cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/applications" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "applicant_entity_id": "biz_example",
  "product_type": "term_loan",
  "requested_amount": {
    "amount": "100000.00",
    "currency": "CAD"
  },
  "purpose": "Equipment purchase",
  "requested_term_months": 36
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/applications",
    headers=headers, timeout=30, allow_redirects=False,
    json={'applicant_entity_id': 'biz_example',
 'product_type': 'term_loan',
 'requested_amount': {'amount': '100000.00',
                      'currency': 'CAD'},
 'purpose': 'Equipment purchase',
 'requested_term_months': 36},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/applications", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "applicant_entity_id": "biz_example",
  "product_type": "term_loan",
  "requested_amount": {
    "amount": "100000.00",
    "currency": "CAD"
  },
  "purpose": "Equipment purchase",
  "requested_term_months": 36
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "app_example",
    "object": "application",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "partial",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "applicant_entity_id": "biz_example",
    "product_type": "term_loan",
    "status": "in_review",
    "requested_amount": {
      "amount": "100000.00",
      "currency": "CAD"
    },
    "requested_term_months": 36,
    "purpose": "Equipment purchase",
    "submitted_at": null,
    "decision_id": "dec_example",
    "loan_id": null,
    "guarantor_entity_ids": [],
    "collateral_ids": [],
    "document_ids": [],
    "channel": "direct",
    "institution_reference": "APP-1001"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "partial"
  }
}

Lending

Create application

Create a credit application.

Required scope: lending:write. Creates application record; does not approve or fund. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

applications

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/applications" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "applicant_entity_id": "biz_example",
  "product_type": "term_loan",
  "requested_amount": {
    "amount": "100000.00",
    "currency": "CAD"
  },
  "purpose": "Equipment purchase",
  "requested_term_months": 36
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/applications",
    headers=headers, timeout=30, allow_redirects=False,
    json={'applicant_entity_id': 'biz_example',
 'product_type': 'term_loan',
 'requested_amount': {'amount': '100000.00',
                      'currency': 'CAD'},
 'purpose': 'Equipment purchase',
 'requested_term_months': 36},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/applications", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "applicant_entity_id": "biz_example",
  "product_type": "term_loan",
  "requested_amount": {
    "amount": "100000.00",
    "currency": "CAD"
  },
  "purpose": "Equipment purchase",
  "requested_term_months": 36
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "app_example",
    "object": "application",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "partial",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "applicant_entity_id": "biz_example",
    "product_type": "term_loan",
    "status": "in_review",
    "requested_amount": {
      "amount": "100000.00",
      "currency": "CAD"
    },
    "requested_term_months": 36,
    "purpose": "Equipment purchase",
    "submitted_at": null,
    "decision_id": "dec_example",
    "loan_id": null,
    "guarantor_entity_ids": [],
    "collateral_ids": [],
    "document_ids": [],
    "channel": "direct",
    "institution_reference": "APP-1001"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "partial"
  }
}

Required scope: lending:write Create a credit application. Required scope: lending:write. Creates application record; does not approve or fund. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID

string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key

string

required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

application/json

applicant_entity_id

string

required

Applicant record.

Minimum string length: 1

product_type

enum<string>

required

Requested credit product.

Available options:

term_loan,

line_of_credit,

revolving,

invoice_finance,

merchant_finance,

equipment_finance,

auto,

mortgage,

consumer_installment,

bnpl,

other

requested_amount

object

required

Requested credit amount and currency.

Show child attributes

purpose

string

Declared use of funds.

Minimum string length: 1

requested_term_months

integer

Requested contractual term in months.

Required range: x >= 1

Response

Create a credit application.

data

application · object

required

Credit request and its lifecycle. Population depends on source and tenant entitlement.

Show child attributes

Get started

Endpoints

Essentials

Create application

Authorizations

Headers

Body

Response