Skip to navigation
APIEmbed

Create intake

Creates a borrower and loan for one submission and returns an upload URL for it. Reusing a client_reference returns the same borrower and loan instead of creating another pair.

Requires the intake:write scope. Rate limit: 1000 requests per minute per key (the upload lane).

Authentication

AuthorizationBearer

Bearer token. Use ss_live_… for live data or ss_test_… for the sandbox (test mode). See Authentication.

Headers

Idempotency-KeystringOptional<=255 characters

Idempotency token. Retries that reuse the key within 24h replay the original response. Up to 255 characters; a UUID is typical. See Idempotency.

SpreadSpace-VersionstringOptionalformat: "^\d{4}-\d{2}-\d{2}$"

Pin the API version, e.g. 2026-10-07. Omit to get the latest. See Versioning.

Request

This endpoint expects an object.
file_namestringRequired<=255 characters
content_typestringRequired<=100 characters
file_sizelong or nullOptional1-104857600

Optional file size in bytes, reported by the client. The upload itself is capped server-side.

content_hashstring or nullOptionalformat: "^[a-fA-F0-9]{64}$"<=64 characters

SHA-256 hex digest of the file, computed client-side. Used for within-loan duplicate detection. Verified server-side during processing.

client_referencestring or nullOptional<=128 characters

Customer-supplied idempotency / grouping key. Unique per tenant: repeat submissions for the same end-borrower pile onto the same auto-provisioned loan. Omit to always create a new submission.

borrower_namestring or nullOptional<=256 characters

Optional business name for the borrower. When supplied, the borrower is created complete under that name and lists with your other borrowers at once. When omitted, the provisioned borrower gets a placeholder name and is flagged is_intake until someone completes triage, which renames it in place.

Response headers

X-Request-IDstringOptional
Correlation ID for this request. Quote it in support tickets.
Idempotency-Replayboolean

Set to true when the response is replayed from the idempotency cache for a request that re-presented an Idempotency-Key it had already used. Absent on the original (winner) response. A replay repeats the original status and body. When the original could not be stored (an unhandled server fault, or a body over the 1 MiB replay cap) the replay is an error envelope that says so; the operation is never re-run under the same key.

SpreadSpace-VersionstringOptional

The API surface version the server resolved for this request. Always present, regardless of whether the client supplied the request-side SpreadSpace-Version header. Default: 2026-10-07.

RateLimit-Limitinteger

Request budget of the endpoint’s rate-limit policy per 60-second sliding window. See Rate limits.

RateLimit-Remaininginteger

Requests left in the current window. Suppressed on 429 responses produced outside the rate limiter (for example a usage throttle), where a remaining budget would be misleading.

RateLimit-Resetinteger

Seconds until a guaranteed-fresh window.

RateLimit-PolicystringOptional

The active policy in limit;w=window-seconds form.

Response

OK
job_idstring
loan_idstring
borrower_idstring
upload_urlstring
expires_in_secondsinteger

Errors

400
Bad Request Error
401
Unauthorized Error
402
Payment Required Error
403
Forbidden Error
404
Not Found Error
409
Conflict Error
429
Too Many Requests Error
500
Internal Server Error