+
+    this.importOpen = false;
+    this.error = null;
+    this.info = `Read from ${[
+      req?.source,
+      res?.source
+    ]
+      .filter(Boolean)
+      .join(' + ')}: ${done.join(', ') || 'nothing new'}. ${notes.join(' ')} Review each tab, then Save API.`;
+  }
+
+  /** A path read from a full URL may repeat the path already in the vendor's base URL. */
+  private stripVendorBasePath(path: string): string {
+    const base = String(this.form.baseUrl ?? '');
+    const m = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/]+(\/.+)$/.exec(base.replace(/\/+$/, ''));
+    if (m && path.startsWith(m[1] + '/')) return path.slice(m[1].length);
+    return path;
+  }
+
+  // ── test ──
+
+  get testApi(): VendorApi | null {
+    return this.vendor?.apis.find((x) => x.id === this.testApiId) ?? null;
+  }
+
+  fillTestBody(): void {
+    this.testBody = this.testApi?.requestBody ?? '{}';
+    this.testResult = null;
+  }
+
+  get testPreview(): RequestPreview | null {
+    const a = this.testApi;
+    return this.vendor && a ? buildRequestPreview(this.vendor, { ...a, requestBody: this.testBody }) : null;
+  }
+
+  runTest(): void {
+    if (!this.vendor || !this.testApiId) return;
+    this.testing = true;
+    this.error = null;
+    this.service.testApi(this.vendor.id, this.testApiId, this.testBody).subscribe({
+      next: (log) => {
+        this.testing = false;
+        this.testResult = log;
+        this.loadCalls();
+      },
+      error: (e) => {
+        this.testing = false;
+        this.error = e?.error?.defaultUserMessage ?? 'Test failed.';
+      }
+    });
+  }
+}

src/app/api-management/api-vendors/api-vendors.component.html

@@ -0,0 +1,172 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>API Management</h1>
+      <p>
+        Connect any API service to the CBS the same way: <b>Vendor → Work → API set</b>. <b>IN</b> = data comes into the
+        CBS from the vendor (CIC alerts, delivery reports, replies). <b>OUT</b> = the CBS calls the vendor (send an SMS
+        or WhatsApp message).
+      </p>
+    </div>
+    <div class="cic-actions">
+      <a class="cic-btn" routerLink="/api-management/logs">API call logs</a>
+      <button class="cic-btn primary" (click)="startAdd()">+ Add vendor</button>
+    </div>
+  </div>
+
+  @if (error && !adding) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+  @if (info) {
+    <div class="cic-alert success">{{ info }}</div>
+  }
+
+  <div class="cic-grid cols-4" style="margin-bottom: 16px">
+    <div class="cic-stat">
+      <div class="k">Vendors</div>
+      <div class="v">{{ vendors.length }}</div>
+      <div class="s">{{ activeVendors }} active</div>
+    </div>
+    <div class="cic-stat">
+      <div class="k">APIs</div>
+      <div class="v">{{ totalIn + totalOut }}</div>
+      <div class="s">{{ totalIn }} IN · {{ totalOut }} OUT</div>
+    </div>
+    <div class="cic-stat">
+      <div class="k">Calls in 24 hours</div>
+      <div class="v">{{ summary.callsToday }}</div>
+      <div class="s">both directions</div>
+    </div>
+    <div class="cic-stat">
+      <div class="k">Failed in 24 hours</div>
+      <div class="v" [class.tone-bad]="summary.failedToday > 0">{{ summary.failedToday }}</div>
+      <div class="s">see the call logs</div>
+    </div>
+  </div>
+
+  <div class="cic-card">
+    <h2>Vendors</h2>
+    @if (loading && !vendors.length) {
+      <div class="cic-empty">Loading…</div>
+    } @else {
+      <div class="cic-table-wrap">
+        <table class="cic-table">
+          <thead>
+            <tr>
+              <th>Vendor</th>
+              <th>Work</th>
+              <th>APIs</th>
+              <th>Environment</th>
+              <th>24 h calls</th>
+              <th>Last call</th>
+              <th>Active</th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            @for (v of vendors; track v.id) {
+              <tr>
+                <td>
+                  <b>{{ v.name }}</b>
+                  <div class="muted cic-mono" style="font-size: 11px">{{ v.code }}</div>
+                </td>
+                <td style="max-width: 340px; white-space: normal">{{ v.work }}</td>
+                <td>
+                  @if (count(v, 'IN')) {
+                    <span class="cic-badge brand">IN × {{ count(v, 'IN') }}</span>
+                  }
+                  @if (count(v, 'OUT')) {
+                    <span class="cic-badge ok">OUT × {{ count(v, 'OUT') }}</span>
+                  }
+                  @if (!v.apis.length) {
+                    <span class="muted">none yet</span>
+                  }
+                </td>
+                <td>
+                  <span
+                    class="cic-badge"
+                    [class.warn]="v.environment === 'SIMULATOR'"
+                    [class.good]="v.environment === 'PRODUCTION'"
+                    >{{ v.environment }}</span
+                  >
+                </td>
+                <td>
+                  {{ calls(v).calls }}
+                  @if (calls(v).failed) {
+                    <span class="tone-bad" style="font-size: 12px"> · {{ calls(v).failed }} failed</span>
+                  }
+                </td>
+                <td>{{ v.lastCallOn ? (v.lastCallOn | slice: 0 : 16) : '—' }}</td>
+                <td>
+                  <span class="cic-switch">
+                    <input type="checkbox" [checked]="v.active" (change)="toggle(v, $event)" />
+                    <span></span>
+                  </span>
+                </td>
+                <td style="white-space: nowrap">
+                  <a class="cic-btn sm primary" [routerLink]="['/api-management/vendors', v.id]">Set up</a>
+                </td>
+              </tr>
+              @if (v.links.length) {
+                <tr>
+                  <td colspan="8" style="background: var(--cic-soft); padding: 6px 12px">
+                    <span class="muted" style="font-size: 12px">{{ v.code }} also has:</span>
+                    @for (l of v.links; track l.route) {
+                      <a class="cic-btn sm" style="margin-left: 6px" [routerLink]="l.route">{{ l.label }}</a>
+                    }
+                  </td>
+                </tr>
+              }
+            }
+          </tbody>
+        </table>
+      </div>
+    }
+  </div>
+
+  @if (adding) {
+    <div class="cic-modal-backdrop" (click)="adding = false">
+      <div class="cic-modal" (click)="$event.stopPropagation()">
+        <h3>Add an API vendor</h3>
+        @if (error) {
+          <div class="cic-alert error">{{ error }}</div>
+        }
+        <div class="cic-grid cols-1" style="gap: 12px">
+          <div class="cic-field">
+            <label>Vendor name</label>
+            <input [(ngModel)]="form.name" placeholder="e.g. Aadhaar eKYC, Payment gateway, E-mail" />
+          </div>
+          <div class="cic-field">
+            <label>Work — what is this vendor used for?</label>
+            <textarea rows="3" [(ngModel)]="form.work" placeholder="e.g. Verify customer Aadhaar during KYC"></textarea>
+          </div>
+          <div class="cic-field">
+            <label>Environment</label>
+            <select [(ngModel)]="form.environment">
+              <option value="SIMULATOR">SIMULATOR — no network call</option>
+              <option value="UAT">UAT — vendor's test environment</option>
+              <option value="PRODUCTION">PRODUCTION — live</option>
+            </select>
+          </div>
+        </div>
+        <p class="muted" style="font-size: 12px; margin: 12px 0 0">
+          Next you set up the connection and add its APIs, each marked IN or OUT.
+        </p>
+        <div class="foot">
+          <button class="cic-btn" (click)="adding = false">Cancel</button>
+          <button class="cic-btn primary" (click)="saveNew()" [disabled]="saving">
+            {{ saving ? 'Adding…' : 'Add and set up' }}
+          </button>
+        </div>
+      </div>
+    </div>
+  }
+</div>

src/app/api-management/api-vendors/api-vendors.component.ts

@@ -0,0 +1,121 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { Router, RouterModule } from '@angular/router';
+
+import { ApiManagementService, ApiVendor } from '../api-management.service';
+
+/** Every outside API service the CBS uses: vendor, its work, its APIs (IN / OUT) and whether it is switched on. */
+@Component({
+  selector: 'mifosx-api-vendors',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule
+  ],
+  templateUrl: './api-vendors.component.html',
+  styleUrls: ['../../credit-bureau/cic-shared.scss']
+})
+export class ApiVendorsComponent implements OnInit {
+  private service = inject(ApiManagementService);
+  private router = inject(Router);
+
+  vendors: ApiVendor[] = [];
+  summary: { callsToday: number; failedToday: number; perVendor: Record<number, { calls: number; failed: number }> } = {
+    callsToday: 0,
+    failedToday: 0,
+    perVendor: {}
+  };
+  loading = false;
+  error: string | null = null;
+  info: string | null = null;
+
+  adding = false;
+  saving = false;
+  form: { name: string; work: string; environment: ApiVendor['environment'] } = this.blankForm();
+
+  ngOnInit(): void {
+    this.load();
+  }
+
+  private blankForm() {
+    return { name: '', work: '', environment: 'SIMULATOR' as ApiVendor['environment'] };
+  }
+
+  load(): void {
+    this.loading = true;
+    this.service.vendors().subscribe((v) => {
+      this.vendors = v;
+      this.loading = false;
+    });
+    this.service.summary().subscribe((s) => (this.summary = s));
+  }
+
+  count(v: ApiVendor, direction: 'IN' | 'OUT'): number {
+    return v.apis.filter((a) => a.direction === direction).length;
+  }
+
+  get totalIn(): number {
+    return this.vendors.reduce((s, v) => s + this.count(v, 'IN'), 0);
+  }
+
+  get totalOut(): number {
+    return this.vendors.reduce((s, v) => s + this.count(v, 'OUT'), 0);
+  }
+
+  get activeVendors(): number {
+    return this.vendors.filter((v) => v.active).length;
+  }
+
+  calls(v: ApiVendor): { calls: number; failed: number } {
+    return this.summary.perVendor[v.id] ?? { calls: 0, failed: 0 };
+  }
+
+  toggle(v: ApiVendor, event: Event): void {
+    const want = (event.target as HTMLInputElement).checked;
+    (event.target as HTMLInputElement).checked = v.active;
+    this.error = null;
+    this.info = null;
+    this.service.saveVendor(v.id, { active: want }).subscribe({
+      next: (u) => {
+        v.active = u.active;
+        this.info = `${u.name} is now ${u.active ? 'active' : 'switched off'}.`;
+      },
+      error: (e) => (this.error = e?.error?.defaultUserMessage ?? 'Could not change the vendor.')
+    });
+  }
+
+  startAdd(): void {
+    this.adding = true;
+    this.form = this.blankForm();
+    this.error = null;
+  }
+
+  saveNew(): void {
+    this.saving = true;
+    this.error = null;
+    this.service.addVendor(this.form).subscribe({
+      next: (v) => {
+        this.saving = false;
+        this.adding = false;
+        this.router.navigate([
+          '/api-management/vendors',
+          v.id
+        ]);
+      },
+      error: (e) => {
+        this.saving = false;
+        this.error = e?.error?.defaultUserMessage ?? 'Could not add the vendor.';
+      }
+    });
+  }
+}

src/app/app.module.ts

@@ -73,6 +73,8 @@ import { InvestmentModule } from './investment/investment.module';
 import { NpaModule } from './npa/npa.module';
 import { ReconciliationModule } from './reconciliation/reconciliation.module';
 import { LoanOriginationModule } from './loan-origination/loan-origination.module';
+import { CreditBureauModule } from './credit-bureau/credit-bureau.module';
+import { ApiManagementModule } from './api-management/api-management.module';
 import { DigitalModule } from './digital/digital.module';
 import { LetterMgmtModule } from './letter-mgmt/letter-mgmt.module';
 import { AccountsModule } from './accounts/accounts.module';
@@ -189,6 +191,8 @@ export function HttpLoaderFactory(http: HttpClient) {
     NpaModule,
     ReconciliationModule,
     LoanOriginationModule,
+    CreditBureauModule,
+    ApiManagementModule,
     DigitalModule,
     LetterMgmtModule,
     AccountsModule,

src/app/cashier/transaction-entry/transaction-entry.component.html

@@ -184,7 +184,7 @@
                           class="ws-f__ctl"
                           [(ngModel)]="row.acTyp"
                           (click)="$event.stopPropagation()"
-                          (change)="isGlCreditOnly(row) && (row.dbCr = 'Cr')"
+                          (change)="isCreditOnly(row) && (row.dbCr = 'Cr')"
                         >
                           @for (a of acTypOptionsFor(row); track a) {
                             <option [value]="a">{{ a }}</option>
@@ -267,7 +267,7 @@
                           type="button"
                           class="ws-seg__btn ws-seg__btn--dr"
                           [class.ws-seg__btn--active-dr]="row.dbCr === 'Dr'"
-                          [disabled]="isGlCreditOnly(row)"
+                          [disabled]="isCreditOnly(row)"
                           (click)="row.dbCr = 'Dr'"
                         >
                           DR
@@ -1644,7 +1644,7 @@
                               class="ws-f__ctl"
                               [(ngModel)]="row.acTyp"
                               (click)="$event.stopPropagation()"
-                              (change)="isGlCreditOnly(row) && (row.dbCr = 'Cr')"
+                              (change)="isCreditOnly(row) && (row.dbCr = 'Cr')"
                             >
                               @for (a of acTypOptionsFor(row); track a) {
                                 <option [value]="a">{{ a }}</option>
@@ -1715,7 +1715,7 @@
                               type="button"
                               class="ws-seg__btn ws-seg__btn--dr"
                               [class.ws-seg__btn--active-dr]="row.dbCr === 'Dr'"
-                              [disabled]="isGlCreditOnly(row)"
+                              [disabled]="isCreditOnly(row)"
                               (click)="$event.stopPropagation(); row.dbCr = 'Dr'"
                             >
                               DR

src/app/cashier/transaction-entry/transaction-entry.component.ts

@@ -2344,6 +2344,20 @@ export class TransactionEntryComponent implements OnInit, OnDestroy {
     );
   }
 
+  /**
+   * A Fixed Deposit row is credit-only on both the clerk and the cashier screens: an FD is funded once, with
+   * exactly its principal, and money leaves it only through its maturity or premature closure. The one
+   * exception is the clerk's own "Close this account" flow, which raises a closure request.
+   */
+  isFdCreditOnly(row: TxnRow): boolean {
+    return row.acTyp === 'FD' && !this.pendingClosure;
+  }
+
+  /** DR is not offered for this row (see isGlCreditOnly and isFdCreditOnly). */
+  isCreditOnly(row: TxnRow): boolean {
+    return this.isGlCreditOnly(row) || this.isFdCreditOnly(row);
+  }
+
   /** Called when the TYPE dropdown changes — sets sensible defaults for TXN TP and DR/CR */
   /**
    * A cashier row that was filled from an approved token (withdrawal / account-closure) is cash
@@ -5272,6 +5286,20 @@ export class TransactionEntryComponent implements OnInit, OnDestroy {
   }
 
   onSave(): void {
+    // Money never leaves a Fixed Deposit from this screen, clerk or cashier: no withdrawal slip, payment,
+    // collection or transfer debits an FD. It is paid out only through its maturity or premature closure
+    // (the clerk's "Close this account" flow). The DR button is already disabled for FD rows (isFdCreditOnly);
+    // this also catches a row set to DR by its TYPE, such as a Withdrawal Slip.
+    const fdDebitRows = this.rows.filter((r) => this.isFdCreditOnly(r) && r.dbCr === 'Dr');
+    if (fdDebitRows.length > 0) {
+      this.showAlert('error', 'Fixed Deposit Cannot Be Debited', [
+        `FD account(s) ${fdDebitRows.map((r) => r.acNo).join(', ')} cannot be debited or withdrawn from.`,
+        'Money leaves a Fixed Deposit only through its maturity or premature closure.',
+        'An FD can only be credited — once, with exactly its principal.'
+      ]);
+      return;
+    }
+
     // Demand drafts commit here like everything else on the worksheet. Checked first because a DD
     // row shares its shape with the ordinary entries below — without this it would fall through and
     // post as a plain transaction, with the draft never raised and the charges silently dropped.
@@ -5349,7 +5377,9 @@ export class TransactionEntryComponent implements OnInit, OnDestroy {
         return;
       }
 
-      // Bank transfer: only savings (SD) or current (CA/CB) accounts allowed
+      // Bank transfer: savings (SD) or current (CA/CB) accounts on either side, plus a Fixed Deposit (FD) on
+      // the CR side only -- funding it from the customer's own account. The server checks the funding rules
+      // (first and only funding, exactly the principal, the source account's owner and available balance).
       const allowedTypes = new Set([
         'SD',
         'CA',
@@ -5357,13 +5387,13 @@ export class TransactionEntryComponent implements OnInit, OnDestroy {
       ]);
       const invalidAccounts = [
         ...drRows,
-        ...crRows
+        ...crRows.filter((r) => r.acTyp !== 'FD')
       ].filter((r) => !allowedTypes.has(r.acTyp));
       if (invalidAccounts.length > 0) {
         this.showAlert('error', 'Invalid Account Type', [
           `Account type(s) not allowed in Bank Transfer: ${invalidAccounts.map((r) => r.acTyp + ' (' + r.acNo + ')').join(', ')}`,
-          'Only Savings (SD) and Current (CA) accounts are permitted.',
-          'GL, FD and SHR accounts are not allowed — use Disbursement/Collection instead.',
+          'Debit side: only Savings (SD) and Current (CA) accounts. Credit side: SD, CA or a Fixed Deposit (FD).',
+          'GL and SHR accounts are not allowed — use Disbursement/Collection instead.',
           'RD installments are paid through a cashier Receipt or Auto Debit.'
         ]);
         return;

src/app/core/shell/shell.component.html

@@ -407,6 +407,15 @@
           <fa-icon icon="clipboard-check" class="ni-ico"></fa-icon>Loan Origination
           <fa-icon icon="caret-down" class="ni-caret"></fa-icon>
         </a>
+        <a
+          class="ni"
+          tabindex="0"
+          routerLink="/credit-bureau/dashboard"
+          routerLinkActive="active"
+          *mifosxHasPermission="'MENU_CREDIT_BUREAU'"
+        >
+          <fa-icon icon="id-card" class="ni-ico"></fa-icon>Credit Bureau
+        </a>
         <a class="ni" tabindex="0" [matMenuTriggerFor]="advancesMenu" *mifosxHasPermission="'MENU_ADVANCES'">
           <fa-icon icon="hand-holding-usd" class="ni-ico"></fa-icon>Advances
           <fa-icon icon="caret-down" class="ni-caret"></fa-icon>
@@ -508,6 +517,16 @@
             ><span class="ni-short">Loans</span>
             <fa-icon icon="caret-down" class="ni-caret"></fa-icon>
           </a>
+          <a
+            class="ni"
+            tabindex="0"
+            routerLink="/credit-bureau/dashboard"
+            routerLinkActive="active"
+            *mifosxHasPermission="'MENU_CREDIT_BUREAU'"
+          >
+            <fa-icon icon="id-card" class="ni-ico"></fa-icon><span class="ni-full">Credit Bureau</span
+            ><span class="ni-short">CIC</span>
+          </a>
           <a
             class="ni"
             tabindex="0"

src/app/core/shell/toolbar/toolbar.component.html

@@ -239,6 +239,41 @@
         </span>
       </button>
     </div>
+
+    <div class="ai-col ai-col--blue">
+      <div class="ai-col-h">
+        <fa-icon icon="sitemap" class="ai-col-h-ic"></fa-icon>
+        <span>API Management</span>
+      </div>
+      <button mat-menu-item class="ai-card" routerLink="/api-management/vendors" tabindex="0">
+        <span class="ai-card-ic"><fa-icon icon="cogs"></fa-icon></span>
+        <span class="ai-card-body">
+          <span class="ai-card-t">API Vendors &amp; Setup</span>
+          <span class="ai-card-d">Vendor, work and API set — IN / OUT (CIC, SMS, WhatsApp …)</span>
+        </span>
+      </button>
+      <button mat-menu-item class="ai-card" routerLink="/credit-bureau/bureaus" tabindex="0">
+        <span class="ai-card-ic"><fa-icon icon="id-card"></fa-icon></span>
+        <span class="ai-card-body">
+          <span class="ai-card-t">CIC Whitelist &amp; Configuration</span>
+          <span class="ai-card-d">Choose and connect CIBIL, Experian, Equifax, CRIF</span>
+        </span>
+      </button>
+      <button mat-menu-item class="ai-card" routerLink="/credit-bureau/api-mapping" tabindex="0">
+        <span class="ai-card-ic"><fa-icon icon="project-diagram"></fa-icon></span>
+        <span class="ai-card-body">
+          <span class="ai-card-t">CIC API Mapping</span>
+          <span class="ai-card-d">Map CBS fields to the bureau's request and response</span>
+        </span>
+      </button>
+      <button mat-menu-item class="ai-card" routerLink="/api-management/logs" tabindex="0">
+        <span class="ai-card-ic"><fa-icon icon="history"></fa-icon></span>
+        <span class="ai-card-body">
+          <span class="ai-card-t">API Call Logs</span>
+          <span class="ai-card-d">Every IN and OUT call with request and response</span>
+        </span>
+      </button>
+    </div>
   </div>
 
   <div class="ai-menu-footer">

src/app/core/shell/toolbar/toolbar.component.scss

@@ -373,7 +373,7 @@ $icon-hover-border: rgb(255 255 255 / 28%);
 // ===== AI Mega Menu Panel =====
 ::ng-deep .ai-menu {
   &.mat-mdc-menu-panel {
-    min-width: 880px !important;
+    min-width: 1080px !important;
     max-width: 96vw !important;
     max-height: 80vh;
     border-radius: 14px !important;
@@ -520,7 +520,7 @@ $icon-hover-border: rgb(255 255 255 / 28%);
 // ===== Mega Layout — 4 colour-coded columns =====
 .ai-menu-cols {
   display: grid;
-  grid-template-columns: repeat(4, 1fr);
+  grid-template-columns: repeat(5, 1fr);
   gap: 0;
   padding: 14px 14px 6px;
   background: #f8fafc;
@@ -567,6 +567,12 @@ $icon-hover-border: rgb(255 255 255 / 28%);
   --c-hover: #be185d;
 }
 
+.ai-col--blue {
+  --c-color: #0369a1;
+  --c-bg: #e0f2fe;
+  --c-hover: #0369a1;
+}
+
 .ai-col-h {
   display: flex;
   align-items: center;
@@ -702,7 +708,7 @@ $icon-hover-border: rgb(255 255 255 / 28%);
 }
 
 // Responsive collapse
-@media (width <= 1100px) {
+@media (width <= 1300px) {
   ::ng-deep .ai-menu.mat-mdc-menu-panel {
     min-width: 680px !important;
   }

src/app/credit-bureau/cic-alert-detail/cic-alert-detail.component.html

@@ -0,0 +1,237 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-modal-backdrop" (click)="closed.emit()">
+  <div class="cic-modal" style="width: min(980px, 100%)" (click)="$event.stopPropagation()">
+    @if (loading && !alert) {
+      <div class="cic-empty">Loading…</div>
+    }
+    @if (alert) {
+      <div style="display: flex; justify-content: space-between; gap: 12px; align-items: flex-start">
+        <div>
+          <h3 style="margin-bottom: 4px">
+            {{ alert.clientName || alert.customerName || 'Unknown customer' }} applied for
+            {{ alert.loanType || 'a loan' }} elsewhere
+          </h3>
+          <div class="muted" style="font-size: 12px">
+            {{ alert.bureauCode }} alert · {{ alert.alertKey }} · received {{ alert.receivedOn | slice: 0 : 16 }} via
+            {{ alert.receivedVia }}
+          </div>
+        </div>
+        <div class="cic-actions">
+          <span class="cic-badge" [class]="'cic-badge ' + statusTone(alert.status)">{{ alert.status }}</span>
+          <button class="cic-btn sm" (click)="closed.emit()">Close</button>
+        </div>
+      </div>
+
+      @if (error) {
+        <div class="cic-alert error" style="margin-top: 12px">{{ error }}</div>
+      }
+      @if (info) {
+        <div class="cic-alert success" style="margin-top: 12px">{{ info }}</div>
+      }
+
+      <div class="cic-grid cols-3" style="margin-top: 14px">
+        <div class="cic-stat">
+          <div class="k">Loan applied for</div>
+          <div class="v" style="font-size: 17px">{{ alert.loanType || '—' }}</div>
+        </div>
+        <div class="cic-stat">
+          <div class="k">Amount</div>
+          <div class="v" style="font-size: 20px">
+            {{ alert.amount !== null && alert.amount !== undefined ? '₹' + (alert.amount | number: '1.0-0') : '—' }}
+          </div>
+        </div>
+        <div class="cic-stat">
+          <div class="k">Enquiry date</div>
+          <div class="v" style="font-size: 17px">{{ alert.enquiryDate | date: 'dd MMM yyyy' }}</div>
+        </div>
+      </div>
+
+      <div class="cic-split" style="margin-top: 14px">
+        <div class="cic-card" style="margin-bottom: 0">
+          <h2>
+            Enquiry elsewhere
+            <span class="cic-card-sub">the CIC does not name the lender</span>
+          </h2>
+          <dl class="cic-kv" style="grid-template-columns: 140px minmax(0, 1fr)">
+            <dt>Loan type</dt>
+            <dd>{{ alert.loanType || '—' }}</dd>
+            <dt>Amount</dt>
+            <dd>
+              {{ alert.amount !== null && alert.amount !== undefined ? '₹' + (alert.amount | number: '1.0-2') : '—' }}
+            </dd>
+            <dt>Purpose</dt>
+            <dd>{{ alert.purpose || '—' }}</dd>
+            <dt>Place</dt>
+            <dd>{{ alert.location || '—' }}</dd>
+            <dt>Enquiry date</dt>
+            <dd>{{ alert.enquiryDate | date: 'dd MMM yyyy' }}</dd>
+          </dl>
+        </div>
+        <div class="cic-card" style="margin-bottom: 0">
+          <h2>
+            Our customer
+            @if (!alert.clientId) {
+              <button
+                class="cic-btn sm primary"
+                (click)="linkCustomer()"
+                [disabled]="saving"
+                *mifosxHasPermission="'UPDATE_CICALERT'"
+              >
+                Link to customer
+              </button>
+            }
+          </h2>
+          <dl class="cic-kv" style="grid-template-columns: 140px minmax(0, 1fr)">
+            <dt>Customer</dt>
+            <dd>
+              @if (alert.clientId) {
+                <a [routerLink]="['/clients', alert.clientId, 'general']" (click)="closed.emit()">{{
+                  alert.clientName
+                }}</a>
+                <span class="muted"> · {{ alert.clientAccountNo }}</span>
+              } @else {
+                <span class="tone-bad">Not matched to any customer</span>
+              }
+            </dd>
+            <dt>Branch</dt>
+            <dd>{{ alert.officeName || '—' }}</dd>
+            <dt>Matched by</dt>
+            <dd>{{ matchLabels[alert.matchType] || alert.matchType }}</dd>
+            <dt>Name at bureau</dt>
+            <dd>{{ alert.customerName || '—' }}</dd>
+            <dt>PAN / Aadhaar</dt>
+            <dd class="cic-mono">{{ alert.panMasked || '—' }} / {{ alert.aadhaarMasked || '—' }}</dd>
+            @if (alert.customerRef) {
+              <dt>Reference</dt>
+              <dd class="cic-mono">{{ alert.customerRef }}</dd>
+            }
+          </dl>
+        </div>
+      </div>
+
+      @if (alert.clientId) {
+        <div class="cic-card" style="margin-top: 14px; margin-bottom: 0">
+          <h2>
+            Customer's loans with us
+            <span class="cic-card-sub">outstanding ₹{{ exposure | number: '1.0-0' }}</span>
+          </h2>
+          @if (alert.clientLoans?.length) {
+            <div class="cic-table-wrap">
+              <table class="cic-table">
+                <thead>
+                  <tr>
+                    <th>Account</th>
+                    <th>Product</th>
+                    <th>Status</th>
+                    <th class="num">Principal</th>
+                    <th class="num">Outstanding</th>
+                    <th>Disbursed</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  @for (l of alert.clientLoans; track l.id) {
+                    <tr>
+                      <td class="cic-mono">{{ l.accountNo }}</td>
+                      <td>{{ l.productName }}</td>
+                      <td>{{ l.status }}</td>
+                      <td class="num">{{ l.principal | number: '1.0-0' }}</td>
+                      <td class="num">{{ l.outstanding | number: '1.0-0' }}</td>
+                      <td>{{ l.disbursedOn | date: 'dd MMM yyyy' }}</td>
+                    </tr>
+                  }
+                </tbody>
+              </table>
+            </div>
+          } @else {
+            <div class="muted" style="font-size: 13px">
+              No loan with us. A customer with deposits only who is borrowing elsewhere may be a cross-sell opportunity.
+            </div>
+          }
+        </div>
+      }
+
+      @if (alert.otherAlertsOfCustomer?.length) {
+        <div class="cic-card" style="margin-top: 14px; margin-bottom: 0">
+          <h2>
+            Other enquiries on this customer
+            <span class="cic-card-sub">{{ alert.otherAlertsOfCustomer?.length }} more</span>
+          </h2>
+          <div class="cic-table-wrap">
+            <table class="cic-table">
+              <thead>
+                <tr>
+                  <th>Date</th>
+                  <th>Loan type</th>
+                  <th class="num">Amount</th>
+                  <th>Status</th>
+                </tr>
+              </thead>
+              <tbody>
+                @for (o of alert.otherAlertsOfCustomer; track o.id) {
+                  <tr class="clickable" (click)="alertId = o.id; load()">
+                    <td>{{ o.enquiryDate | date: 'dd MMM yyyy' }}</td>
+                    <td>{{ o.loanType }}</td>
+                    <td class="num">{{ o.amount | number: '1.0-0' }}</td>
+                    <td>
+                      <span class="cic-badge" [class]="'cic-badge ' + statusTone(o.status)">{{ o.status }}</span>
+                    </td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </div>
+        </div>
+      }
+
+      @if (alert.remarks || alert.actionedByName) {
+        <div class="cic-alert info" style="margin-top: 14px">
+          <b>{{ alert.status }}</b> by {{ alert.actionedByName }} on {{ alert.actionedOn | slice: 0 : 16 }}
+          @if (alert.remarks) {
+            — {{ alert.remarks }}
+          }
+        </div>
+      }
+
+      <ng-container *mifosxHasPermission="'UPDATE_CICALERT'">
+        @if (action) {
+          <div class="cic-field" style="margin-top: 14px">
+            <label>{{ action === 'ACTIONED' ? 'What was done' : 'Reason for dismissing' }}</label>
+            <textarea rows="3" [(ngModel)]="remarks" maxlength="1000"></textarea>
+          </div>
+        }
+        <div class="foot">
+          @if (action) {
+            <button class="cic-btn" (click)="action = null">Cancel</button>
+            <button class="cic-btn primary" (click)="confirmAction()" [disabled]="saving">
+              {{ action === 'ACTIONED' ? 'Save as actioned' : 'Dismiss alert' }}
+            </button>
+          } @else {
+            @if (alert.status === 'ACTIONED' || alert.status === 'DISMISSED') {
+              <button class="cic-btn" (click)="setStatus('SEEN', null)" [disabled]="saving">Reopen</button>
+            }
+            @if (alert.status !== 'DISMISSED') {
+              <button class="cic-btn danger" (click)="action = 'DISMISSED'">Dismiss</button>
+            }
+            @if (alert.status !== 'ACTIONED') {
+              <button class="cic-btn primary" (click)="action = 'ACTIONED'">Mark actioned</button>
+            }
+          }
+        </div>
+      </ng-container>
+
+      <div style="margin-top: 12px">
+        <button class="cic-btn sm" (click)="showRaw = !showRaw">{{ showRaw ? 'Hide' : 'Show' }} bureau data</button>
+        @if (showRaw) {
+          <pre class="cic-code" style="margin-top: 8px">{{ rawText() }}</pre>
+        }
+      </div>
+    }
+  </div>
+</div>

src/app/credit-bureau/cic-alert-detail/cic-alert-detail.component.ts

@@ -0,0 +1,149 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, EventEmitter, Input, OnChanges, Output, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { MatDialog, MatDialogModule } from '@angular/material/dialog';
+import { RouterModule } from '@angular/router';
+
+import { HasPermissionDirective } from 'app/directives/has-permission/has-permission.directive';
+import {
+  CustomerSearchDialogComponent,
+  CustomerSearchResult
+} from 'app/shared/customer-search-dialog/customer-search-dialog.component';
+import { CIC_MATCH_LABELS, CicAlert, CicService, cicError, cicStatusTone } from '../cic.service';
+
+/**
+ * One enquiry alert: which of our customers applied elsewhere (the CIC does not name the lender), for what loan and
+ * how much; the customer's
+ * loans with us and earlier alerts; and the follow-up (seen / actioned / dismissed, or linking an unmatched alert).
+ */
+@Component({
+  selector: 'mifosx-cic-alert-detail',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    MatDialogModule,
+    HasPermissionDirective
+  ],
+  templateUrl: './cic-alert-detail.component.html',
+  styleUrls: ['../cic-shared.scss']
+})
+export class CicAlertDetailComponent implements OnChanges {
+  private cic = inject(CicService);
+  private dialog = inject(MatDialog);
+
+  @Input() alertId: number | null = null;
+  @Output() closed = new EventEmitter<void>();
+  @Output() changed = new EventEmitter<CicAlert>();
+
+  alert: CicAlert | null = null;
+  loading = false;
+  saving = false;
+  error: string | null = null;
+  info: string | null = null;
+  showRaw = false;
+
+  action: 'ACTIONED' | 'DISMISSED' | null = null;
+  remarks = '';
+
+  readonly matchLabels = CIC_MATCH_LABELS;
+  readonly statusTone = cicStatusTone;
+
+  ngOnChanges(): void {
+    if (this.alertId) this.load();
+  }
+
+  load(): void {
+    if (!this.alertId) return;
+    this.loading = true;
+    this.error = null;
+    this.info = null;
+    this.action = null;
+    this.remarks = '';
+    this.cic.alert(this.alertId).subscribe({
+      next: (a) => {
+        this.alert = a;
+        this.loading = false;
+        // Opening a new alert is seeing it.
+        if (a.status === 'NEW' && a.clientId) this.setStatus('SEEN', null, true);
+      },
+      error: (e) => {
+        this.loading = false;
+        this.error = cicError(e, 'Could not load the alert.');
+      }
+    });
+  }
+
+  setStatus(status: string, remarks: string | null, quiet = false): void {
+    if (!this.alert) return;
+    this.saving = true;
+    this.error = null;
+    this.cic.updateStatus(this.alert.id, status, remarks).subscribe({
+      next: (a) => {
+        this.saving = false;
+        this.alert = a;
+        this.action = null;
+        this.remarks = '';
+        if (!quiet) this.info = `Alert marked ${status.toLowerCase()}.`;
+        this.changed.emit(a);
+      },
+      error: (e) => {
+        this.saving = false;
+        // A user without UPDATE_CICALERT can still read; the automatic "seen" is then simply skipped.
+        if (!quiet) this.error = cicError(e, 'Could not update the alert.');
+      }
+    });
+  }
+
+  confirmAction(): void {
+    if (!this.action) return;
+    if (!this.remarks.trim()) {
+      this.error =
+        this.action === 'ACTIONED'
+          ? 'Write what was done (customer contacted, retention offer made, limit reviewed ...).'
+          : 'Write why the alert is dismissed.';
+      return;
+    }
+    this.setStatus(this.action, this.remarks.trim());
+  }
+
+  linkCustomer(): void {
+    if (!this.alert) return;
+    this.dialog
+      .open(CustomerSearchDialogComponent, { width: '960px', maxWidth: '95vw', data: { requireAccount: false } })
+      .afterClosed()
+      .subscribe((r: CustomerSearchResult | undefined) => {
+        if (!r?.clientId || !this.alert) return;
+        this.saving = true;
+        this.cic.linkClient(this.alert.id, r.clientId).subscribe({
+          next: (a) => {
+            this.saving = false;
+            this.alert = a;
+            this.info = `Alert linked to ${a.clientName}.`;
+            this.changed.emit(a);
+          },
+          error: (e) => {
+            this.saving = false;
+            this.error = cicError(e, 'Could not link the customer.');
+          }
+        });
+      });
+  }
+
+  get exposure(): number {
+    return (this.alert?.clientLoans ?? []).reduce((s, l) => s + Number(l.outstanding ?? 0), 0);
+  }
+
+  rawText(): string {
+    return JSON.stringify(this.alert?.raw ?? {}, null, 2);
+  }
+}

src/app/credit-bureau/cic-api-mapping/cic-api-mapping.component.html

@@ -0,0 +1,489 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>CIC API Mapping — Enquiry Alerts</h1>
+      <p>
+        How the CBS asks each bureau for enquiry alerts, and how the bureau's answer is read into our alerts (customer,
+        loan type, amount, enquiry date …) — no code change needed.
+      </p>
+    </div>
+    <div class="cic-actions">
+      <a class="cic-btn" routerLink="/credit-bureau/dashboard">← Dashboard</a>
+      <a class="cic-btn" routerLink="/credit-bureau/bureaus">CIC Configuration</a>
+      <button
+        class="cic-btn primary"
+        (click)="save()"
+        [disabled]="saving || !endpoint"
+        *mifosxHasPermission="'UPDATE_CICBUREAU'"
+      >
+        {{ saving ? 'Saving…' : dirty ? 'Save changes' : 'Save' }}
+      </button>
+    </div>
+  </div>
+
+  <div class="cic-card">
+    <div class="cic-grid cols-3" style="align-items: end">
+      <div class="cic-field">
+        <label>Bureau</label>
+        <select [(ngModel)]="bureauId" (ngModelChange)="load()">
+          @for (b of bureaus; track b.id) {
+            <option [ngValue]="b.id">{{ b.code }} — {{ b.name }}</option>
+          }
+        </select>
+      </div>
+      <div class="cic-field">
+        <label>API</label>
+        <select [(ngModel)]="endpointType" (ngModelChange)="load()">
+          @for (t of catalog?.endpointTypes ?? []; track t) {
+            <option [value]="t">
+              {{ t === 'ENQUIRY_ALERT' ? 'Enquiry alerts (our customer enquired elsewhere)' : t }}
+            </option>
+          }
+        </select>
+      </div>
+      <div>
+        @if (bureau) {
+          <span
+            class="cic-badge"
+            [class.warn]="bureau.environment === 'SIMULATOR'"
+            [class.good]="bureau.environment === 'PRODUCTION'"
+            >{{ bureau.environment }}</span
+          >
+          <span class="cic-badge" [class.good]="bureau.whitelisted">{{
+            bureau.whitelisted ? 'Whitelisted' : 'Not whitelisted'
+          }}</span>
+          @if (endpoint && !endpoint.exists) {
+            <span class="cic-badge warn">Not configured yet</span>
+          }
+          @if (dirty) {
+            <span class="cic-badge warn">Unsaved changes</span>
+          }
+        }
+      </div>
+    </div>
+  </div>
+
+  @if (error) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+  @if (info) {
+    <div class="cic-alert success">{{ info }}</div>
+  }
+  @if (bureau?.environment === 'SIMULATOR') {
+    <div class="cic-alert info">
+      In SIMULATOR mode the built-in test bureau answers in the shape of the seeded generic mapping. When moving to the
+      bureau's UAT / PRODUCTION, change the paths below to the bureau's own API specification and check them with Test
+      Response.
+    </div>
+  }
+
+  @if (loading) {
+    <div class="cic-card cic-empty">Loading…</div>
+  }
+
+  @if (endpoint && !loading) {
+    <div class="cic-tabs">
+      <button [class.active]="tab === 'response'" (click)="tab = 'response'">
+        Response mapping ({{ responseRows.length }})
+      </button>
+      <button [class.active]="tab === 'request'" (click)="tab = 'request'">
+        Request mapping ({{ requestRows.length }})
+      </button>
+      <button [class.active]="tab === 'endpoint'" (click)="tab = 'endpoint'">Endpoint, headers &amp; body</button>
+      <button [class.active]="tab === 'test'" (click)="tab = 'test'">Test response</button>
+      <button [class.active]="tab === 'preview'" (click)="tab = 'preview'">Preview request</button>
+    </div>
+
+    <!-- RESPONSE -->
+    @if (tab === 'response') {
+      <div class="cic-card">
+        <h2>
+          Bureau response → CBS alert
+          <span class="cic-card-sub"
+            >"alerts", "errorCode" and "errorMessage" are read from the whole response; every other field from each
+            alert</span
+          >
+        </h2>
+        <div class="cic-table-wrap">
+          <table class="cic-table">
+            <thead>
+              <tr>
+                <th style="width: 34px">#</th>
+                <th style="min-width: 240px">Bureau response JSON path</th>
+                <th style="min-width: 220px">CBS alert field</th>
+                <th style="min-width: 150px">Transform</th>
+                <th style="min-width: 110px">Default</th>
+                <th style="width: 110px"></th>
+              </tr>
+            </thead>
+            <tbody>
+              @for (r of responseRows; track $index; let i = $index) {
+                <tr>
+                  <td class="muted">{{ i + 1 }}</td>
+                  <td>
+                    <input
+                      class="cic-mono"
+                      [(ngModel)]="r.sourceField"
+                      (ngModelChange)="markDirty()"
+                      [placeholder]="isRoot(r.targetField) ? 'data.alerts' : 'enquiry.amount'"
+                    />
+                  </td>
+                  <td>
+                    <input
+                      class="cic-mono"
+                      [(ngModel)]="r.targetField"
+                      (ngModelChange)="markDirty()"
+                      list="cic-result-fields"
+                      placeholder="amount"
+                    />
+                    <div class="muted" style="font-size: 10px">
+                      {{ isRoot(r.targetField) ? 'whole response' : 'each alert' }}
+                    </div>
+                  </td>
+                  <td>
+                    <select [(ngModel)]="r.transform" (ngModelChange)="markDirty()">
+                      @for (t of transformList; track t.key) {
+                        <option [value]="t.key">{{ t.label }}</option>
+                      }
+                    </select>
+                  </td>
+                  <td><input [(ngModel)]="r.defaultValue" (ngModelChange)="markDirty()" /></td>
+                  <td style="white-space: nowrap">
+                    <button class="cic-btn sm" (click)="move('response', i, -1)" [disabled]="i === 0">↑</button>
+                    <button
+                      class="cic-btn sm"
+                      (click)="move('response', i, 1)"
+                      [disabled]="i === responseRows.length - 1"
+                    >
+                      ↓
+                    </button>
+                    <button class="cic-btn sm danger" (click)="removeRow('response', i)">✕</button>
+                  </td>
+                </tr>
+              }
+            </tbody>
+          </table>
+        </div>
+        <datalist id="cic-result-fields">
+          @for (f of resultFieldList; track f.key) {
+            <option [value]="f.key">{{ f.label }}</option>
+          }
+        </datalist>
+        <div class="cic-actions" style="margin-top: 12px">
+          <button class="cic-btn" (click)="addRow('response')">+ Add response field</button>
+          <span class="muted" style="font-size: 12px">
+            For dates the transform names the format the bureau sends (e.g. Date ddMMyyyy). The customer is matched by
+            PAN, then Aadhaar (with date of birth or name), then our customer reference.
+          </span>
+        </div>
+        <div class="cic-grid cols-3" style="margin-top: 14px">
+          @for (f of resultFieldList; track f.key) {
+            <div style="font-size: 12px">
+              <code>{{ f.key }}</code> <span class="muted">— {{ f.label }}</span>
+            </div>
+          }
+        </div>
+      </div>
+    }
+
+    <!-- REQUEST -->
+    @if (tab === 'request') {
+      <div class="cic-card">
+        <h2>
+          CBS value → bureau request
+          <span class="cic-card-sub"
+            >Paths like <code>criteria.fromDate</code> build nested JSON; <code>[0]</code> builds arrays</span
+          >
+        </h2>
+        <div class="cic-table-wrap">
+          <table class="cic-table">
+            <thead>
+              <tr>
+                <th style="width: 34px">#</th>
+                <th style="min-width: 220px">CBS value</th>
+                <th style="min-width: 220px">Bureau JSON path</th>
+                <th style="min-width: 160px">Transform</th>
+                <th style="min-width: 120px">Fixed / default value</th>
+                <th>Mandatory</th>
+                <th style="width: 110px"></th>
+              </tr>
+            </thead>
+            <tbody>
+              @for (r of requestRows; track $index; let i = $index) {
+                <tr>
+                  <td class="muted">{{ i + 1 }}</td>
+                  <td>
+                    <select [(ngModel)]="r.sourceField" (ngModelChange)="markDirty()">
+                      <option [ngValue]="null">— fixed value —</option>
+                      @for (f of cbsFieldList; track f.key) {
+                        <option [ngValue]="f.key">{{ f.label }}</option>
+                      }
+                    </select>
+                  </td>
+                  <td>
+                    <input
+                      class="cic-mono"
+                      [(ngModel)]="r.targetField"
+                      (ngModelChange)="markDirty()"
+                      placeholder="criteria.fromDate"
+                    />
+                  </td>
+                  <td>
+                    <select [(ngModel)]="r.transform" (ngModelChange)="markDirty()">
+                      @for (t of transformList; track t.key) {
+                        <option [value]="t.key">{{ t.label }}</option>
+                      }
+                    </select>
+                  </td>
+                  <td>
+                    <input
+                      [(ngModel)]="r.defaultValue"
+                      (ngModelChange)="markDirty()"
+                      [placeholder]="r.sourceField ? 'if empty' : 'value'"
+                    />
+                  </td>
+                  <td style="text-align: center">
+                    <input
+                      type="checkbox"
+                      [(ngModel)]="r.mandatory"
+                      (ngModelChange)="markDirty()"
+                      style="width: auto"
+                    />
+                  </td>
+                  <td style="white-space: nowrap">
+                    <button class="cic-btn sm" (click)="move('request', i, -1)" [disabled]="i === 0" title="Move up">
+                      ↑
+                    </button>
+                    <button
+                      class="cic-btn sm"
+                      (click)="move('request', i, 1)"
+                      [disabled]="i === requestRows.length - 1"
+                      title="Move down"
+                    >
+                      ↓
+                    </button>
+                    <button class="cic-btn sm danger" (click)="removeRow('request', i)" title="Remove">✕</button>
+                  </td>
+                </tr>
+              }
+            </tbody>
+          </table>
+        </div>
+        <div class="cic-actions" style="margin-top: 12px">
+          <button class="cic-btn" (click)="addRow('request')">+ Add request field</button>
+          <span class="muted" style="font-size: 12px"
+            >A mandatory value that is empty stops the fetch before the bureau is called.</span
+          >
+        </div>
+      </div>
+    }
+
+    <!-- ENDPOINT -->
+    @if (tab === 'endpoint') {
+      <div class="cic-card">
+        <h2>Endpoint</h2>
+        <div class="cic-grid cols-4">
+          <div class="cic-field">
+            <label>HTTP method</label>
+            <select [(ngModel)]="endpoint.httpMethod" (ngModelChange)="markDirty()">
+              @for (m of catalog?.httpMethods ?? []; track m) {
+                <option [value]="m">{{ m }}</option>
+              }
+            </select>
+          </div>
+          <div class="cic-field" style="grid-column: span 2">
+            <label>Path (appended to the bureau's base URL)</label>
+            <input
+              class="cic-mono"
+              [(ngModel)]="endpoint.path"
+              (ngModelChange)="markDirty()"
+              placeholder="/monitoring/enquiry-alerts"
+            />
+          </div>
+          <div class="cic-field">
+            <label>Content type</label>
+            <input class="cic-mono" [(ngModel)]="endpoint.contentType" (ngModelChange)="markDirty()" />
+          </div>
+        </div>
+        <label style="display: flex; gap: 8px; align-items: center; font-size: 13px; margin-top: 12px">
+          <input type="checkbox" [(ngModel)]="endpoint.isActive" (ngModelChange)="markDirty()" /> Endpoint active
+        </label>
+        <div class="cic-grid cols-2" style="margin-top: 14px">
+          <div class="cic-field">
+            <label>Static headers (JSON object)</label>
+            <textarea
+              class="cic-mono"
+              rows="10"
+              [(ngModel)]="endpoint.headersJson"
+              (ngModelChange)="markDirty()"
+            ></textarea>
+            <span class="hint"
+              >Placeholders like <code>{{ '{{' }}bureau.memberCode{{ '}}' }}</code> or
+              <code>{{ '{{' }}fetch.reference{{ '}}' }}</code> are filled in. Authentication headers are added
+              automatically.</span
+            >
+            @if (jsonErrors.headers) {
+              <span class="tone-bad" style="font-size: 12px">{{ jsonErrors.headers }}</span>
+            }
+          </div>
+          <div class="cic-field">
+            <label>Base request body (JSON object)</label>
+            <textarea
+              class="cic-mono"
+              rows="10"
+              [(ngModel)]="endpoint.baseBody"
+              (ngModelChange)="markDirty()"
+            ></textarea>
+            <span class="hint">Constant parts of the request; request mappings are written into it.</span>
+            @if (jsonErrors.body) {
+              <span class="tone-bad" style="font-size: 12px">{{ jsonErrors.body }}</span>
+            }
+          </div>
+        </div>
+      </div>
+    }
+
+    <!-- TEST RESPONSE -->
+    @if (tab === 'test') {
+      <div class="cic-card">
+        <h2>
+          Test response
+          <span class="cic-card-sub"
+            >reads a bureau answer through the saved response mapping and matches customers — nothing is saved</span
+          >
+        </h2>
+        <div class="cic-field">
+          <label
+            >Bureau response (JSON) — paste a sample from the bureau's specification, or leave empty for a simulator
+            sample</label
+          >
+          <textarea class="cic-mono" rows="12" [(ngModel)]="sampleText"></textarea>
+        </div>
+        <div class="cic-actions" style="margin-top: 12px">
+          <button class="cic-btn primary" (click)="runTest()" [disabled]="testing">
+            {{ testing ? 'Reading…' : 'Read through mapping' }}
+          </button>
+          <button class="cic-btn" (click)="sampleText = ''; testResult = null">Clear</button>
+        </div>
+      </div>
+      @if (testResult) {
+        @if (testResult.errorCode) {
+          <div class="cic-alert error">Bureau error {{ testResult.errorCode }}: {{ testResult.errorMessage }}</div>
+        }
+        @if (!testResult.alertListFound) {
+          <div class="cic-alert warn">
+            No alert list was found at the path mapped to "alerts". Check that row of the response mapping.
+          </div>
+        }
+        <div class="cic-card">
+          <h2>{{ testResult.count }} alert(s) read</h2>
+          @if (testResult.items?.length) {
+            <div class="cic-table-wrap">
+              <table class="cic-table">
+                <thead>
+                  <tr>
+                    <th>Alert id</th>
+                    <th>Customer (bureau)</th>
+                    <th>PAN</th>
+                    <th>Date</th>
+                    <th>Loan type</th>
+                    <th class="num">Amount</th>
+                    <th>Match</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  @for (it of testResult.items; track $index) {
+                    <tr>
+                      <td class="cic-mono">{{ it.alertRef }}</td>
+                      <td>{{ it.customerName }}</td>
+                      <td class="cic-mono">{{ it.pan || it.aadhaar || it.customerRef }}</td>
+                      <td>{{ it.enquiryDate }}</td>
+                      <td>{{ it.loanType }}</td>
+                      <td class="num">{{ it.amount | number: '1.0-0' }}</td>
+                      <td>
+                        @if (it.ownBank) {
+                          <span class="cic-badge">Own bank — skipped</span>
+                        } @else if (it.clientId) {
+                          <span class="cic-badge good">{{ matchLabels[it.matchType] }}</span> {{ it.clientName }}
+                        } @else {
+                          <span class="cic-badge bad">Not matched</span>
+                        }
+                      </td>
+                    </tr>
+                  }
+                </tbody>
+              </table>
+            </div>
+          }
+        </div>
+      }
+    }
+
+    <!-- PREVIEW -->
+    @if (tab === 'preview') {
+      <div class="cic-card">
+        <h2>Preview <span class="cic-card-sub">builds the request from the saved mapping — nothing is sent</span></h2>
+        <div class="cic-grid cols-4" style="align-items: end">
+          <div class="cic-field">
+            <label>Alerts from</label>
+            <input type="date" [(ngModel)]="previewFrom" />
+          </div>
+          <div class="cic-field">
+            <label>Alerts to</label>
+            <input type="date" [(ngModel)]="previewTo" />
+          </div>
+          <div class="muted" style="font-size: 12px; grid-column: span 2">
+            Empty = the bureau's look-back window up to today.
+          </div>
+        </div>
+        <button class="cic-btn primary" style="margin-top: 12px" (click)="runPreview()" [disabled]="previewing">
+          {{ previewing ? 'Building…' : 'Build preview' }}
+        </button>
+      </div>
+
+      @if (previewResult) {
+        @if (previewResult.missingMandatory?.length) {
+          <div class="cic-alert error">
+            The fetch would be refused — mandatory values are empty:
+            <ul>
+              @for (m of previewResult.missingMandatory; track m) {
+                <li>{{ m }}</li>
+              }
+            </ul>
+          </div>
+        }
+        <div class="cic-split">
+          <div class="cic-card">
+            <h2>Request body</h2>
+            <pre class="cic-code">{{ prettyJson(previewResult.body) }}</pre>
+          </div>
+          <div class="cic-card">
+            <h2>Call</h2>
+            <dl class="cic-kv" style="grid-template-columns: 120px minmax(0, 1fr)">
+              <dt>Method</dt>
+              <dd>{{ previewResult.method }}</dd>
+              <dt>URL</dt>
+              <dd class="cic-mono">{{ previewResult.url }}</dd>
+              <dt>Window</dt>
+              <dd>{{ previewResult.fromDate }} → {{ previewResult.toDate }}</dd>
+              <dt>Auth</dt>
+              <dd>{{ previewResult.authentication }}</dd>
+              @for (h of headerEntries(previewResult.headers); track h.k) {
+                <dt class="cic-mono">{{ h.k }}</dt>
+                <dd class="cic-mono">{{ h.v }}</dd>
+              }
+            </dl>
+          </div>
+        </div>
+      }
+    }
+  }
+</div>

src/app/credit-bureau/cic-api-mapping/cic-api-mapping.component.ts

@@ -0,0 +1,310 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { ActivatedRoute, RouterModule } from '@angular/router';
+
+import { HasPermissionDirective } from 'app/directives/has-permission/has-permission.directive';
+import { CIC_MATCH_LABELS, CicBureau, CicCatalog, CicEndpoint, CicMapping, CicService, cicError } from '../cic.service';
+
+/**
+ * The per-bureau API mapping of the enquiry-alert call, maintained from the UI: endpoint (method, path, headers, base
+ * body), REQUEST rows that put the fetch window and the bank's identity into the bureau's request, and RESPONSE rows
+ * that read the bureau's alert list and each alert's fields (customer, lender, loan type, amount ...). A dry-run
+ * preview shows the request; Test Response reads a sample answer through the mapping without saving anything.
+ */
+@Component({
+  selector: 'mifosx-cic-api-mapping',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    HasPermissionDirective
+  ],
+  templateUrl: './cic-api-mapping.component.html',
+  styleUrls: ['../cic-shared.scss']
+})
+export class CicApiMappingComponent implements OnInit {
+  private cic = inject(CicService);
+  private route = inject(ActivatedRoute);
+
+  catalog: CicCatalog | null = null;
+  bureaus: CicBureau[] = [];
+  bureauId: number | null = null;
+  endpointType = 'ENQUIRY_ALERT';
+
+  endpoint: CicEndpoint | null = null;
+  requestRows: CicMapping[] = [];
+  responseRows: CicMapping[] = [];
+  tab: 'request' | 'response' | 'endpoint' | 'preview' | 'test' = 'response';
+
+  loading = false;
+  saving = false;
+  dirty = false;
+  error: string | null = null;
+  info: string | null = null;
+  jsonErrors: { headers?: string; body?: string } = {};
+
+  // preview
+  previewFrom = '';
+  previewTo = '';
+  previewResult: any = null;
+  previewing = false;
+
+  // test response
+  sampleText = '';
+  testResult: any = null;
+  testing = false;
+
+  cbsFieldList: { key: string; label: string }[] = [];
+  resultFieldList: { key: string; label: string }[] = [];
+  transformList: { key: string; label: string }[] = [];
+
+  readonly matchLabels = CIC_MATCH_LABELS;
+
+  ngOnInit(): void {
+    this.cic.catalog().subscribe({
+      next: (c) => {
+        this.catalog = c;
+        this.cbsFieldList = Object.entries(c.cbsFields).map(
+          ([
+            key,
+            label
+          ]) => ({ key, label })
+        );
+        this.resultFieldList = Object.entries(c.resultFields).map(
+          ([
+            key,
+            label
+          ]) => ({ key, label })
+        );
+        this.transformList = Object.entries(c.transforms).map(
+          ([
+            key,
+            label
+          ]) => ({ key, label })
+        );
+      },
+      error: (e) => (this.error = cicError(e))
+    });
+    this.cic.bureaus().subscribe({
+      next: (b) => {
+        this.bureaus = b;
+        const wanted = Number(this.route.snapshot.queryParamMap.get('bureauId'));
+        this.bureauId = b.find((x) => x.id === wanted)?.id ?? b[0]?.id ?? null;
+        this.load();
+      },
+      error: (e) => (this.error = cicError(e, 'Could not load the bureaus.'))
+    });
+  }
+
+  get bureau(): CicBureau | undefined {
+    return this.bureaus.find((b) => b.id === this.bureauId);
+  }
+
+  isRoot(target: string): boolean {
+    return (this.catalog?.rootFields ?? []).includes(target);
+  }
+
+  load(): void {
+    if (!this.bureauId) return;
+    if (this.dirty && !confirm('Discard unsaved mapping changes?')) return;
+    this.loading = true;
+    this.error = null;
+    this.info = null;
+    this.previewResult = null;
+    this.testResult = null;
+    this.cic.endpoint(this.bureauId, this.endpointType).subscribe({
+      next: (e) => {
+        this.apply(e);
+        this.loading = false;
+      },
+      error: (err) => {
+        this.loading = false;
+        this.error = cicError(err, 'Could not load the mapping.');
+      }
+    });
+  }
+
+  private apply(e: CicEndpoint): void {
+    this.endpoint = { ...e, headersJson: this.prettyJson(e.headersJson), baseBody: this.prettyJson(e.baseBody) };
+    this.requestRows = e.requestMappings.map((m) => ({ ...m }));
+    this.responseRows = e.responseMappings.map((m) => ({ ...m }));
+    this.dirty = false;
+    this.jsonErrors = {};
+  }
+
+  markDirty(): void {
+    this.dirty = true;
+  }
+
+  addRow(direction: 'request' | 'response'): void {
+    const row: CicMapping = {
+      sourceField: null,
+      targetField: '',
+      transform: 'NONE',
+      defaultValue: null,
+      mandatory: false
+    };
+    (direction === 'request' ? this.requestRows : this.responseRows).push(row);
+    this.dirty = true;
+  }
+
+  removeRow(direction: 'request' | 'response', index: number): void {
+    (direction === 'request' ? this.requestRows : this.responseRows).splice(index, 1);
+    this.dirty = true;
+  }
+
+  move(direction: 'request' | 'response', index: number, delta: number): void {
+    const rows = direction === 'request' ? this.requestRows : this.responseRows;
+    const to = index + delta;
+    if (to < 0 || to >= rows.length) return;
+    [
+      rows[index],
+      rows[to]
+    ] = [
+      rows[to],
+      rows[index]
+    ];
+    this.dirty = true;
+  }
+
+  /** Local checks before the server's own validation. */
+  private validJson(): boolean {
+    this.jsonErrors = {};
+    for (const [
+      key,
+      text
+    ] of [
+      [
+        'headers',
+        this.endpoint?.headersJson
+      ],
+      [
+        'body',
+        this.endpoint?.baseBody
+      ]
+    ] as const) {
+      try {
+        const parsed = JSON.parse(text || '{}');
+        if (typeof parsed !== 'object' || Array.isArray(parsed) || parsed === null)
+          throw new Error('must be a JSON object');
+      } catch (e: any) {
+        this.jsonErrors[key] = `Not a valid JSON object: ${e?.message ?? e}`;
+      }
+    }
+    return !this.jsonErrors.headers && !this.jsonErrors.body;
+  }
+
+  save(): void {
+    if (!this.bureauId || !this.endpoint) return;
+    if (!this.validJson()) {
+      this.tab = 'endpoint';
+      this.error = 'Fix the JSON on the Endpoint tab before saving.';
+      return;
+    }
+    this.saving = true;
+    this.error = null;
+    this.info = null;
+    const clean = (rows: CicMapping[]) =>
+      rows.map((r, i) => ({
+        sourceField: r.sourceField || null,
+        targetField: (r.targetField || '').trim(),
+        transform: r.transform || 'NONE',
+        defaultValue: r.defaultValue === '' ? null : r.defaultValue,
+        mandatory: !!r.mandatory,
+        sortOrder: (i + 1) * 10
+      }));
+    this.cic
+      .saveEndpoint(this.bureauId, this.endpointType, {
+        httpMethod: this.endpoint.httpMethod,
+        path: this.endpoint.path,
+        contentType: this.endpoint.contentType,
+        headersJson: JSON.stringify(JSON.parse(this.endpoint.headersJson || '{}')),
+        baseBody: JSON.stringify(JSON.parse(this.endpoint.baseBody || '{}')),
+        isActive: this.endpoint.isActive,
+        requestMappings: clean(this.requestRows),
+        responseMappings: clean(this.responseRows)
+      })
+      .subscribe({
+        next: (e) => {
+          this.saving = false;
+          this.apply(e);
+          this.info = `${this.bureau?.code} enquiry-alert mapping saved (${this.requestRows.length} request, ${this.responseRows.length} response fields).`;
+        },
+        error: (err) => {
+          this.saving = false;
+          this.error = cicError(err, 'Could not save the mapping.');
+        }
+      });
+  }
+
+  private requireSaved(): boolean {
+    if (this.dirty) {
+      this.error = 'Save the mapping first — preview and test use the saved mapping.';
+      return false;
+    }
+    return true;
+  }
+
+  runPreview(): void {
+    if (!this.bureauId || !this.requireSaved()) return;
+    this.previewing = true;
+    this.error = null;
+    this.cic
+      .preview(this.bureauId, { fromDate: this.previewFrom || undefined, toDate: this.previewTo || undefined })
+      .subscribe({
+        next: (r) => {
+          this.previewing = false;
+          this.previewResult = r;
+        },
+        error: (e) => {
+          this.previewing = false;
+          this.error = cicError(e, 'Preview failed.');
+        }
+      });
+  }
+
+  runTest(): void {
+    if (!this.bureauId || !this.requireSaved()) return;
+    this.testing = true;
+    this.error = null;
+    this.cic.parseTest(this.bureauId, this.sampleText.trim() || null).subscribe({
+      next: (r) => {
+        this.testing = false;
+        this.testResult = r;
+        if (r.sampleResponse && !this.sampleText.trim()) this.sampleText = this.prettyJson(r.sampleResponse);
+      },
+      error: (e) => {
+        this.testing = false;
+        this.error = cicError(e, 'Test failed.');
+      }
+    });
+  }
+
+  prettyJson(text?: string | null): string {
+    if (!text) return '{}';
+    try {
+      return JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+      return text;
+    }
+  }
+
+  headerEntries(h: Record<string, string> | null | undefined): { k: string; v: string }[] {
+    return Object.entries(h ?? {}).map(
+      ([
+        k,
+        v
+      ]) => ({ k, v })
+    );
+  }
+}

src/app/credit-bureau/cic-bureau-config/cic-bureau-config.component.html

@@ -0,0 +1,279 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>CIC Whitelist &amp; Configuration</h1>
+      <p>
+        Choose which Credit Information Companies this bank receives enquiry alerts from, and how each is reached. Only
+        whitelisted bureaus are fetched.
+      </p>
+    </div>
+    <div class="cic-actions">
+      <a class="cic-btn" routerLink="/credit-bureau/dashboard">← Dashboard</a>
+      <a class="cic-btn" routerLink="/credit-bureau/api-mapping">API Mapping</a>
+    </div>
+  </div>
+
+  @if (error) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+  @if (info) {
+    <div class="cic-alert success">{{ info }}</div>
+  }
+
+  @if (loading && !bureaus.length) {
+    <div class="cic-card cic-empty">Loading…</div>
+  }
+
+  <div class="cic-grid cols-2">
+    @for (b of bureaus; track b.id) {
+      <div class="cic-card" style="margin-bottom: 0">
+        <div style="display: flex; justify-content: space-between; gap: 12px; align-items: flex-start">
+          <div style="min-width: 0">
+            <div style="display: flex; gap: 8px; align-items: center; flex-wrap: wrap">
+              <b style="font-size: 16px">{{ b.code }}</b>
+              <span class="cic-badge" [class]="'cic-badge ' + envTone(b.environment)">{{ b.environment }}</span>
+              @if (b.isDefault) {
+                <span class="cic-badge brand">Default</span>
+              }
+            </div>
+            <div class="muted" style="font-size: 12px; margin-top: 3px">{{ b.name }}</div>
+          </div>
+          <label style="display: flex; gap: 8px; align-items: center; font-size: 12px; font-weight: 600">
+            {{ b.whitelisted ? 'Whitelisted' : 'Not whitelisted' }}
+            <span class="cic-switch">
+              <input
+                type="checkbox"
+                [checked]="b.whitelisted"
+                [disabled]="toggling === b.id"
+                (change)="toggle(b, $event)"
+                *mifosxHasPermission="'UPDATE_CICBUREAU'"
+              />
+              <span></span>
+            </span>
+          </label>
+        </div>
+
+        <dl class="cic-kv" style="margin-top: 14px; grid-template-columns: 140px minmax(0, 1fr)">
+          <dt>Base URL</dt>
+          <dd class="cic-mono">{{ b.environment === 'SIMULATOR' ? '(simulator)' : b.baseUrl || '— not set —' }}</dd>
+          <dt>Member code</dt>
+          <dd>{{ b.memberCode || '—' }}</dd>
+          <dt>Authentication</dt>
+          <dd>
+            {{ authLabels[b.authType] || b.authType }}
+            @if (b.authType !== 'NONE') {
+              <span class="cic-badge" [class.good]="b.hasSecret" [class.bad]="!b.hasSecret">{{
+                b.hasSecret ? 'credential stored' : 'no credential'
+              }}</span>
+            }
+          </dd>
+          <dt>Endpoints</dt>
+          <dd>{{ b.activeEndpoints }} active</dd>
+          <dt>Alert fetch</dt>
+          <dd>
+            {{ b.alertAutoFetch ? 'Automatic, every ' + b.alertFetchIntervalMin + ' min' : 'Manual only' }}
+            <span class="muted">· looks back {{ b.alertLookbackDays }} days</span>
+          </dd>
+          <dt>Last fetch</dt>
+          <dd>
+            @if (b.lastFetchOn) {
+              <span
+                class="cic-badge"
+                [class.good]="b.lastFetchStatus === 'SUCCESS'"
+                [class.bad]="b.lastFetchStatus === 'FAILED'"
+                >{{ b.lastFetchStatus }}</span
+              >
+              <span class="muted" style="font-size: 12px"> {{ b.lastFetchOn | slice: 0 : 16 }}</span>
+              <div class="muted" style="font-size: 12px">{{ b.lastFetchMessage }}</div>
+            } @else {
+              <span class="muted">never</span>
+            }
+          </dd>
+          <dt>Last test</dt>
+          <dd>
+            @if (b.lastTestStatus) {
+              <span
+                class="cic-badge"
+                [class.good]="b.lastTestStatus === 'OK'"
+                [class.bad]="b.lastTestStatus !== 'OK'"
+                >{{ b.lastTestStatus }}</span
+              >
+              <span class="muted" style="font-size: 12px"> {{ b.lastTestedOn | slice: 0 : 16 }}</span>
+              <div class="muted" style="font-size: 12px">{{ b.lastTestMessage }}</div>
+            } @else {
+              <span class="muted">never</span>
+            }
+          </dd>
+          <dt>Alerts (30d)</dt>
+          <dd>
+            {{ b.alertsLast30Days }}
+            @if (b.newAlerts) {
+              <span class="cic-badge bad">{{ b.newAlerts }} new</span>
+            }
+          </dd>
+        </dl>
+
+        <div class="cic-actions" style="margin-top: 14px">
+          <button class="cic-btn" (click)="edit(b)" *mifosxHasPermission="'UPDATE_CICBUREAU'">Configure</button>
+          <button
+            class="cic-btn"
+            (click)="test(b)"
+            [disabled]="testing === b.id"
+            *mifosxHasPermission="'UPDATE_CICBUREAU'"
+          >
+            {{ testing === b.id ? 'Testing…' : 'Test Connection' }}
+          </button>
+          @if (b.whitelisted) {
+            <button
+              class="cic-btn"
+              (click)="fetchNow(b)"
+              [disabled]="fetching === b.id"
+              *mifosxHasPermission="'FETCH_CICALERT'"
+            >
+              {{ fetching === b.id ? 'Fetching…' : 'Fetch alerts now' }}
+            </button>
+          }
+          <a class="cic-btn" routerLink="/credit-bureau/api-mapping" [queryParams]="{ bureauId: b.id }">API Mapping</a>
+        </div>
+      </div>
+    }
+  </div>
+
+  <div class="cic-alert info" style="margin-top: 16px">
+    <b>Going live with a bureau:</b> 1) subscribe to the bureau's enquiry-alert (portfolio monitoring) service and get
+    the bank's member code, API URL and credentials; 2) Configure them here (environment UAT first); 3) adapt the
+    request / response fields under API Mapping to the bureau's specification and check them with Preview and Test
+    Response; 4) Test Connection and Fetch alerts now; 5) switch to PRODUCTION and whitelist it. Alerts then arrive
+    automatically.
+  </div>
+
+  @if (editing) {
+    <div class="cic-modal-backdrop" (click)="editing = null">
+      <div class="cic-modal" style="width: min(820px, 100%)" (click)="$event.stopPropagation()">
+        <h3>Configure {{ editing.code }}</h3>
+        <div class="cic-grid cols-2">
+          <div class="cic-field">
+            <label>Display name</label>
+            <input [(ngModel)]="form.name" />
+          </div>
+          <div class="cic-field">
+            <label>Environment</label>
+            <select [(ngModel)]="form.environment">
+              <option value="SIMULATOR">SIMULATOR — built-in test bureau, no network call</option>
+              <option value="UAT">UAT — bureau's test environment</option>
+              <option value="PRODUCTION">PRODUCTION — live bureau</option>
+            </select>
+          </div>
+          <div class="cic-field" style="grid-column: 1 / -1">
+            <label>Base URL</label>
+            <input class="cic-mono" [(ngModel)]="form.baseUrl" placeholder="https://api.bureau.example/v1" />
+            <span class="hint"
+              >Endpoint paths from API Mapping are appended to this. PRODUCTION requires https://.</span
+            >
+          </div>
+          <div class="cic-field">
+            <label>Bank's member code / id</label>
+            <input [(ngModel)]="form.memberCode" />
+          </div>
+          <div class="cic-field">
+            <label>Authentication</label>
+            <select [(ngModel)]="form.authType">
+              @for (a of catalog?.authTypes ?? []; track a) {
+                <option [value]="a">{{ authLabels[a] || a }}</option>
+              }
+            </select>
+          </div>
+          @if (form.authType === 'BASIC') {
+            <div class="cic-field">
+              <label>User id</label>
+              <input [(ngModel)]="form.username" autocomplete="off" />
+            </div>
+          }
+          @if (form.authType === 'API_KEY') {
+            <div class="cic-field">
+              <label>API key header name</label>
+              <input class="cic-mono" [(ngModel)]="form.apiKeyHeader" />
+            </div>
+          }
+          @if (form.authType === 'OAUTH2_CLIENT_CREDENTIALS') {
+            <div class="cic-field">
+              <label>Token URL</label>
+              <input
+                class="cic-mono"
+                [(ngModel)]="form.tokenUrl"
+                placeholder="https://auth.bureau.example/oauth/token"
+              />
+            </div>
+            <div class="cic-field">
+              <label>Client id</label>
+              <input [(ngModel)]="form.clientId" autocomplete="off" />
+            </div>
+          }
+          @if (needsSecret(form.authType)) {
+            <div class="cic-field">
+              <label>{{ secretLabel(form.authType) }}</label>
+              <input
+                type="password"
+                [(ngModel)]="form.secret"
+                autocomplete="new-password"
+                [placeholder]="editing.hasSecret ? '•••••• stored — leave blank to keep' : 'Enter to store (encrypted)'"
+              />
+              @if (editing.hasSecret) {
+                <label style="display: flex; gap: 6px; align-items: center; font-weight: 500; font-size: 12px">
+                  <input type="checkbox" [(ngModel)]="form.clearSecret" style="width: auto" /> Remove the stored
+                  credential
+                </label>
+              }
+            </div>
+          }
+          <div class="cic-field">
+            <label>Timeout (ms)</label>
+            <input type="number" min="1000" max="300000" [(ngModel)]="form.timeoutMs" />
+          </div>
+          <div class="cic-field">
+            <label>Fetch alerts automatically every (minutes)</label>
+            <input
+              type="number"
+              min="15"
+              max="1440"
+              [(ngModel)]="form.alertFetchIntervalMin"
+              [disabled]="!form.alertAutoFetch"
+            />
+            <label style="display: flex; gap: 6px; align-items: center; font-weight: 500; font-size: 12px">
+              <input type="checkbox" [(ngModel)]="form.alertAutoFetch" style="width: auto" /> Fetch automatically
+              (15–1440 min)
+            </label>
+          </div>
+          <div class="cic-field">
+            <label>Look back (days)</label>
+            <input type="number" min="1" max="90" [(ngModel)]="form.alertLookbackDays" />
+            <span class="hint"
+              >Each fetch asks for alerts of this many past days; ones already received are skipped.</span
+            >
+          </div>
+          <div class="cic-field" style="grid-column: 1 / -1">
+            <label>Description</label>
+            <input [(ngModel)]="form.description" />
+          </div>
+          <label style="display: flex; gap: 8px; align-items: center; font-size: 13px">
+            <input type="checkbox" [(ngModel)]="form.isDefault" /> Default bureau (listed first)
+          </label>
+        </div>
+        <div class="foot">
+          <button class="cic-btn" (click)="editing = null">Cancel</button>
+          <button class="cic-btn primary" (click)="save()" [disabled]="saving">
+            {{ saving ? 'Saving…' : 'Save' }}
+          </button>
+        </div>
+      </div>
+    </div>
+  }
+</div>

src/app/credit-bureau/cic-bureau-config/cic-bureau-config.component.ts

@@ -0,0 +1,198 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { RouterModule } from '@angular/router';
+
+import { HasPermissionDirective } from 'app/directives/has-permission/has-permission.directive';
+import { CicBureau, CicCatalog, CicService, cicError } from '../cic.service';
+
+/**
+ * Which CICs the bank receives enquiry alerts from (whitelist), and how each is reached: environment, URL, member
+ * code, authentication and credentials (stored encrypted, never shown back), timeout, and the alert fetch schedule.
+ */
+@Component({
+  selector: 'mifosx-cic-bureau-config',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    HasPermissionDirective
+  ],
+  templateUrl: './cic-bureau-config.component.html',
+  styleUrls: ['../cic-shared.scss']
+})
+export class CicBureauConfigComponent implements OnInit {
+  private cic = inject(CicService);
+
+  catalog: CicCatalog | null = null;
+  bureaus: CicBureau[] = [];
+  loading = false;
+  error: string | null = null;
+  info: string | null = null;
+
+  editing: CicBureau | null = null;
+  form: any = {};
+  saving = false;
+  testing: number | null = null;
+  toggling: number | null = null;
+  fetching: number | null = null;
+
+  readonly authLabels: Record<string, string> = {
+    NONE: 'None (IP whitelisting / mutual TLS)',
+    BASIC: 'Basic (user id + password)',
+    API_KEY: 'API key in a header',
+    BEARER_TOKEN: 'Static bearer token',
+    OAUTH2_CLIENT_CREDENTIALS: 'OAuth2 client credentials'
+  };
+
+  ngOnInit(): void {
+    this.cic.catalog().subscribe({ next: (c) => (this.catalog = c), error: (e) => (this.error = cicError(e)) });
+    this.load();
+  }
+
+  load(): void {
+    this.loading = true;
+    this.cic.bureaus().subscribe({
+      next: (b) => {
+        this.bureaus = b;
+        this.loading = false;
+      },
+      error: (e) => {
+        this.error = cicError(e, 'Could not load the bureaus.');
+        this.loading = false;
+      }
+    });
+  }
+
+  toggle(b: CicBureau, event: Event): void {
+    const target = event.target as HTMLInputElement;
+    const want = target.checked;
+    target.checked = b.whitelisted; // reflect the server's answer, not the click
+    this.error = null;
+    this.info = null;
+    this.toggling = b.id;
+    this.cic.setWhitelisted(b.id, want).subscribe({
+      next: (u) => {
+        this.toggling = null;
+        this.replace(u);
+        this.info = `${u.code} is now ${u.whitelisted ? 'whitelisted — its enquiry alerts will be fetched' : 'not whitelisted'}.`;
+      },
+      error: (e) => {
+        this.toggling = null;
+        this.error = cicError(e, 'Could not change the whitelist.');
+      }
+    });
+  }
+
+  edit(b: CicBureau): void {
+    this.editing = b;
+    this.info = null;
+    this.error = null;
+    this.form = {
+      name: b.name,
+      description: b.description ?? '',
+      environment: b.environment,
+      baseUrl: b.baseUrl ?? '',
+      memberCode: b.memberCode ?? '',
+      authType: b.authType,
+      username: b.username ?? '',
+      apiKeyHeader: b.apiKeyHeader ?? 'X-API-KEY',
+      secret: '',
+      clearSecret: false,
+      tokenUrl: b.tokenUrl ?? '',
+      clientId: b.clientId ?? '',
+      timeoutMs: b.timeoutMs,
+      alertAutoFetch: b.alertAutoFetch,
+      alertFetchIntervalMin: b.alertFetchIntervalMin,
+      alertLookbackDays: b.alertLookbackDays,
+      isDefault: b.isDefault
+    };
+  }
+
+  save(): void {
+    if (!this.editing) return;
+    this.saving = true;
+    this.error = null;
+    const body = { ...this.form };
+    if (!body.secret) delete body.secret;
+    this.cic.updateBureau(this.editing.id, body).subscribe({
+      next: (u) => {
+        this.saving = false;
+        this.editing = null;
+        this.info = `${u.code} configuration saved.`;
+        this.load();
+      },
+      error: (e) => {
+        this.saving = false;
+        this.error = cicError(e, 'Could not save the configuration.');
+      }
+    });
+  }
+
+  test(b: CicBureau): void {
+    this.testing = b.id;
+    this.error = null;
+    this.info = null;
+    this.cic.testConnection(b.id).subscribe({
+      next: (r) => {
+        this.testing = null;
+        if (r.status === 'OK') this.info = `${b.code}: ${r.message}`;
+        else this.error = `${b.code}: ${r.message}`;
+        this.load();
+      },
+      error: (e) => {
+        this.testing = null;
+        this.error = cicError(e, 'Connection test failed.');
+      }
+    });
+  }
+
+  fetchNow(b: CicBureau): void {
+    this.fetching = b.id;
+    this.error = null;
+    this.info = null;
+    this.cic.fetch(b.id).subscribe({
+      next: (r) => {
+        this.fetching = null;
+        if (r.status === 'SUCCESS') this.info = `${b.code}: ${r.message}`;
+        else this.error = `${b.code}: ${r.message}`;
+        this.load();
+      },
+      error: (e) => {
+        this.fetching = null;
+        this.error = cicError(e, 'Fetch failed.');
+      }
+    });
+  }
+
+  needsSecret(auth: string): boolean {
+    return auth !== 'NONE';
+  }
+
+  secretLabel(auth: string): string {
+    return auth === 'BASIC'
+      ? 'Password'
+      : auth === 'API_KEY'
+        ? 'API key'
+        : auth === 'BEARER_TOKEN'
+          ? 'Bearer token'
+          : 'Client secret';
+  }
+
+  envTone(env: string): string {
+    return env === 'PRODUCTION' ? 'good' : env === 'UAT' ? 'ok' : 'warn';
+  }
+
+  private replace(u: CicBureau): void {
+    this.bureaus = this.bureaus.map((b) => (b.id === u.id ? u : b));
+  }
+}

src/app/credit-bureau/cic-dashboard/cic-dashboard.component.html

@@ -0,0 +1,254 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>Credit Bureau — Customer Enquiry Alerts</h1>
+      <p>
+        Our customers who applied for a loan at another bank or NBFC, as reported by the CIC (CIBIL, Experian, Equifax,
+        CRIF): what loan and how much. The CIC does not tell which bank or lender it was.
+      </p>
+    </div>
+    <div class="cic-actions">
+      <select [(ngModel)]="days" (ngModelChange)="load()" class="cic-btn" style="padding-right: 8px">
+        <option [ngValue]="7">Last 7 days</option>
+        <option [ngValue]="30">Last 30 days</option>
+        <option [ngValue]="90">Last 90 days</option>
+        <option [ngValue]="180">Last 180 days</option>
+      </select>
+      <a class="cic-btn" routerLink="/credit-bureau/fetch-log">Fetch log</a>
+      @if (whitelisted.length) {
+        <button
+          class="cic-btn primary"
+          (click)="fetchNow('ALL')"
+          [disabled]="fetching !== null"
+          *mifosxHasPermission="'FETCH_CICALERT'"
+        >
+          {{ fetching === 'ALL' ? 'Fetching…' : 'Fetch alerts now' }}
+        </button>
+      }
+    </div>
+  </div>
+
+  @if (error) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+  @if (info) {
+    <div class="cic-alert success">{{ info }}</div>
+  }
+  @if (data && !whitelisted.length) {
+    <div class="cic-alert warn">
+      No CIC is whitelisted yet, so no alerts are being received. Whitelist a bureau from the AI / Intelligence Modules
+      menu → API Management → CIC Whitelist &amp; Configuration.
+    </div>
+  }
+  @if (loading && !data) {
+    <div class="cic-card cic-empty">Loading…</div>
+  }
+
+  @if (data) {
+    <div class="cic-grid cols-4" style="margin-bottom: 16px">
+      <div class="cic-stat">
+        <div class="k">New alerts</div>
+        <div class="v" [class.tone-bad]="data.newAlerts > 0">{{ data.newAlerts }}</div>
+        <div class="s">not yet looked at</div>
+      </div>
+      <div class="cic-stat">
+        <div class="k">Customers enquired elsewhere</div>
+        <div class="v">{{ data.customersInPeriod }}</div>
+        <div class="s">{{ data.alertsInPeriod }} enquiries · last {{ days }} days</div>
+      </div>
+      <div class="cic-stat">
+        <div class="k">Amount applied elsewhere</div>
+        <div class="v">₹{{ data.amountInPeriod | number: '1.0-0' }}</div>
+        <div class="s">in total · last {{ days }} days</div>
+      </div>
+      <div class="cic-stat">
+        <div class="k">Unmatched alerts</div>
+        <div class="v" [class.tone-warn]="data.unmatchedOpen > 0">{{ data.unmatchedOpen }}</div>
+        <div class="s">bureau sent, customer not found · {{ data.receivedToday }} received today</div>
+      </div>
+    </div>
+
+    <!-- Recent -->
+    <div class="cic-card">
+      <h2>Latest enquiries on our customers</h2>
+      @if (data.recent?.length) {
+        <div class="cic-table-wrap">
+          <table class="cic-table">
+            <thead>
+              <tr>
+                <th>Enquiry date</th>
+                <th>Our customer</th>
+                <th>Branch</th>
+                <th>Loan type</th>
+                <th class="num">Amount (₹)</th>
+                <th>Purpose</th>
+                <th>Bureau</th>
+                <th>Status</th>
+              </tr>
+            </thead>
+            <tbody>
+              @for (a of data.recent; track a.id) {
+                <tr class="clickable" (click)="openAlertId = a.id">
+                  <td>{{ a.enquiryDate | date: 'dd MMM yyyy' }}</td>
+                  <td>
+                    <b>{{ a.clientName }}</b>
+                    <div class="muted" style="font-size: 11px">{{ a.clientAccountNo }}</div>
+                  </td>
+                  <td>{{ a.officeName }}</td>
+                  <td>{{ a.loanType }}</td>
+                  <td class="num">{{ a.amount | number: '1.0-0' }}</td>
+                  <td>{{ a.purpose }}</td>
+                  <td>{{ a.bureauCode }}</td>
+                  <td>
+                    <span class="cic-badge" [class]="'cic-badge ' + statusTone(a.status)">{{ a.status }}</span>
+                  </td>
+                </tr>
+              }
+            </tbody>
+          </table>
+        </div>
+      } @else {
+        <div class="cic-empty">
+          No enquiry alerts yet. They appear here as soon as a CIC reports one of our customers.
+        </div>
+      }
+    </div>
+
+    <div class="cic-split">
+      <!-- Repeat customers -->
+      <div class="cic-card">
+        <h2>
+          Customers applying elsewhere repeatedly
+          <span class="cic-card-sub">2+ enquiries · last {{ days }} days</span>
+        </h2>
+        @if (data.repeatCustomers?.length) {
+          <div class="cic-table-wrap">
+            <table class="cic-table">
+              <thead>
+                <tr>
+                  <th>Customer</th>
+                  <th class="num">Enquiries</th>
+                  <th class="num">Total applied (₹)</th>
+                  <th>Last</th>
+                </tr>
+              </thead>
+              <tbody>
+                @for (c of data.repeatCustomers; track c.clientId) {
+                  <tr>
+                    <td>
+                      <b>{{ c.clientName }}</b>
+                      <div class="muted" style="font-size: 11px">{{ c.accountNo }}</div>
+                    </td>
+                    <td class="num tone-bad">
+                      <b>{{ c.alerts }}</b>
+                    </td>
+                    <td class="num">{{ c.amount | number: '1.0-0' }}</td>
+                    <td>{{ c.lastEnquiryDate | date: 'dd MMM' }}</td>
+                  </tr>
+                }
+              </tbody>
+            </table>
+          </div>
+        } @else {
+          <div class="cic-empty">No customer has more than one enquiry in this period.</div>
+        }
+      </div>
+
+      <!-- Trend -->
+      <div class="cic-card">
+        <h2>Enquiries per day <span class="cic-card-sub">last 14 days</span></h2>
+        <div class="cic-trend">
+          @for (p of data.trend14Days; track p.date) {
+            <div
+              class="col"
+              [title]="(p.date | date: 'dd MMM') + ': ' + p.count + ' enquiries, ₹' + (p.amount | number: '1.0-0')"
+            >
+              <span class="n">{{ p.count || '' }}</span>
+              <div class="bar" [style.height.%]="pct(p.count, data.trend14Days, 'count')"></div>
+              <span class="d">{{ p.date | date: 'dd' }}</span>
+            </div>
+          }
+        </div>
+      </div>
+    </div>
+
+    <div>
+      <div class="cic-card" style="margin-bottom: 0">
+        <h2>By loan type</h2>
+        @for (g of data.byLoanType; track g.label) {
+          <div style="margin-bottom: 10px">
+            <div style="display: flex; justify-content: space-between; font-size: 12px; margin-bottom: 4px">
+              <span>{{ g.label }}</span>
+              <span class="muted">{{ g.count }} · ₹{{ g.amount | number: '1.0-0' }}</span>
+            </div>
+            <div class="cic-bar"><div [style.width.%]="pct(g.count, data.byLoanType, 'count')"></div></div>
+          </div>
+        } @empty {
+          <div class="cic-empty">No data.</div>
+        }
+      </div>
+    </div>
+
+    <!-- Bureau fetch status -->
+    <div class="cic-card" style="margin-top: 16px">
+      <h2>
+        Alert feed from each CIC
+        <a class="cic-btn sm" routerLink="/credit-bureau/fetch-log">Fetch log</a>
+      </h2>
+      <div class="cic-grid cols-4">
+        @for (b of data.bureaus; track b.id) {
+          <div class="cic-stat">
+            <div style="display: flex; justify-content: space-between; align-items: center; gap: 6px">
+              <b>{{ b.code }}</b>
+              <span class="cic-badge" [class.good]="b.whitelisted">{{ b.whitelisted ? 'Whitelisted' : 'Off' }}</span>
+            </div>
+            <div class="s" style="margin-top: 6px">
+              {{ b.environment }} · {{ b.autoFetch ? 'auto every ' + b.intervalMin + ' min' : 'manual fetch only' }}
+            </div>
+            <div class="s">
+              Last fetch:
+              @if (b.lastFetchOn) {
+                <span class="cic-badge" [class]="'cic-badge ' + fetchTone(b.lastFetchStatus)">{{
+                  b.lastFetchStatus
+                }}</span>
+                {{ b.lastFetchOn | slice: 0 : 16 }}
+              } @else {
+                never
+              }
+            </div>
+            @if (b.lastFetchMessage) {
+              <div class="s" style="font-size: 11px">{{ b.lastFetchMessage }}</div>
+            }
+            @if (b.whitelisted) {
+              <button
+                class="cic-btn sm"
+                style="margin-top: 8px"
+                (click)="fetchNow(b.id)"
+                [disabled]="fetching !== null"
+                *mifosxHasPermission="'FETCH_CICALERT'"
+              >
+                {{ fetching === b.id ? 'Fetching…' : 'Fetch now' }}
+              </button>
+            }
+          </div>
+        }
+      </div>
+    </div>
+  }
+</div>
+
+@if (openAlertId) {
+  <mifosx-cic-alert-detail
+    [alertId]="openAlertId"
+    (closed)="openAlertId = null"
+    (changed)="onChanged()"
+  ></mifosx-cic-alert-detail>
+}

src/app/credit-bureau/cic-dashboard/cic-dashboard.component.ts

@@ -0,0 +1,119 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { RouterModule } from '@angular/router';
+
+import { HasPermissionDirective } from 'app/directives/has-permission/has-permission.directive';
+import { CicAlertDetailComponent } from '../cic-alert-detail/cic-alert-detail.component';
+import { CicService, cicError, cicStatusTone } from '../cic.service';
+
+/**
+ * Credit Bureau dashboard: our customers who applied for a loan at another bank / NBFC, as reported by the CICs -
+ * who, what loan and how much (the CIC does not name the lender) - with the customers applying elsewhere repeatedly,
+ * the loan types, the trend, and the fetch status of each bureau. The other pages (fetch log, CIC configuration, API
+ * mapping) are reached from the buttons at the top.
+ */
+@Component({
+  selector: 'mifosx-cic-dashboard',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule,
+    HasPermissionDirective,
+    CicAlertDetailComponent
+  ],
+  templateUrl: './cic-dashboard.component.html',
+  styleUrls: ['../cic-shared.scss']
+})
+export class CicDashboardComponent implements OnInit {
+  private cic = inject(CicService);
+
+  days = 30;
+  loading = false;
+  error: string | null = null;
+  info: string | null = null;
+  data: any = null;
+  fetching: number | 'ALL' | null = null;
+  openAlertId: number | null = null;
+
+  readonly statusTone = cicStatusTone;
+
+  ngOnInit(): void {
+    this.load();
+  }
+
+  load(): void {
+    this.loading = true;
+    this.error = null;
+    this.cic.dashboard(this.days).subscribe({
+      next: (d) => {
+        this.data = d;
+        this.loading = false;
+      },
+      error: (e) => {
+        this.error = cicError(e, 'Could not load the credit bureau dashboard.');
+        this.loading = false;
+      }
+    });
+  }
+
+  get whitelisted(): any[] {
+    return (this.data?.bureaus ?? []).filter((b: any) => b.whitelisted);
+  }
+
+  /** Fetch now from one bureau, or from every whitelisted bureau in turn. */
+  fetchNow(bureauId: number | 'ALL'): void {
+    const ids = bureauId === 'ALL' ? this.whitelisted.map((b) => b.id as number) : [bureauId];
+    if (!ids.length) return;
+    this.fetching = bureauId;
+    this.error = null;
+    this.info = null;
+    const messages: string[] = [];
+    const next = (i: number) => {
+      if (i >= ids.length) {
+        this.fetching = null;
+        this.info = messages.join(' · ');
+        this.load();
+        return;
+      }
+      this.cic.fetch(ids[i]).subscribe({
+        next: (run) => {
+          messages.push(
+            `${run.bureauCode}: ${run.status === 'SUCCESS' ? run.newAlerts + ' new alert(s)' : 'failed - ' + run.message}`
+          );
+          next(i + 1);
+        },
+        error: (e) => {
+          messages.push(cicError(e, 'Fetch failed.'));
+          next(i + 1);
+        }
+      });
+    };
+    next(0);
+  }
+
+  max(list: any[] | undefined, key: string): number {
+    return Math.max(1, ...(list ?? []).map((x) => Number(x[key] ?? 0)));
+  }
+
+  pct(value: any, list: any[] | undefined, key: string): number {
+    return Math.round((Number(value ?? 0) / this.max(list, key)) * 100);
+  }
+
+  onChanged(): void {
+    this.load();
+  }
+
+  fetchTone(status?: string): string {
+    return status === 'SUCCESS' ? 'good' : status === 'FAILED' ? 'bad' : '';
+  }
+}

src/app/credit-bureau/cic-fetch-log/cic-fetch-log.component.html

@@ -0,0 +1,126 @@
+<!--
+  Copyright since 2025 Mifos Initiative
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<div class="cic-page">
+  <div class="cic-head">
+    <div>
+      <h1>Fetch Log</h1>
+      <p>Every time the CBS asked a CIC for enquiry alerts: when, how many came, how many were our customers.</p>
+    </div>
+    <div class="cic-actions">
+      <a class="cic-btn" routerLink="/credit-bureau/dashboard">← Dashboard</a>
+    </div>
+  </div>
+
+  @if (error) {
+    <div class="cic-alert error">{{ error }}</div>
+  }
+
+  <div class="cic-card">
+    <h2>
+      Fetches
+      <span class="cic-actions">
+        <select [(ngModel)]="bureauId" (ngModelChange)="filterChanged()" class="cic-btn sm">
+          <option value="">All bureaus</option>
+          @for (b of bureaus; track b.id) {
+            <option [value]="b.id">{{ b.code }}</option>
+          }
+        </select>
+        <button class="cic-btn sm" (click)="load()">Refresh</button>
+      </span>
+    </h2>
+    @if (loading && !runs.length) {
+      <div class="cic-empty">Loading…</div>
+    } @else if (!runs.length) {
+      <div class="cic-empty">No fetch has run yet.</div>
+    } @else {
+      <div class="cic-table-wrap">
+        <table class="cic-table">
+          <thead>
+            <tr>
+              <th>Run</th>
+              <th>Bureau</th>
+              <th>How</th>
+              <th>Window</th>
+              <th>Status</th>
+              <th class="num">Received</th>
+              <th class="num">New</th>
+              <th class="num">Matched</th>
+              <th class="num">Unmatched</th>
+              <th class="num">Already had</th>
+              <th class="num">Own bank</th>
+              <th>By</th>
+              <th>When</th>
+            </tr>
+          </thead>
+          <tbody>
+            @for (r of runs; track r.id) {
+              <tr class="clickable" (click)="view(r)">
+                <td class="cic-mono">{{ r.runRef }}</td>
+                <td>{{ r.bureauCode }}</td>
+                <td>{{ r.trigger }}</td>
+                <td>{{ r.fromDate | date: 'dd MMM' }} – {{ r.toDate | date: 'dd MMM yy' }}</td>
+                <td>
+                  <span class="cic-badge" [class]="'cic-badge ' + tone(r.status)">{{ r.status }}</span>
+                </td>
+                <td class="num">{{ r.received }}</td>
+                <td class="num">
+                  <b>{{ r.newAlerts }}</b>
+                </td>
+                <td class="num">{{ r.matched }}</td>
+                <td class="num">{{ r.unmatched }}</td>
+                <td class="num">{{ r.duplicates }}</td>
+                <td class="num">{{ r.ownBank }}</td>
+                <td>{{ r.triggeredByName }}</td>
+                <td>{{ r.startedOn | slice: 0 : 16 }}</td>
+              </tr>
+            }
+          </tbody>
+        </table>
+      </div>
+      <div class="cic-pager">
+        <span>{{ offset + 1 }}–{{ offset + runs.length }} of {{ total }}</span>
+        <span class="cic-actions">
+          <button class="cic-btn sm" (click)="page(-1)" [disabled]="offset === 0">Previous</button>
+          <button class="cic-btn sm" (click)="page(1)" [disabled]="offset + limit >= total">Next</button>
+        </span>
+      </div>
+    }
+  </div>
+</div>
+
+@if (viewing) {
+  <div class="cic-modal-backdrop" (click)="viewing = null">
+    <div class="cic-modal" style="width: min(1000px, 100%)" (click)="$event.stopPropagation()">
+      <h3>{{ viewing.runRef }} · {{ viewing.bureauCode }} · {{ viewing.status }}</h3>
+      <div
+        class="cic-alert"
+        [class.success]="viewing.status === 'SUCCESS'"
+        [class.error]="viewing.status !== 'SUCCESS'"
+      >
+        {{ viewing.message }}
+        @if (viewing.httpStatus) {
+          (HTTP {{ viewing.httpStatus }}, {{ viewing.durationMs }} ms)
+        }
+      </div>
+      <div class="cic-split">
+        <div>
+          <h4 style="margin: 0 0 6px; font-size: 13px">Request</h4>
+          <pre class="cic-code">{{ pretty(viewing.request) || '—' }}</pre>
+        </div>
+        <div>
+          <h4 style="margin: 0 0 6px; font-size: 13px">Response</h4>
+          <pre class="cic-code">{{ pretty(viewing.response) || '—' }}</pre>
+        </div>
+      </div>
+      <div class="foot">
+        <button class="cic-btn" (click)="viewing = null">Close</button>
+      </div>
+    </div>
+  </div>
+}

src/app/credit-bureau/cic-fetch-log/cic-fetch-log.component.ts

@@ -0,0 +1,91 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { CommonModule } from '@angular/common';
+import { Component, OnInit, inject } from '@angular/core';
+import { FormsModule } from '@angular/forms';
+import { RouterModule } from '@angular/router';
+
+import { CicBureau, CicFetchRun, CicService, cicError } from '../cic.service';
+
+/** Log of every alert fetch from the CICs: when, how many alerts, how many matched, and the request / response. */
+@Component({
+  selector: 'mifosx-cic-fetch-log',
+  standalone: true,
+  imports: [
+    CommonModule,
+    FormsModule,
+    RouterModule
+  ],
+  templateUrl: './cic-fetch-log.component.html',
+  styleUrls: ['../cic-shared.scss']
+})
+export class CicFetchLogComponent implements OnInit {
+  private cic = inject(CicService);
+
+  bureaus: CicBureau[] = [];
+  runs: CicFetchRun[] = [];
+  total = 0;
+  offset = 0;
+  readonly limit = 20;
+  bureauId = '';
+  viewing: CicFetchRun | null = null;
+  loading = false;
+  error: string | null = null;
+
+  ngOnInit(): void {
+    this.cic.bureaus().subscribe({ next: (b) => (this.bureaus = b), error: () => (this.bureaus = []) });
+    this.load();
+  }
+
+  load(): void {
+    this.loading = true;
+    this.error = null;
+    this.cic.fetchRuns({ bureauId: this.bureauId, offset: this.offset, limit: this.limit }).subscribe({
+      next: (p) => {
+        this.runs = p.pageItems;
+        this.total = p.totalFilteredRecords;
+        this.loading = false;
+      },
+      error: (e) => {
+        this.error = cicError(e, 'Could not load the fetch log.');
+        this.loading = false;
+      }
+    });
+  }
+
+  filterChanged(): void {
+    this.offset = 0;
+    this.load();
+  }
+
+  page(delta: number): void {
+    this.offset = Math.max(0, this.offset + delta * this.limit);
+    this.load();
+  }
+
+  view(r: CicFetchRun): void {
+    this.cic.fetchRun(r.id).subscribe({
+      next: (full) => (this.viewing = full),
+      error: (e) => (this.error = cicError(e))
+    });
+  }
+
+  pretty(text?: string | null): string {
+    if (!text) return '';
+    try {
+      return JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+      return text;
+    }
+  }
+
+  tone(status: string): string {
+    return status === 'SUCCESS' ? 'good' : status === 'FAILED' ? 'bad' : 'warn';
+  }
+}

src/app/credit-bureau/cic-shared.scss

@@ -0,0 +1,627 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+/* Shared look for the Credit Bureau (CIC) screens. */
+
+:host {
+  --cic-ink: #0f172a;
+  --cic-muted: #64748b;
+  --cic-line: #e2e8f0;
+  --cic-soft: #f8fafc;
+  --cic-brand: #1d4ed8;
+  --cic-brand-soft: #eff6ff;
+  --cic-good: #047857;
+  --cic-good-soft: #ecfdf5;
+  --cic-ok: #0369a1;
+  --cic-ok-soft: #f0f9ff;
+  --cic-warn: #b45309;
+  --cic-warn-soft: #fffbeb;
+  --cic-bad: #b91c1c;
+  --cic-bad-soft: #fef2f2;
+
+  display: block;
+  color: var(--cic-ink);
+}
+
+.cic-page {
+  padding: 20px 24px 40px;
+  max-width: 1440px;
+  margin: 0 auto;
+}
+
+.cic-head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  margin-bottom: 18px;
+  flex-wrap: wrap;
+
+  h1 {
+    margin: 0;
+    font-size: 22px;
+    font-weight: 700;
+    letter-spacing: -0.01em;
+  }
+
+  p {
+    margin: 4px 0 0;
+    color: var(--cic-muted);
+    font-size: 13px;
+  }
+}
+
+.cic-actions {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+  align-items: center;
+}
+
+.cic-card {
+  background: #fff;
+  border: 1px solid var(--cic-line);
+  border-radius: 12px;
+  padding: 18px 20px;
+  margin-bottom: 16px;
+  box-shadow: 0 1px 2px rgb(15 23 42 / 4%);
+
+  > h2,
+  .cic-card-title {
+    margin: 0 0 14px;
+    font-size: 15px;
+    font-weight: 700;
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 10px;
+  }
+
+  .cic-card-sub {
+    color: var(--cic-muted);
+    font-size: 12px;
+    font-weight: 500;
+  }
+}
+
+.cic-grid {
+  display: grid;
+  gap: 14px;
+
+  &.cols-2 {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  &.cols-3 {
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+  }
+
+  &.cols-4 {
+    grid-template-columns: repeat(4, minmax(0, 1fr));
+  }
+
+  @media (width <= 960px) {
+    &.cols-3,
+    &.cols-4 {
+      grid-template-columns: repeat(2, minmax(0, 1fr));
+    }
+  }
+
+  @media (width <= 640px) {
+    &.cols-2,
+    &.cols-3,
+    &.cols-4 {
+      grid-template-columns: 1fr;
+    }
+  }
+}
+
+.cic-split {
+  display: grid;
+  grid-template-columns: minmax(0, 1.1fr) minmax(0, 0.9fr);
+  gap: 16px;
+
+  @media (width <= 1100px) {
+    grid-template-columns: 1fr;
+  }
+}
+
+.cic-stat {
+  background: #fff;
+  border: 1px solid var(--cic-line);
+  border-radius: 12px;
+  padding: 14px 16px;
+
+  .k {
+    font-size: 12px;
+    color: var(--cic-muted);
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+  }
+
+  .v {
+    font-size: 24px;
+    font-weight: 700;
+    margin-top: 6px;
+    font-variant-numeric: tabular-nums;
+  }
+
+  .s {
+    font-size: 12px;
+    color: var(--cic-muted);
+    margin-top: 2px;
+  }
+}
+
+.cic-field {
+  display: flex;
+  flex-direction: column;
+  gap: 5px;
+  min-width: 0;
+
+  label {
+    font-size: 12px;
+    font-weight: 600;
+    color: #334155;
+  }
+
+  .hint {
+    font-size: 11px;
+    color: var(--cic-muted);
+  }
+
+  input,
+  select,
+  textarea {
+    width: 100%;
+    border: 1px solid #cbd5e1;
+    border-radius: 8px;
+    padding: 8px 10px;
+    font-size: 13px;
+    font-family: inherit;
+    background: #fff;
+    color: var(--cic-ink);
+    box-sizing: border-box;
+
+    &:focus {
+      outline: none;
+      border-color: var(--cic-brand);
+      box-shadow: 0 0 0 3px rgb(29 78 216 / 12%);
+    }
+
+    &:disabled {
+      background: var(--cic-soft);
+      color: var(--cic-muted);
+    }
+  }
+
+  textarea {
+    resize: vertical;
+    min-height: 90px;
+  }
+}
+
+.cic-mono,
+textarea.cic-mono {
+  font-family: 'JetBrains Mono', 'Fira Code', Consolas, monospace !important;
+  font-size: 12px !important;
+}
+
+.cic-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  border: 1px solid var(--cic-line);
+  background: #fff;
+  color: var(--cic-ink);
+  border-radius: 8px;
+  padding: 8px 14px;
+  font-size: 13px;
+  font-weight: 600;
+  cursor: pointer;
+  white-space: nowrap;
+
+  &:hover:not(:disabled) {
+    background: var(--cic-soft);
+  }
+
+  &:disabled {
+    opacity: 0.55;
+    cursor: not-allowed;
+  }
+
+  &.primary {
+    background: var(--cic-brand);
+    border-color: var(--cic-brand);
+    color: #fff;
+
+    &:hover:not(:disabled) {
+      background: #1e40af;
+    }
+  }
+
+  &.danger {
+    color: var(--cic-bad);
+    border-color: #fecaca;
+
+    &:hover:not(:disabled) {
+      background: var(--cic-bad-soft);
+    }
+  }
+
+  &.sm {
+    padding: 5px 10px;
+    font-size: 12px;
+  }
+}
+
+.cic-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 9px;
+  border-radius: 999px;
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: 0.02em;
+  background: var(--cic-soft);
+  color: var(--cic-muted);
+  border: 1px solid var(--cic-line);
+  white-space: nowrap;
+
+  &.good {
+    background: var(--cic-good-soft);
+    color: var(--cic-good);
+    border-color: #a7f3d0;
+  }
+
+  &.ok {
+    background: var(--cic-ok-soft);
+    color: var(--cic-ok);
+    border-color: #bae6fd;
+  }
+
+  &.warn {
+    background: var(--cic-warn-soft);
+    color: var(--cic-warn);
+    border-color: #fde68a;
+  }
+
+  &.bad {
+    background: var(--cic-bad-soft);
+    color: var(--cic-bad);
+    border-color: #fecaca;
+  }
+
+  &.brand {
+    background: var(--cic-brand-soft);
+    color: var(--cic-brand);
+    border-color: #bfdbfe;
+  }
+}
+
+.cic-alert {
+  border-radius: 10px;
+  padding: 10px 14px;
+  font-size: 13px;
+  margin-bottom: 14px;
+  border: 1px solid;
+
+  &.error {
+    background: var(--cic-bad-soft);
+    border-color: #fecaca;
+    color: var(--cic-bad);
+  }
+
+  &.success {
+    background: var(--cic-good-soft);
+    border-color: #a7f3d0;
+    color: var(--cic-good);
+  }
+
+  &.info {
+    background: var(--cic-brand-soft);
+    border-color: #bfdbfe;
+    color: #1e3a8a;
+  }
+
+  &.warn {
+    background: var(--cic-warn-soft);
+    border-color: #fde68a;
+    color: var(--cic-warn);
+  }
+
+  ul {
+    margin: 6px 0 0;
+    padding-left: 18px;
+  }
+}
+
+.cic-table-wrap {
+  overflow-x: auto;
+  border: 1px solid var(--cic-line);
+  border-radius: 10px;
+}
+
+.cic-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 13px;
+
+  th {
+    text-align: left;
+    font-size: 11px;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: var(--cic-muted);
+    font-weight: 700;
+    background: var(--cic-soft);
+    padding: 9px 12px;
+    border-bottom: 1px solid var(--cic-line);
+    white-space: nowrap;
+  }
+
+  td {
+    padding: 9px 12px;
+    border-bottom: 1px solid #f1f5f9;
+    vertical-align: middle;
+  }
+
+  tr:last-child td {
+    border-bottom: none;
+  }
+
+  tr.clickable {
+    cursor: pointer;
+
+    &:hover td {
+      background: #f8fafc;
+    }
+  }
+
+  .num {
+    text-align: right;
+    font-variant-numeric: tabular-nums;
+  }
+
+  td input,
+  td select {
+    width: 100%;
+    border: 1px solid #cbd5e1;
+    border-radius: 6px;
+    padding: 5px 7px;
+    font-size: 12px;
+    box-sizing: border-box;
+    background: #fff;
+  }
+}
+
+.cic-empty {
+  text-align: center;
+  color: var(--cic-muted);
+  padding: 28px 12px;
+  font-size: 13px;
+}
+
+.cic-pager {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-top: 12px;
+  font-size: 12px;
+  color: var(--cic-muted);
+}
+
+.cic-switch {
+  position: relative;
+  display: inline-block;
+  width: 40px;
+  height: 22px;
+  flex: none;
+
+  input {
+    opacity: 0;
+    width: 0;
+    height: 0;
+  }
+
+  span {
+    position: absolute;
+    inset: 0;
+    background: #cbd5e1;
+    border-radius: 999px;
+    transition: background 0.15s;
+    cursor: pointer;
+
+    &::before {
+      content: '';
+      position: absolute;
+      width: 16px;
+      height: 16px;
+      left: 3px;
+      top: 3px;
+      background: #fff;
+      border-radius: 50%;
+      transition: transform 0.15s;
+      box-shadow: 0 1px 2px rgb(0 0 0 / 20%);
+    }
+  }
+
+  input:checked + span {
+    background: var(--cic-good);
+  }
+
+  input:checked + span::before {
+    transform: translateX(18px);
+  }
+
+  input:disabled + span {
+    opacity: 0.5;
+    cursor: not-allowed;
+  }
+}
+
+.cic-tabs {
+  display: flex;
+  gap: 4px;
+  border-bottom: 1px solid var(--cic-line);
+  margin-bottom: 14px;
+  flex-wrap: wrap;
+
+  button {
+    border: none;
+    background: none;
+    padding: 9px 14px;
+    font-size: 13px;
+    font-weight: 600;
+    color: var(--cic-muted);
+    cursor: pointer;
+    border-bottom: 2px solid transparent;
+    margin-bottom: -1px;
+
+    &.active {
+      color: var(--cic-brand);
+      border-bottom-color: var(--cic-brand);
+    }
+  }
+}
+
+.cic-kv {
+  display: grid;
+  grid-template-columns: 170px minmax(0, 1fr);
+  gap: 7px 12px;
+  font-size: 13px;
+
+  dt {
+    color: var(--cic-muted);
+  }
+
+  dd {
+    margin: 0;
+    font-weight: 600;
+    word-break: break-word;
+  }
+}
+
+.cic-code {
+  background: #0f172a;
+  color: #e2e8f0;
+  border-radius: 10px;
+  padding: 12px 14px;
+  font-family: 'JetBrains Mono', 'Fira Code', Consolas, monospace;
+  font-size: 12px;
+  white-space: pre-wrap;
+  word-break: break-all;
+  max-height: 420px;
+  overflow: auto;
+  margin: 0;
+}
+
+.cic-trend {
+  display: flex;
+  align-items: flex-end;
+  gap: 6px;
+  height: 180px;
+  padding-top: 6px;
+
+  .col {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: flex-end;
+    height: 100%;
+    min-width: 0;
+  }
+
+  .bar {
+    width: 100%;
+    max-width: 28px;
+    min-height: 2px;
+    background: var(--cic-brand);
+    border-radius: 4px 4px 0 0;
+  }
+
+  .n {
+    font-size: 10px;
+    color: var(--cic-muted);
+    margin-bottom: 2px;
+  }
+
+  .d {
+    font-size: 10px;
+    color: var(--cic-muted);
+    margin-top: 4px;
+  }
+}
+
+.cic-modal-backdrop {
+  position: fixed;
+  inset: 0;
+  background: rgb(15 23 42 / 45%);
+  z-index: 1000;
+  display: grid;
+  place-items: center;
+  padding: 16px;
+}
+
+.cic-modal {
+  background: #fff;
+  border-radius: 14px;
+  width: min(640px, 100%);
+  max-height: 90vh;
+  overflow: auto;
+  padding: 20px 22px;
+  box-shadow: 0 20px 50px rgb(15 23 42 / 25%);
+
+  h3 {
+    margin: 0 0 12px;
+    font-size: 16px;
+  }
+
+  .foot {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    margin-top: 16px;
+  }
+}
+
+.cic-bar {
+  height: 8px;
+  border-radius: 999px;
+  background: #f1f5f9;
+  overflow: hidden;
+
+  > div {
+    height: 100%;
+    background: var(--cic-brand);
+    border-radius: 999px;
+  }
+}
+
+.muted {
+  color: var(--cic-muted);
+}
+
+.tone-good {
+  color: var(--cic-good);
+}
+
+.tone-ok {
+  color: var(--cic-ok);
+}
+
+.tone-warn {
+  color: var(--cic-warn);
+}
+
+.tone-bad {
+  color: var(--cic-bad);
+}

src/app/credit-bureau/cic.service.ts

@@ -0,0 +1,276 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { HttpClient, HttpContext, HttpParams } from '@angular/common/http';
+import { Injectable, inject } from '@angular/core';
+import { Observable } from 'rxjs';
+
+import { SILENT_HTTP_ERROR } from '../core/http/silent-error.token';
+
+/** A credit bureau (CIC) as configured for the bank. Never carries the secret itself. */
+export interface CicBureau {
+  id: number;
+  code: string;
+  name: string;
+  description?: string;
+  whitelisted: boolean;
+  isDefault: boolean;
+  environment: 'SIMULATOR' | 'UAT' | 'PRODUCTION';
+  baseUrl?: string;
+  memberCode?: string;
+  authType: string;
+  username?: string;
+  apiKeyHeader?: string;
+  hasSecret: boolean;
+  tokenUrl?: string;
+  clientId?: string;
+  timeoutMs: number;
+  alertAutoFetch: boolean;
+  alertFetchIntervalMin: number;
+  alertLookbackDays: number;
+  lastFetchOn?: string;
+  lastFetchStatus?: string;
+  lastFetchMessage?: string;
+  lastTestStatus?: string;
+  lastTestMessage?: string;
+  lastTestedOn?: string;
+  updatedOn?: string;
+  activeEndpoints: number;
+  alertsLast30Days: number;
+  newAlerts: number;
+}
+
+export interface CicMapping {
+  id?: number;
+  sourceField: string | null;
+  targetField: string;
+  transform: string;
+  defaultValue: string | null;
+  mandatory: boolean;
+  sortOrder?: number;
+}
+
+export interface CicEndpoint {
+  bureauId: number;
+  endpointType: string;
+  exists: boolean;
+  id?: number;
+  httpMethod: string;
+  path?: string;
+  contentType: string;
+  headersJson: string;
+  baseBody: string;
+  isActive: boolean;
+  requestMappings: CicMapping[];
+  responseMappings: CicMapping[];
+}
+
+export interface CicCatalog {
+  environments: string[];
+  authTypes: string[];
+  endpointTypes: string[];
+  httpMethods: string[];
+  cbsFields: Record<string, string>;
+  resultFields: Record<string, string>;
+  rootFields: string[];
+  transforms: Record<string, string>;
+  alertStatuses: string[];
+  matchTypes: string[];
+}
+
+/** One enquiry made on our customer at another lender, as reported by the CIC. */
+export interface CicAlert {
+  id: number;
+  bureauId: number;
+  bureauCode: string;
+  alertKey: string;
+  clientId?: number;
+  clientName?: string;
+  clientAccountNo?: string;
+  officeId?: number;
+  officeName?: string;
+  matchType: 'PAN' | 'AADHAAR' | 'CUSTOMER_REF' | 'MANUAL' | 'NONE';
+  customerName?: string;
+  panMasked?: string;
+  aadhaarMasked?: string;
+  customerRef?: string;
+  enquiryDate?: string;
+  loanType?: string;
+  amount?: number;
+  purpose?: string;
+  location?: string;
+  status: 'NEW' | 'SEEN' | 'ACTIONED' | 'DISMISSED';
+  remarks?: string;
+  actionedByName?: string;
+  actionedOn?: string;
+  receivedVia?: string;
+  receivedOn?: string;
+  raw?: any;
+  fetchRunId?: number;
+  otherAlertsOfCustomer?: CicAlert[];
+  clientLoans?: {
+    id: number;
+    accountNo: string;
+    productName: string;
+    status: string;
+    principal: number;
+    outstanding: number;
+    disbursedOn?: string;
+  }[];
+}
+
+export interface CicFetchRun {
+  id: number;
+  runRef: string;
+  bureauId: number;
+  bureauCode: string;
+  trigger: 'MANUAL' | 'SCHEDULED';
+  environment?: string;
+  fromDate?: string;
+  toDate?: string;
+  status: 'RUNNING' | 'SUCCESS' | 'FAILED';
+  httpStatus?: number;
+  received: number;
+  newAlerts: number;
+  matched: number;
+  unmatched: number;
+  duplicates: number;
+  ownBank: number;
+  message?: string;
+  durationMs?: number;
+  triggeredByName?: string;
+  startedOn: string;
+  request?: string;
+  response?: string;
+}
+
+export interface CicPage<T> {
+  totalFilteredRecords: number;
+  pageItems: T[];
+}
+
+export const CIC_MATCH_LABELS: Record<string, string> = {
+  PAN: 'PAN',
+  AADHAAR: 'Aadhaar',
+  CUSTOMER_REF: 'Customer ref',
+  MANUAL: 'Linked manually',
+  NONE: 'Not matched'
+};
+
+export function cicStatusTone(status: string): string {
+  return status === 'NEW' ? 'bad' : status === 'SEEN' ? 'warn' : status === 'ACTIONED' ? 'good' : '';
+}
+
+/** The server's own message for a failed call. */
+export function cicError(err: any, fallback = 'Something went wrong. Please try again.'): string {
+  return (
+    err?.error?.errors?.[0]?.defaultUserMessage ??
+    err?.error?.defaultUserMessage ??
+    err?.error?.message ??
+    err?.message ??
+    fallback
+  );
+}
+
+@Injectable({ providedIn: 'root' })
+export class CicService {
+  private http = inject(HttpClient);
+  private base = '/cic';
+  /** Errors are shown inline on these screens, so the global alert is suppressed. */
+  private silent = { context: new HttpContext().set(SILENT_HTTP_ERROR, true) };
+
+  catalog(): Observable<CicCatalog> {
+    return this.http.get<CicCatalog>(`${this.base}/catalog`, this.silent);
+  }
+
+  bureaus(whitelistedOnly = false): Observable<CicBureau[]> {
+    return this.http.get<CicBureau[]>(`${this.base}/bureaus`, {
+      ...this.silent,
+      params: new HttpParams().set('whitelistedOnly', String(whitelistedOnly))
+    });
+  }
+
+  updateBureau(id: number, body: any): Observable<CicBureau> {
+    return this.http.put<CicBureau>(`${this.base}/bureaus/${id}`, body, this.silent);
+  }
+
+  setWhitelisted(id: number, whitelisted: boolean): Observable<CicBureau> {
+    return this.http.put<CicBureau>(`${this.base}/bureaus/${id}/whitelist`, { whitelisted }, this.silent);
+  }
+
+  testConnection(id: number): Observable<{ status: string; message: string }> {
+    return this.http.post<{ status: string; message: string }>(
+      `${this.base}/bureaus/${id}/test-connection`,
+      {},
+      this.silent
+    );
+  }
+
+  endpoint(bureauId: number, type: string): Observable<CicEndpoint> {
+    return this.http.get<CicEndpoint>(`${this.base}/bureaus/${bureauId}/endpoints/${type}`, this.silent);
+  }
+
+  saveEndpoint(bureauId: number, type: string, body: any): Observable<CicEndpoint> {
+    return this.http.put<CicEndpoint>(`${this.base}/bureaus/${bureauId}/endpoints/${type}`, body, this.silent);
+  }
+
+  preview(bureauId: number, body: { fromDate?: string; toDate?: string }): Observable<any> {
+    return this.http.post<any>(`${this.base}/bureaus/${bureauId}/preview`, body, this.silent);
+  }
+
+  parseTest(bureauId: number, content: string | null): Observable<any> {
+    return this.http.post<any>(`${this.base}/bureaus/${bureauId}/parse-test`, { content }, this.silent);
+  }
+
+  fetch(bureauId: number, body: { fromDate?: string; toDate?: string } = {}): Observable<CicFetchRun> {
+    return this.http.post<CicFetchRun>(`${this.base}/bureaus/${bureauId}/fetch`, body, this.silent);
+  }
+
+  fetchRuns(filter: Record<string, any>): Observable<CicPage<CicFetchRun>> {
+    return this.http.get<CicPage<CicFetchRun>>(`${this.base}/fetch-runs`, {
+      ...this.silent,
+      params: this.params(filter)
+    });
+  }
+
+  fetchRun(id: number): Observable<CicFetchRun> {
+    return this.http.get<CicFetchRun>(`${this.base}/fetch-runs/${id}`, this.silent);
+  }
+
+  dashboard(days = 30): Observable<any> {
+    return this.http.get<any>(`${this.base}/dashboard`, {
+      ...this.silent,
+      params: new HttpParams().set('days', String(days))
+    });
+  }
+
+  alert(id: number): Observable<CicAlert> {
+    return this.http.get<CicAlert>(`${this.base}/alerts/${id}`, this.silent);
+  }
+
+  updateStatus(id: number, status: string, remarks?: string | null): Observable<CicAlert> {
+    return this.http.put<CicAlert>(`${this.base}/alerts/${id}/status`, { status, remarks }, this.silent);
+  }
+
+  linkClient(id: number, clientId: number): Observable<CicAlert> {
+    return this.http.put<CicAlert>(`${this.base}/alerts/${id}/client`, { clientId }, this.silent);
+  }
+
+  private params(filter: Record<string, any>): HttpParams {
+    let params = new HttpParams();
+    Object.entries(filter).forEach(
+      ([
+        k,
+        v
+      ]) => {
+        if (v !== null && v !== undefined && v !== '') params = params.set(k, String(v));
+      }
+    );
+    return params;
+  }
+}

src/app/credit-bureau/credit-bureau-routing.module.ts

@@ -0,0 +1,58 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { NgModule } from '@angular/core';
+import { Routes, RouterModule } from '@angular/router';
+
+import { Route } from '../core/route/route.service';
+import { CicDashboardComponent } from './cic-dashboard/cic-dashboard.component';
+import { CicFetchLogComponent } from './cic-fetch-log/cic-fetch-log.component';
+import { CicBureauConfigComponent } from './cic-bureau-config/cic-bureau-config.component';
+import { CicApiMappingComponent } from './cic-api-mapping/cic-api-mapping.component';
+
+const routes: Routes = [
+  Route.withShell([
+    {
+      path: 'credit-bureau',
+      data: { title: 'Credit Bureau', breadcrumb: 'Credit Bureau' },
+      children: [
+        {
+          path: '',
+          redirectTo: 'dashboard',
+          pathMatch: 'full'
+        },
+        {
+          path: 'dashboard',
+          component: CicDashboardComponent,
+          data: { title: 'Credit Bureau Dashboard', breadcrumb: 'Dashboard' }
+        },
+        {
+          path: 'fetch-log',
+          component: CicFetchLogComponent,
+          data: { title: 'Fetch Log', breadcrumb: 'Fetch Log' }
+        },
+        {
+          path: 'bureaus',
+          component: CicBureauConfigComponent,
+          data: { title: 'CIC Whitelist & Configuration', breadcrumb: 'CIC Configuration' }
+        },
+        {
+          path: 'api-mapping',
+          component: CicApiMappingComponent,
+          data: { title: 'CIC API Mapping', breadcrumb: 'API Mapping' }
+        }
+      ]
+    }
+  ])
+];
+
+@NgModule({
+  imports: [RouterModule.forChild(routes)],
+  exports: [RouterModule]
+})
+export class CreditBureauRoutingModule {}

src/app/credit-bureau/credit-bureau.module.ts

@@ -0,0 +1,40 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { NgModule } from '@angular/core';
+
+import { SharedModule } from '../shared/shared.module';
+import { CreditBureauRoutingModule } from './credit-bureau-routing.module';
+import { CicDashboardComponent } from './cic-dashboard/cic-dashboard.component';
+import { CicFetchLogComponent } from './cic-fetch-log/cic-fetch-log.component';
+import { CicAlertDetailComponent } from './cic-alert-detail/cic-alert-detail.component';
+import { CicBureauConfigComponent } from './cic-bureau-config/cic-bureau-config.component';
+import { CicApiMappingComponent } from './cic-api-mapping/cic-api-mapping.component';
+import { CicService } from './cic.service';
+import { CicStaticService } from './cic-static.service';
+
+/**
+ * CIC / credit bureau (CIBIL, Experian, Equifax, CRIF) - its own top-level menu: enquiry alerts on our customers from
+ * other lenders, the CIC whitelist and configuration, and the API mapping.
+ */
+@NgModule({
+  imports: [
+    SharedModule,
+    CreditBureauRoutingModule,
+    CicDashboardComponent,
+    CicFetchLogComponent,
+    CicAlertDetailComponent,
+    CicBureauConfigComponent,
+    CicApiMappingComponent
+  ],
+  providers: [
+    // Static demo data, no backend call. Remove this line to use the real /v1/cic API again.
+    { provide: CicService, useClass: CicStaticService }
+  ]
+})
+export class CreditBureauModule {}

src/app/platform-admin/menu-access/menu-access.component.ts

@@ -65,6 +65,7 @@ export class PlatformMenuAccessComponent {
     { code: 'MENU_DEPOSITS', label: 'Deposits', icon: 'piggy-bank' },
     { code: 'MENU_ADVANCES', label: 'Advances', icon: 'hand-holding-usd' },
     { code: 'MENU_LOAN_ORIGINATION', label: 'Loan Origination', icon: 'clipboard-check' },
+    { code: 'MENU_CREDIT_BUREAU', label: 'Credit Bureau', icon: 'id-card' },
     { code: 'MENU_SHARE', label: 'Share', icon: 'coins' },
     { code: 'MENU_NPA', label: 'NPA', icon: 'exclamation-triangle' },
     { code: 'MENU_GENERAL_LEDGER', label: 'General Ledger', icon: 'book-open' },

src/assets/animations/loading_animation.json

@@ -45,15 +45,17 @@
       "hasMask": false,
       "ao": 0,
       "ks": { "a": { "a": 0, "k": [
-            -17.052704811096184,
-            -15.0467209815979
+            0,
+            0,
+            0
           ], "ix": 1 }, "s": { "a": 0, "k": [
-            362.228,
-            362.228,
+            394,
+            394,
             100
           ], "ix": 6 }, "sk": { "a": 0, "k": 0 }, "p": { "a": 0, "k": [
-            188.2303284168625,
-            195.49656352277756
+            250,
+            250,
+            0
           ], "ix": 2 }, "r": { "a": 0, "k": 0, "ix": 10 }, "sa": { "a": 0, "k": 0 }, "o": { "a": 0, "k": 100, "ix": 11 } },
       "shapes": [
         {
@@ -341,16 +343,16 @@
               "g": { "p": 3, "k": { "a": 0, "k": [
                     0,
                     1,
-                    0.4470588235294118,
-                    0,
+                    0.6,
+                    0.2,
                     0.485,
-                    0.9725490196078431,
-                    0.2235294117647059,
-                    0.5019607843137255,
                     1,
-                    0.9411764705882353,
-                    0,
-                    1
+                    0.6,
+                    0.2,
+                    1,
+                    1,
+                    0.6,
+                    0.2
                   ], "ix": 8 } },
               "t": 1,
               "a": { "a": 0, "k": 0 },
@@ -363,7 +365,7 @@
               "lj": 1,
               "ml": 4,
               "o": { "a": 0, "k": 100, "ix": 9 },
-              "w": { "a": 0, "k": 2, "ix": 10 }
+              "w": { "a": 0, "k": 2.5, "ix": 10 }
             },
             {
               "ty": "fl",
@@ -402,8 +404,8 @@
           "o": {
             "a": 1,
             "k": [
-              { "o": { "x": 0.167, "y": 0.167 }, "i": { "x": 0.833, "y": 0.833 }, "s": [0], "t": 0 },
-              { "s": [360], "t": 90.0000036657751 }
+              { "o": { "x": 0.167, "y": 0.167 }, "i": { "x": 0.833, "y": 0.833 }, "s": [28], "t": 0 },
+              { "s": [388], "t": 90.0000036657751 }
             ],
             "ix": 3
           },
@@ -437,7 +439,7 @@
             250,
             250,
             0
-          ], "ix": 2 }, "r": { "a": 0, "k": 60, "ix": 10 }, "sa": { "a": 0, "k": 0 }, "o": { "a": 0, "k": 100, "ix": 11 } },
+          ], "ix": 2 }, "r": { "a": 0, "k": 0, "ix": 10 }, "sa": { "a": 0, "k": 0 }, "o": { "a": 0, "k": 100, "ix": 11 } },
       "shapes": [
         {
           "ty": "gr",
@@ -723,16 +725,16 @@
                 ], "ix": 5 },
               "g": { "p": 3, "k": { "a": 0, "k": [
                     0,
-                    0,
-                    0.7764705882352941,
+                    1,
+                    1,
                     1,
                     0.485,
-                    0.24705882352941178,
-                    0.38823529411764707,
                     1,
                     1,
-                    0.49411764705882355,
-                    0,
+                    1,
+                    1,
+                    1,
+                    1,
                     1
                   ], "ix": 8 } },
               "t": 1,
@@ -746,7 +748,7 @@
               "lj": 1,
               "ml": 4,
               "o": { "a": 0, "k": 100, "ix": 9 },
-              "w": { "a": 0, "k": 0.5, "ix": 10 }
+              "w": { "a": 0, "k": 2.5, "ix": 10 }
             },
             {
               "ty": "fl",
@@ -813,14 +815,14 @@
             0,
             0
           ], "ix": 1 }, "s": { "a": 0, "k": [
-            362.228,
-            362.228,
+            330,
+            330,
             100
           ], "ix": 6 }, "sk": { "a": 0, "k": 0 }, "p": { "a": 0, "k": [
             250,
             250,
             0
-          ], "ix": 2 }, "r": { "a": 0, "k": 30, "ix": 10 }, "sa": { "a": 0, "k": 0 }, "o": { "a": 0, "k": 100, "ix": 11 } },
+          ], "ix": 2 }, "r": { "a": 0, "k": 0, "ix": 10 }, "sa": { "a": 0, "k": 0 }, "o": { "a": 0, "k": 100, "ix": 11 } },
       "shapes": [
         {
           "ty": "gr",
@@ -1106,17 +1108,17 @@
                 ], "ix": 5 },
               "g": { "p": 3, "k": { "a": 0, "k": [
                     0,
-                    1,
-                    0.8235294117647058,
-                    0,
+                    0.0784,
+                    0.7059,
+                    0.2118,
                     0.485,
-                    0.5019607843137255,
-                    0.8117647058823529,
-                    0.5019607843137255,
+                    0.0784,
+                    0.7059,
+                    0.2118,
                     1,
-                    0,
-                    0.8,
-                    1
+                    0.0784,
+                    0.7059,
+                    0.2118
                   ], "ix": 8 } },
               "t": 1,
               "a": { "a": 0, "k": 0 },
@@ -1129,7 +1131,7 @@
               "lj": 1,
               "ml": 4,
               "o": { "a": 0, "k": 100, "ix": 9 },
-              "w": { "a": 0, "k": 0.5, "ix": 10 }
+              "w": { "a": 0, "k": 2.5, "ix": 10 }
             },
             {
               "ty": "fl",
@@ -1168,8 +1170,8 @@
           "o": {
             "a": 1,
             "k": [
-              { "o": { "x": 0.167, "y": 0.167 }, "i": { "x": 0.833, "y": 0.833 }, "s": [0], "t": 0 },
-              { "s": [360], "t": 90.0000036657751 }
+              { "o": { "x": 0.167, "y": 0.167 }, "i": { "x": 0.833, "y": 0.833 }, "s": [-28], "t": 0 },
+              { "s": [332], "t": 90.0000036657751 }
             ],
             "ix": 3
           },

src/index.html

@@ -325,10 +325,10 @@
         };
         document.head.appendChild(script);
 
-        // Progress simulation stages (Guaranteed ~2 seconds duration on refresh)
+        // Progress simulation stages (Guaranteed ~4 seconds duration on refresh: 2% every 90ms reaches 90% in about 4s)
         var interval = setInterval(function () {
           if (progress < 90) {
-            progress += 5;
+            progress += 2;
           } else if (angularReady && progress < 100) {
             progress += 5;
           }
@@ -351,7 +351,7 @@
           }
         }, 90);
 
-        // Enforce minimum hold time (2000ms = 2 seconds) so refresh always shows the animation
+        // Enforce minimum hold time (4000ms = 4 seconds) so refresh always shows the animation
         setTimeout(function () {
           minTimePassed = true;
           if (angularReady) {
@@ -359,7 +359,7 @@
             if (bar) bar.style.width = '100%';
             dismissSplash();
           }
-        }, 2000);
+        }, 4000);
 
         function dismissSplash() {
           if (dismissed) return;
@@ -387,12 +387,12 @@
           }
         };
 
-        // Safety fallback (Max 7s in case of backend network failure)
+        // Safety fallback (Max 9s in case of backend network failure)
         setTimeout(function () {
           angularReady = true;
           minTimePassed = true;
           dismissSplash();
-        }, 7000);
+        }, 9000);
       })();
     </script>