Apply API

The resource will live at /partner/v1/applications and will require a write grant (scope to be announced). An application moves through a strict lifecycle; the most reliable way to follow it is to subscribe to webhooks rather than poll. Below: create, retrieve, list and withdraw, then the two integration patterns.

Endpoints

Create an application

Creates an application in the created state and returns a handoff_url. Always send an Idempotency-Key so a retried request does not open a second application for the same borrower.

Body parameters

Request

curl -s https://hub.credicorp.co.uk/partner/v1/applications \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: 7c1f-9b22-001" \
  -H "Content-Type: application/json" \
  -d '{
    "business": { "company_number": "16093826" },
    "amount_pence": 2500000,
    "term_months": 12,
    "purpose": "working_capital",
    "redirect_uri": "https://yourapp.com/return",
    "reference": "INV-4821"
  }'

$application = $cc->applications->create([
  'business'     => ['company_number' => '16093826'],
  'amount_pence' => 2500000,
  'term_months'  => 12,
  'purpose'      => 'working_capital',
  'redirect_uri' => 'https://yourapp.com/return',
  'reference'    => 'INV-4821',
], ['idempotency_key' => '7c1f-9b22-001']);

header('Location: ' . $application->handoff_url);

const application = await cc.applications.create({
  business: { companyNumber: '16093826' },
  amountPence: 2500000,
  termMonths: 12,
  purpose: 'working_capital',
  redirectUri: 'https://yourapp.com/return',
  reference: 'INV-4821',
}, { idempotencyKey: '7c1f-9b22-001' });

res.redirect(application.handoffUrl);

Response 201 Created

{
  "id": "app_8Kd2c9Qm",
  "object": "application",
  "status": "created",
  "business": { "company_number": "16093826", "name": "Credicorp Limited" },
  "amount_pence": 2500000,
  "term_months": 12,
  "purpose": "working_capital",
  "reference": "INV-4821",
  "handoff_url": "https://apply.credicorp.co.uk/s/3fa7c1…",
  "expires_at": "2026-07-06T10:00:00Z",
  "created_at": "2026-06-29T10:00:00Z"
}

Retrieve an application

Returns the current state of one application, including the linked decision once decisioning has run and the account_id once it funds.

curl https://hub.credicorp.co.uk/partner/v1/applications/app_8Kd2c9Qm \
  -H "Authorization: Bearer $TOKEN"

List applications

Returns a cursor-paginated list, newest first. Combine the filters below; all are optional.

curl "https://hub.credicorp.co.uk/partner/v1/applications?status=funded&limit=20" \
  -H "Authorization: Bearer $TOKEN"

Withdraw an application

Cancels an application that has not yet funded and moves it to withdrawn. The call is idempotent — withdrawing an already-withdrawn application returns 200 with no change. Attempting to withdraw a funded application returns 409 conflict; servicing a funded loan is handled through Accounts roadmap.

curl -s -X POST https://hub.credicorp.co.uk/partner/v1/applications/app_8Kd2c9Qm/withdraw \
  -H "Authorization: Bearer $TOKEN" \
  -d '{ "reason": "duplicate" }'

Status values

An application advances through these states. Transitions are one-directional except for the terminal cancel states.

Hosted vs white-label handoff

There are two ways to take the applicant from "created" to "submitted". Pick per integration; you can mix them across products.

Hosted journey (recommended)

Redirect the applicant to the handoff_url returned at creation. Credicorp runs the entire regulated flow — identity, open-banking affordability, consents and the offer screen — on apply.credicorp.co.uk, themed to your brand. When it finishes we redirect back to your redirect_uri with the application_id appended, and fire application.submitted. This is the fastest route to live and keeps the compliance surface with us.

White-label flow

Drive the screens in your own UI and submit collected data through the API. You own the front end; Credicorp still owns decisioning, identity verification and the credit agreement. This unlocks identity and consent endpoints on partner/v1 — see Identity — and requires a completed data-protection review because you are now handling applicant PII directly.

Errors

All errors from this endpoint use the standard hub error envelope. The top-level key is always error — branch your logic on code and quote correlation_id when contacting support.

{
  "error": {
    "code": "validation_failed",
    "message": "The request failed validation.",
    "detail": [{ "field": "amount_pence", "reason": "required" }],
    "correlation_id": "cor_01J2K3M4N5P6Q7R8S9T0A1V2W3",
    "retryable": false
  }
}

The full error code list and all envelope fields are on the Errors page.