Documentation

Authentication

Send Authorization: ApiKey YOUR_KEY on every request. Bearer YOUR_KEY is also accepted. Keys belong to an organization and are shown once at creation.

Permission	Use
`read`	Retrieve applications, documents, credit results, memos, conversations, and exports.
`write`	Create, update, or delete records; upload files; generate memos.

A key needs both permissions for the full quickstart. Records outside its organization return 404.

Uploads return before extraction finishes. Poll GET /applications/{id}/documents or /documents/{docId}. Start with a few seconds between requests, increase the interval, and set a timeout in your client.

Document status	Client action
`awaiting`	Queued; poll again.
`processing`	Extraction is running; poll again.
`verified`	Extraction passed verification; read the results.
`low_confidence`	Inspect `flag_message` and extraction results; arrange review.
`missing`	A required document has not been supplied.

The credit picture updates as documents are accepted. It does not require 100% file completeness. Missing credit results can be null; do not treat them as zero.

Memo generation: POST /applications/{id}/memo returns 202 with data.status of accepted or already_running. Poll /memo/status:

synthesis_in_progress: true: continue polling.
last_run_status: failed: stop and inspect last_run_failure_code and last_run_failure_stage.
A completed run with synthesis_in_progress: false: read /memo.
is_stale: true: the memo needs refreshing against current evidence. It is not proof of a running job.

Retries and duplicate applications

Supply a stable external_ref (your loan ID, up to 200 characters) to POST /intake or POST /applications. Repeating it within the same organization returns the existing application with 200 and idempotent: true. It does not update that application. Repeated intake also skips all attached files.

Use PATCH /applications/{id} for changes and POST /applications/{id}/documents for additional files. After an interrupted or partially failed upload, list the documents and retry only missing files. Upload retries can create duplicates. Do not rely on Idempotency-Key response replay; use external_ref for application deduplication.

Upload limits

Keep the entire multipart request, including metadata and overhead, below 4.5 MB. Upload packages one file per request; reduce individual files that exceed the limit. A batch may store some files before failing, so check the document list before retrying.

Errors

API errors return a message:

{ "message": "This API key lacks the 'write' scope required for this endpoint." }

HTTP status	What to do
`400`	Correct the input using the error message.
`401`	Check the key and Authorization header.
`403`	Check permissions; sample applications also prohibit memo generation.
`404`	Check the identifier, organization, or whether export data exists.
`413`	Reduce the upload size. Hosting-layer errors may not use the JSON envelope.
`500` / `502` / `503`	Retry reads with backoff. Before retrying a write, check whether it took effect.

Application statuses

These describe the lending file, not an extraction job: submitted, awaiting_docs, underwriting, question_raised, memo_drafted, approved, and declined. Approval and decline are lender decisions.

Responses and identifiers

Successful JSON responses use a data envelope. Application lists also include pagination; exports return files. Application endpoints accept the UUID or human-readable app_id (for example, APP-1042). Save the returned identifier instead of constructing one.

Integration guide