REST API and webhooks
Everything available in the app is available via the API: creating a check, a link for the borrower, file uploads, provider checks, the summary and PDF. The result arrives by webhook, so there is no need to poll the service.
Plan All plans. The sandbox has the test API only, and the IP allowlist is in Bank Pro and Enterprise.
What’s inside
- REST API with version v1 in the path and a uniform response format
- API key with access rights or OAuth2 client credentials
- The key secret is generated on the server and shown once
- Idempotency key for check creation
- Webhooks for 11 event types with HMAC-SHA256 signatures, retries and a delivery log
- Organization IP address allowlist
- OpenAPI 3.1 documentation with a Scalar interface in six languages
- SLA up to 99.9% on the Bank Pro plan
Limitations
Public and anonymous endpoints are rate limited. A 429 response means retry later after a pause.
FAQ
How do I verify that a webhook came from the platform?
Recompute HMAC-SHA256 over the timestamp and request body with the webhook secret and compare it with the signature header. Reject timestamps that are too old.
What happens if I repeat check creation after a timeout?
With the same idempotency key, the check that was already created is returned, and no duplicate appears.
Use cases with this feature
Other features
Shall we run a check on your report?
Send an anonymized sample report from the country you need: we will break it down in a demo and show the flags, the summary and the connection to your system.