API and platform events

Everything an officer does in the interface is available over the API. Partner channels, the borrower site and internal services work against the same contracts.

Access and headers

A request is addressed to a specific organization and a specific locale. A key is issued with permissions, rotated without downtime and can be revoked.

API documentation

Organization-Id: Identifies the organization. In separate-database mode it selects the connection.
Language-Code: Response locale: reference data, status names and document texts return in this language.
X-Api-Key: Partner integration key. Its scope limits the set of available methods.
Idempotency-Key: Retry key for money operations: resending does not create a second transaction.

API areas

Methods are grouped by domain and mirror the structure of the platform.

Applications

Creating an application, check steps, documents and underwriting decisions.

/applications

Customers

Profile, identifiers, documents, consents and bank details.

/customers

Contracts

Payment schedule, accruals, payments and allocation across debt components.

/loans

Scoring

Models, rules, features and results with the list of contributing factors.

/scoring

Compliance and AML

Registry checks, alerts, risk profiles and regulator reports.

/compliance, /aml

Collection

Cases, contacts, promises to pay, legal proceedings and assignment batches.

/collection

Funding

Investors, funding contracts, bond series and payouts.

/funding

Reporting

Form templates, drafts, validation and export in the required format.

/reporting, /tax-reporting

Borrower portal

Public methods for the borrower website and mobile app.

/public/customer

Events and webhooks

Contract changes are published outward through an outbox. Delivery is guaranteed by exponential retries, and undelivered messages land in a separate queue rather than being lost.

Event subscription
Destination address, event set and signing secret are configured per organization.
Delivery log
Each attempt shows the response code, the body and the time of the next retry.
Bureau events
Thirty-three contract and credit line event types go to credit bureaus.
Accounting events
Thirty-three event types go to the accounting system over HTTP or file exchange.

Environment and limits

Until a live connection is made, external providers run as stubs: the system responds end to end, but money does not move and real checks are not performed.

Every call to an external service is logged together with the request and response body, and API keys are stored only as a hash.

Request example

GET /Applications/GetApplications?Offset=0&Count=20
Organization-Id: 42
Language-Code: ru
X-Api-Key: ••••••••

API documentation Guides and resources

Response format: JSON in a single envelope: code, success flag, error text and payload.
Pagination: Server-side. Offset and count are sent in the request, the response carries the total count.
Idempotency: Mandatory for money operations and schedule modifications.
Localization: Six languages. The locale comes from the request header, not from an organization setting.
Sandbox: A separate environment with the same contracts and stubs instead of providers.
Versioning: Breaking changes ship as a new version; the previous one keeps working for the support period.

Frequent questions

Can we work through the API only, without the interface

Yes. The officer interface uses the same API, so any scenario available in the interface is available to an external client within the scope of the key.

How is partner authentication handled

A partner receives a key with a limited scope. The key is stored as a hash, rotated without downtime, and every call lands in the external request log with the request and response bodies.

What happens if a payment is submitted twice

Money operations accept a retry key. A repeated request with the same key returns the result of the first operation and does not create a second transaction.

How do we get notified about delinquency or repayment

Through an event subscription. You specify the destination address, the event set and the signing secret. Every delivery attempt is recorded, and failed ones are retried with a growing interval.