Apply API

The resource lives at /partner/v1/applications and requires the apply:write scope. An application moves through a strict lifecycle; the most reliable way to follow it is to subscribe to webhooks rather than poll. Below: create, retrieve, list and withdraw, then the two integration patterns.

Endpoints

Create an application

Creates an application in the created state and returns a handoff_url. Always send an Idempotency-Key so a retried request does not open a second application for the same borrower.

Body parameters

Request

curl -s https://api.credicorp.co.uk/partner/v1/applications \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: 7c1f-9b22-001" \
  -H "Content-Type: application/json" \
  -d '{
    "business": { "company_number": "16093826" },
    "amount_pence": 2500000,
    "term_months": 12,
    "purpose": "working_capital",
    "redirect_uri": "https://yourapp.com/return",
    "reference": "INV-4821"
  }'

$application = $cc->applications->create([
  'business'     => ['company_number' => '16093826'],
  'amount_pence' => 2500000,
  'term_months'  => 12,
  'purpose'      => 'working_capital',
  'redirect_uri' => 'https://yourapp.com/return',
  'reference'    => 'INV-4821',
], ['idempotency_key' => '7c1f-9b22-001']);

header('Location: ' . $application->handoff_url);

const application = await cc.applications.create({
  business: { companyNumber: '16093826' },
  amountPence: 2500000,
  termMonths: 12,
  purpose: 'working_capital',
  redirectUri: 'https://yourapp.com/return',
  reference: 'INV-4821',
}, { idempotencyKey: '7c1f-9b22-001' });

res.redirect(application.handoffUrl);

Response 201 Created

{
  "id": "app_8Kd2c9Qm",
  "object": "application",
  "status": "created",
  "business": { "company_number": "16093826", "name": "Credicorp Limited" },
  "amount_pence": 2500000,
  "term_months": 12,
  "purpose": "working_capital",
  "reference": "INV-4821",
  "handoff_url": "https://apply.credicorp.co.uk/s/3fa7c1…",
  "expires_at": "2026-07-06T10:00:00Z",
  "created_at": "2026-06-29T10:00:00Z"
}

Retrieve an application

Returns the current state of one application, including the linked decision once decisioning has run and the account_id once it funds.

curl https://api.credicorp.co.uk/partner/v1/applications/app_8Kd2c9Qm \
  -H "Authorization: Bearer $TOKEN"

List applications

Returns a cursor-paginated list, newest first. Combine the filters below; all are optional.

curl "https://api.credicorp.co.uk/partner/v1/applications?status=funded&limit=20" \
  -H "Authorization: Bearer $TOKEN"

Withdraw an application

Cancels an application that has not yet funded and moves it to withdrawn. The call is idempotent — withdrawing an already-withdrawn application returns 200 with no change. Attempting to withdraw a funded application returns 409 conflict; servicing a funded loan is handled through Accounts.

curl -s -X POST https://api.credicorp.co.uk/partner/v1/applications/app_8Kd2c9Qm/withdraw \
  -H "Authorization: Bearer $TOKEN" \
  -d '{ "reason": "duplicate" }'

Status values

An application advances through these states. Transitions are one-directional except for the terminal cancel states.

Hosted vs white-label handoff

There are two ways to take the applicant from "created" to "submitted". Pick per integration; you can mix them across products.

Hosted journey (recommended)

Redirect the applicant to the handoff_url returned at creation. Credicorp runs the entire regulated flow — identity, open-banking affordability, consents and the offer screen — on apply.credicorp.co.uk, themed to your brand. When it finishes we redirect back to your redirect_uri with the application_id appended, and fire application.submitted. This is the fastest route to live and keeps the compliance surface with us.

White-label flow

Drive the screens in your own UI and submit collected data through the API. You own the front end; Credicorp still owns decisioning, identity verification and the credit agreement. This unlocks identity and consent endpoints on partner/v1 — see Identity — and requires a completed data-protection review because you are now handling applicant PII directly.