Integration guide

Authentication

Send Authorization: ApiKey YOUR_KEY on every request (Bearer YOUR_KEY also works). Keys are organization-scoped and shown once at creation.

The quickstart needs both. Records in other organizations return 404.

Processing and polling

Uploads return before extraction finishes. Poll GET /applications/{id}/documents or GET /applications/{id}/documents/{docId}, backing off from a few seconds, with a client timeout.

The credit picture updates as documents are accepted; it doesn't wait for a complete file. Missing results are null, not zero.

Memo generation: POST /applications/{id}/memo returns 202 with data.status of accepted or already_running. Poll /memo/status:

• synthesis_in_progress: true: continue polling.
• last_run_status: failed: stop and inspect last_run_failure_code and last_run_failure_stage.
• A completed run with synthesis_in_progress: false: read /memo.
• is_stale: true: the memo is out of date with current evidence. It does not mean a job is running.

Retries and duplicate applications

Supply a stable external_ref (your loan ID, up to 200 characters) to POST /intake or POST /applications. Repeating it within the same organization returns the existing application, unchanged, with 200 and idempotent: true; repeated intake also skips attached files.

Use PATCH /applications/{id} for changes and POST /applications/{id}/documents for more files. Upload retries can create duplicates: after a partial failure, list the documents and retry only missing files. Do not rely on Idempotency-Key response replay; deduplicate applications with external_ref.

Required application fields

POST /applications and POST /intake require business_name, borrower_email, loan_type (your organization's configured loan product), and a loan_amount greater than zero. Product-specific answers go in intake_data.

Archiving applications

DELETE /applications/{id} reversibly archives the application; documents, stored files, and child records are retained. The response includes archived: true and archive metadata (deleted: true remains for compatibility). There is no v1 restore or permanent-erasure endpoint; restore through the authorized dashboard archive workflow.

Upload limits

Keep the whole multipart request, including metadata, under 4.5 MB: upload one file per request and shrink files that exceed it. A batch can store some files before failing, and accepted files keep processing, so list documents before retrying. A failed intake may already have created the application: retry with its external_ref to recover it, then upload only missing files.

Exports and transcripts

All are read-only. Transcripts return existing layout text and do not start OCR. Memo section bodies are structured JSON (citation markers removed); do not assume every body is a string.

For lender-owned decisioning, use /decision-input and check assessment.complete and missing_required_metrics; an incomplete result is still usable evidence. /scorecard explains missing configuration or inputs; /historical-precedents returns advisory comparisons when enabled.

Errors

API errors return a message:

{ "message": "This API key lacks the 'write' scope required for this endpoint." }

Application statuses

These describe the lending file, not an extraction job: submitted, awaiting_docs, underwriting, question_raised, memo_drafted, approved, and declined. Approval and decline are lender decisions.

Responses and identifiers

Successful JSON responses use a data envelope; application lists add pagination, and exports return files. Application endpoints accept the UUID or app_id (e.g. APP-1042). Save the returned identifier rather than constructing one.