WeLab

aid: welab
name: WeLab
description: 'WeLab is a Hong Kong-headquartered fintech group founded in 2013 (incorporated November 2012 as WeLend) by Simon
  Loong, Kelly Wong and Frances Kang, operating consumer lending, digital banking and payments businesses across Hong Kong,
  mainland China and Indonesia. Its brands include WeLend (Hong Kong online lending), WeLab Digital and Taoxinji (mainland
  China), WeLab Pay, Tianmian Lab, and two licensed digital banks — WeLab Bank Limited, one of Hong Kong''s virtual banks
  licensed by the Hong Kong Monetary Authority in April 2019 and launched to the public in July 2020, and Bank Saqu (formerly
  Bank Jasa Jakarta) in Indonesia. WeLab Bank is the group''s API-bearing entity: under the HKMA Open API Framework it publishes
  an "Open API" developer portal for registered third-party service providers, backed by dedicated production and sandbox
  API gateways that require a client certificate (mutual TLS) before any request is served. Investors across its funding rounds
  include Sequoia Capital, Alibaba Entrepreneurs Fund, Credit Suisse and Allianz.'
image: https://www.welab.bank/uploads/We_Lab_Bank_logo_en_b54140e004.png
url: https://raw.githubusercontent.com/api-evangelist/welab/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.21'
created: '2026-08-05'
modified: '2026-08-05'
tags:
- fintech
- digital-banking
- virtual-bank
- open-banking
- hong-kong
- indonesia
- consumer-lending
- payments
- hkma-open-api
- financial-services
apis:
- name: WeLab Bank Open API
  description: 'WeLab Bank''s Open API programme, published under the Hong Kong Monetary Authority Open API Framework and
    linked as "Open API" from the welab.bank site footer. The developer portal at portal-sandbox.welab.bank carries the API
    catalogue (account information APIs including account balance, account status and account transaction) and a help centre,
    and requires registration with WeLab Bank as a third-party service provider. The API gateways themselves are dedicated
    hosts in AWS ap-east-1 (Hong Kong): api.welab.bank for production and api-sandbox.welab.bank for the sandbox. Both enforce
    mutual TLS — an anonymous request to the sandbox gateway is answered with HTTP 400 "No required SSL certificate was sent"
    — so no operation, schema or specification is reachable without a WeLab-issued client certificate.'
  humanURL: https://portal-sandbox.welab.bank/
  baseURL: https://api.welab.bank
  tags:
  - open-banking
  - hkma-open-api
  - account-information
  - digital-banking
  - hong-kong
  properties:
  - type: DeveloperPortal
    url: https://portal-sandbox.welab.bank/
  - type: Authentication
    url: authentication/welab-authentication.yml
  - type: Conformance
    url: conformance/welab-conformance.yml
  x-evidence:
    checked: '2026-08-05'
    probes:
    - url: https://api-sandbox.welab.bank/
      status: 400
      note: nginx — "No required SSL certificate was sent" (mutual TLS required)
    - url: https://api.welab.bank/
      status: 0
      note: TCP connect timeout from a US network; DNS resolves to prod-opa-gw-public-nlb (AWS ap-east-1)
    - url: https://portal-sandbox.welab.bank/
      status: 403
      note: Cloudflare block page returned to every non-interactive client
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DomainSecurity
  url: security/welab-domain-security.yml
- type: Website
  url: https://www.welab.co/
- type: DeveloperPortal
  url: https://portal-sandbox.welab.bank/
- type: Support
  url: https://www.welab.bank/en/support/
- type: HelpCenter
  url: https://www.welab.bank/en/support/faq/
- type: Blog
  url: https://www.welab.bank/en/blog/
- type: Newsroom
  url: https://www.welab.bank/en/newsroom/
- type: About
  url: https://www.welab.bank/en/about/
- type: TermsOfService
  url: https://www.welab.bank/en/legal/terms-and-conditions/
- type: PrivacyPolicy
  url: https://www.welab.bank/en/legal/privacy-policy/
- type: RegulatoryDisclosures
  url: https://www.welab.bank/en/legal/regulatory-disclosures/
- type: SecurityTips
  url: https://www.welab.bank/en/legal/security-tips/
- type: Careers
  url: https://www.welab.co/en/careers/
- type: Authentication
  url: authentication/welab-authentication.yml
- type: Conformance
  url: conformance/welab-conformance.yml
- type: Lifecycle
  url: lifecycle/welab-lifecycle.yml
- type: LLMsTxt
  url: llms/welab-llms.txt
- type: SecondaryMarketListing
  url: https://www.hiive.com/securities/welab-stock
x-enrichment:
  date: '2026-08-05'
  status: minimal
  artifacts_added: 5
  pass: local-v1
x-coverage:
  state: gated
  reason: partner-login
  detail: WeLab Bank's own footer "Open API" link goes to portal-sandbox.welab.bank, a registered-third-party-service-provider
    portal that answers every non-interactive client with a Cloudflare 403, and its sandbox gateway api-sandbox.welab.bank
    refuses anonymous requests at the TLS layer with HTTP 400 "No required SSL certificate was sent" — so the account balance/status/transaction
    contract cannot be read without a WeLab-issued client certificate.
  evidence:
  - url: https://api-sandbox.welab.bank/
    status: 400
  - url: https://portal-sandbox.welab.bank/
    status: 403
  - url: https://www.welab.bank/en/legal/maintenance-schedule/
    status: 200
  checked: '2026-08-05'