# Musaffa

> Musaffa is a New York-headquartered Islamic fintech. It screens 120,000+ stocks and ETFs across
> 70+ global exchanges against an AAOIFI-based Shariah methodology and sells the resulting dataset
> to other businesses as the Musaffa B2B Shariah Compliance API.

Generated by API Evangelist on 2026-08-26 from Musaffa's own public documentation. Musaffa does not
publish an llms.txt of its own (https://musaffa.com/llms.txt returned 404 on 2026-08-26).

## What the API returns

Per ticker: a Shariah-compliance status (COMPLIANT / NON_COMPLIANT / QUESTIONABLE / NOT_COVERED), a
0-5 compliance ranking, a revenue breakdown against the AAOIFI 5% non-permissible-revenue screen,
interest-bearing securities and interest-bearing debt ratios against the AAOIFI 30% screens (both
measured on trailing 36-month average market capitalization), the source filing and reporting
period, and a dividend purification amount per share.

## Base URL and versioning

- Documented prefix: https://platform.musaffa.com/api
- Prefix used by every worked example: https://platform.musaffa.com/b2b/api
- Versions move per operation, not per API. The current (v3) reference mixes v1, v2 and v3 paths.

## Operations

- POST /b2b/api/v1/musaffa/stocks/list — screened stocks for a country + sector
- POST /b2b/api/v3/musaffa/stocks/report — full screening report for one ticker
- POST /b2b/api/v2/musaffa/stocks/screening-list — bulk screening, max 100 tickers per request
- POST /b2b/api/v2/musaffa/stocks/dividends/pure — dividend purification amount per share
- GET  /b2b/api/v1/musaffa/stocks/related/{symbol} — peer securities by market, industry, sector
- Outbound webhook — Musaffa POSTs compliance-status changes to a client-supplied URL

Documented as "Coming soon" and not yet shipped: List of covered stocks, ETF Screening Reports,
List of ETFs.

## Authentication

Not OAuth, not a static API key. Musaffa issues a clientId and a secretKey to each B2B client out of
band; every request carries three headers:

- clientId: the issued client identifier
- time: yyyyMMddHHmmss
- token: Base64(SHA-512(secretKey + time + jsonStringBody))

The signed timestamp expires after 5 seconds (HTTP 400 "Time expired"). The same signature is
applied to outbound webhook deliveries, so a receiver can verify them.

## Rate limits

Up to 100,000 API calls per month and 1 API call per second, plan-dependent (Starter 10,000/month,
Pro 100,000/month, Premium unlimited). Exhaustion returns HTTP 429. No rate-limit response headers
are published — an agent cannot read remaining quota, a limit or a reset time, only the 429.

## Errors

HTTP status codes only: 400, 401, 403, 404, 405, 406, 429, 500, 503. No RFC 9457
application/problem+json, no documented error envelope schema.

## Access

The API is sold, not self-served. There is no developer signup that issues API credentials; access
starts with a demo request or a call at https://musaffa.com/for-business/. Package tiers (Starter,
Pro, Premium, Custom) publish market access, features and monthly call quotas but no prices.

## What Musaffa does NOT publish

- No OpenAPI, Swagger, GraphQL or AsyncAPI document (probed 2026-08-26)
- No client SDK in any language, and no GitHub organization
- No MCP server and no A2A agent card
- No /.well-known/ documents, including security.txt
- No status page, no changelog, no deprecation or sunset policy

## Links

- Company: https://musaffa.com/
- API product page: https://musaffa.com/for-business/
- API reference (current, v3): https://api.musaffa.com/
- API reference v2: https://api.musaffa.com/v2/
- API reference v1: https://api.musaffa.com/v1/
- Screening methodology: https://musaffa.com/screening-methodology/
- Covered countries: https://musaffa.com/covered-countries/
- Disclosure library: https://musaffa.com/disclosure-library/
- Terms of use: https://musaffa.com/terms-of-use/
- Privacy policy: https://musaffa.com/privacy-policy/
- Contact: https://musaffa.com/contact-us/ — info@musaffa.com