Extend the marketplace

Where integration embeds our lending in your product, a marketplace listing does the reverse: your service plugs into our flow. Lenders and partners switch it on for their pipeline; the platform invokes you at the right moment via events, and you enrich the application with the result. Typical listings include accountancy-data connectors, fraud and KYB checks, valuation and asset-finance tooling, bookkeeping sync and insurance offers.

The extension model

Every marketplace app follows the same four-beat contract. It is deliberately asynchronous — you never block the platform while you do slow work.

1 · Subscribe to platform events

Register your HTTPS endpoint and the events you want. Use wildcards (payment.*) to capture a family. The response returns a whsec_ signing secret — store it; you'll need it to verify every delivery.

curl -s https://hub.credicorp.co.uk/partner/v1/webhook_endpoints \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "url": "https://vendor.example/hooks/credicorp",
    "events": ["application.submitted", "decision.completed"]
  }'
# → { "id": "whe_4Kd", "secret": "whsec_9f2a…" }

Events a marketplace app commonly subscribes to

2 · Acknowledge, then act asynchronously

The platform expects a 2xx within 10 seconds. Verify the Credicorp-Signature header in constant time (full recipe in Request signing roadmap), enqueue the event, and return immediately. Deliveries can arrive more than once, so make handlers idempotent keyed on event.id.

app.post('/hooks/credicorp', (req, res) => {
  const ok = cc.webhooks.verify(
    req.rawBody,
    req.headers['credicorp-signature'],
    process.env.WHSEC
  );
  if (!ok) return res.sendStatus(400);

  const evt = JSON.parse(req.rawBody);
  queue.add('enrich', evt, { jobId: evt.id });  // idempotent
  res.sendStatus(202);                          // ack fast, work later
});

$raw = file_get_contents('php://input');
$sig = $_SERVER['HTTP_CREDICORP_SIGNATURE'] ?? '';

if (! $cc->webhooks->verify($raw, $sig, getenv('WHSEC'))) {
    http_response_code(400); exit;
}

$evt = json_decode($raw, true);
$queue->push('enrich', $evt, jobId: $evt['id']);  // idempotent
http_response_code(202);                              // ack now, act later

3 · Write your result back

Once your worker finishes, attach a structured result to the application. The platform stores it against your listing, surfaces it to the lender, and — where your service is wired into decisioning — can feed it into the engine. Namespace your type with your vendor slug to avoid collisions, and always send an Idempotency-Key.

curl -s https://hub.credicorp.co.uk/partner/v1/applications/app_8Kd2c9Qm/results \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: res-evt_7Hn" \
  -d '{
    "type": "acme.kyb_check",
    "status": "pass",
    "event_id": "evt_7Hn",
    "data": { "score": 0.94, "directors_verified": 2, "pep": false }
  }'

Response 201 Created

{
  "id": "res_5Yh",
  "object": "result",
  "application_id": "app_8Kd2c9Qm",
  "type": "acme.kyb_check",
  "status": "pass",
  "created_at": "2026-06-29T10:00:09Z"
}

4 · Pass verified-vendor review

Before your listing is visible to lenders it goes through verified-vendor review. The badge tells partners your service meets the platform's security and reliability bar. Submit when your sandbox integration is complete; review typically takes a few business days.