REST API
The LoanPilot HTTP API — upload statements and read credit decisions programmatically.
REST API
Base URL: https://api.ippo.one/v1. Authenticate with a Bearer token — an API key
for servers, or a per-user login token for mobile apps. Everything is scoped to your team, exactly like the app.
curl https://api.ippo.one/v1/me \
-H "Authorization: Bearer $LOANPILOT_API_KEY"Endpoints
| Method | Path | Description |
|---|---|---|
GET | /v1/me | The user + team the key belongs to |
GET | /v1/analyses | List analyses (limit, offset, status, decision) |
POST | /v1/analyses | Upload a statement (multipart) and start an analysis |
GET | /v1/analyses/{id} | One analysis; ?include_result=true for the full report |
GET | /v1/products | The team's loan products (credit policies) |
POST | /v1/credit-checks | Pull a credit-bureau report (billable; {name, mobile, consent}) |
GET | /v1/credit-checks | List saved credit checks |
GET | /v1/credit-checks/{id} | One credit check + full bureau report |
Create an analysis
POST /v1/analyses is multipart/form-data:
| Field | Notes |
|---|---|
file | the statement PDF (required) |
product_id | the loan product to score under (optional) |
applicant_name, applicant_mobile, bureau_consent | to also pull the bureau (requires entitlement + consent) |
inputs | JSON object of anchors: requested_amount, collateral_value, gst_turnover, down_payment |
curl -X POST https://api.ippo.one/v1/analyses \
-H "Authorization: Bearer $LOANPILOT_API_KEY" \
-F "file=@statement.pdf" \
-F 'inputs={"requested_amount":500000,"collateral_value":700000}'Returns { "id": "...", "ref": "APP-000123", "status": "queued" }. Poll GET /v1/analyses/{id} until
status is completed, then read result.
Decisions assist a human
Derogatory bureau marks, document-integrity flags, mule patterns and name mismatches are routed to manual review — the API returns the decision, your workflow still has a person confirm the flagged ones.
Errors & limits
Errors are JSON with a message (and code where relevant) and the right HTTP status (401 bad key, 404
not found, 429 rate-limited, 422 rejected file). Uploads and bureau pulls are rate-limited per user.
Prefer the SDK or MCP server over raw HTTP where you can.