AIS SANDBOX

User Journey Documentation for Seen Tarbi Sandbox on Seen Tarbi DevPortal

Step 1: Access Seen Tarbi Sandbox

Open the DevPortal: https://xlab.xsquare.sa/

Sandbox API base URL: https://sandbox.seentarbi.sa
In-portal guide (after login): https://docs.xsquare.sa

Step 2: Register

The homepage is the registration form. Complete three steps:

1. Email
2. Details — full name, phone (+966), country, account type (Individual or Company), password
3. Role — Product Manager, Developer, or Business Owner, plus a use case

Already registered? Use Sign in.

Step 3: Set up MFA and sign in

After signup, scan the QR code and enter the TOTP code on MFA verify.

On later visits: https://xlab.xsquare.sa/login → MFA if prompted → dashboard.

Forgot password: https://xlab.xsquare.sa/reset-password

Your developer login is only for the portal. AIS calls use app credentials, not this email/password.

Step 4: Create a sandbox app

Go to Apps (https://xlab.xsquare.sa/dashboard/start-app) and click Create app.

• App name
• Callback URL (optional, e.g. https://your-app.com/callback or http://localhost:3000/callback)

Copy client ID and client secret immediately. The secret is shown once.

There is no Wathq CRN step and no Modal Bank API key.

Step 5: Start a consent (mock bank)

On the app card, click Start sandbox flow. The portal creates a test consent and opens the mock bank:

https://mbank.seentarbi.sa/?consentId=...

Or do the same from Postman / your app via POST /api/consents and open the returned redirect_url. You do not configure a mock-bank URL.

Demo users

Sign in → OTP 1234 → select accounts → approve. Consent must be APPROVED before AIS returns data.

Step 6: Get an app token

POST https://sandbox.seentarbi.sa/oauth2/token
Content-Type: application/x-www-form-urlencoded

client_id=<your-client-id>
&client_secret=<your-client-secret>
&grant_type=client_credentials
&scope=api

Use the returned access_token as Authorization: Bearer ... on every later call.

Step 7: Call AIS

Base path:

https://sandbox.seentarbi.sa/open-banking/account-information/2022.11.01-final-errata2

Every data call needs the Bearer token and ?consentId=<id>.

Start with GET /accounts, then balances, transactions, beneficiaries, and the other resources.

You can:

• Hit endpoints in the portal (Apps wizard, step 2)
• Import the Postman collection + sandbox environment from the portal (step 3)
• Use the OpenAPI file in API Reference

Full walkthrough: https://xlab.xsquare.sa/doc

.