> This page is for API. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.spreadspace.app/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.spreadspace.app/_mcp/server. # List loans GET https://api.spreadspace.app/api/loans Lists loans across every borrower you can see, newest first. Requires the `loans:read` scope. Rate limit: 200 requests per minute per key (the `api` lane). Reference: https://docs.spreadspace.app/api/api-reference/loans/list-all ## Authentication - `Authorization` header (bearer token, required) — Bearer token. Use `ss_live_…` for live data or `ss_test_…` for the sandbox (test mode). See [Authentication](https://docs.spreadspace.app/api/authentication). ## Request ### Query parameters - `limit` (integer, optional, default: 50) — Page size, 1 to 100. Defaults to 50. A value outside the range answers 400 `invalid_limit`. - `cursor` (string, optional) — The `next_cursor` from the previous page. - `include` (string, optional) — Expand each loan with `borrower`, `documents`, or both separated by a comma. ### Headers - `SpreadSpace-Version` (string, optional) — Pin the API version, e.g. `2026-10-07`. Omit to get the latest. See [Versioning](https://docs.spreadspace.app/api/versioning). ## Response ### 200 OK - `data` (list of LoanResponse, required) - `has_more` (boolean, required) - `next_cursor` (string, optional, nullable) ## Errors ### 400 Bad Request Error Bad request: validation failed, the cursor is malformed, or the API version is unknown. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 401 Unauthorized Error Unauthorized: the bearer token or API key is missing or invalid. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 402 Payment Required Error Payment required: the standard error envelope with `type` `subscription_required` when the workspace has no active or trialing subscription, or `billing_required` where a plan entitlement applies. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 403 Forbidden Error Forbidden: authentication succeeded but the caller is not permitted to perform this action, for example an API key missing the required scope, an embed session reaching a loan it was not minted for, or a feature outside the workspace's plan. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 404 Not Found Error Not found: the resource does not exist or is not visible to the calling tenant. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 429 Too Many Requests Error Too many requests: the rate limit was hit, or an idempotency-key replay is still in progress. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 500 Internal Server Error Internal server error: an unexpected failure. Quote the `request_id` in support tickets. A mutation sent with an `Idempotency-Key` replays this fault under that key rather than re-running; confirm the resource state before resending with a new key. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ## Types ### LoanResponse - `loan_id` (string, required) - `borrower_id` (string, required) - `assignees` (list of LoanAssigneeResponse, required) - `status` (string, required) - `created_at` (datetime, required) - `updated_at` (datetime, required) - `borrower` (LoanBorrowerSummary, required, nullable) — Borrower summary nested into a LoanResponse when the caller requests `?include=borrower` on a loan list endpoint. Carries the borrower metadata the list surface already exposes (name, entity type, location, industry), never a tax identifier, so a per-loan borrower read is not needed. - `borrower_name` (string, optional, nullable) - `loan_type` (string, optional, nullable) - `loan_sub_type` (string, optional, nullable) - `loan_type_label` (string, optional, nullable) - `loan_sub_type_label` (string, optional, nullable) - `name` (string, optional, nullable) - `loan_number` (string, optional, nullable) - `requested_amount` (string, optional, nullable) — Monetary amount as a decimal string with exactly two decimal places. From 0.00 through 999999999999.99. - `rate_type` (string, optional, nullable) - `interest_rate` (double, optional, nullable) - `term_months` (integer, optional, nullable) - `priority` (string, optional, nullable) - `notes` (string, optional, nullable) - `guarantors` (list of string, optional, nullable) — Guarantor names declared on the loan. Gated like Notes: null when the caller may not read the loan file, and null when none were declared. - `documents` (list of LoanDocumentSummary, optional, nullable) — Nested per-loan document summaries. Populated only when the loan list endpoint was called with `?include=documents` and the caller may read this loan, and null otherwise. The field is always present on the wire; an empty list means the loan has no documents yet. ### ApiErrorBody Inner body of the canonical API error envelope. - `type` (string, required) — Stable error type identifier. Pattern-match on this value, not the human-readable message. - `message` (string, required) — Human-readable error message. Subject to wording changes; do not parse. - `request_id` (string, optional, nullable) — Per-request correlation ID (matches `X-Request-ID` response header). Quote in support tickets. - `details` (map from string to string, optional, nullable) — Structured detail. Some error types populate documented keys in every environment: a version conflict (409) carries `current_version`, the version the resource is actually at, so the client can reload and re-apply. Free-form diagnostic detail beyond those keys appears in development environments only. An `insufficient_credits` 402 carries `balance_usd`, `reserved_usd`, `in_flight_docs`, `incoming_docs` and `per_doc_reservation_usd` as decimal strings. ### LoanAssigneeResponse One user assigned to a loan. `display_name` and `email` are present for workspace callers only; an API-key or embed caller receives `user_id` and `assigned_at` alone. - `user_id` (string, required) - `assigned_at` (datetime, required) ### LoanBorrowerSummary Borrower summary nested into a LoanResponse when the caller requests `?include=borrower` on a loan list endpoint. Carries the borrower metadata the list surface already exposes (name, entity type, location, industry), never a tax identifier, so a per-loan borrower read is not needed. - `borrower_id` (string, required) - `name` (string, required) - `dba_name` (string, optional, nullable) - `legal_entity_type` (string, optional, nullable) - `city` (string, optional, nullable) - `state` (string, optional, nullable) - `industry` (string, optional, nullable) ### LoanDocumentSummary Per-document summary row nested into a LoanResponse when the caller requests `?include=documents`. Summary only (id, category, filename, extraction status, the sentence for a document that could not be extracted, created at), never the extracted figures. Nested only for loans the caller may read. - `extracted_document_id` (string, required) - `document_category` (string, required) - `created_at` (datetime, required) - `original_filename` (string, optional, nullable) - `extraction_status` (string, optional, nullable) - `unextractable_reason` (string, optional, nullable) — A sentence you can show for a document that could not be extracted, for example a bank statement that did not include all of its pages. Null otherwise. ## Examples **Response** ```json { "data": [ { "loan_id": "9876543210abcdef98765432", "borrower_id": "1a2b3c4d5e6f7890b0aa11cc", "assignees": [], "status": "active", "created_at": "2024-02-01T10:00:00.794540+00:00", "updated_at": "2024-02-01T10:00:00.794540+00:00", "borrower": null, "borrower_name": "GreenTech Innovations LLC", "loan_type": null, "loan_sub_type": null, "loan_type_label": null, "loan_sub_type_label": null, "name": "GreenTech Equipment Loan", "loan_number": null, "requested_amount": null, "rate_type": "Fixed", "interest_rate": null, "term_months": null, "priority": null, "notes": null, "guarantors": null, "documents": null }, { "loan_id": "9f8b7c6d5e4a3b2c1d0e4f5a", "borrower_id": "9f8e7d6c5b4a3210a1b2c3d4", "assignees": [ { "user_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "assigned_at": "2024-01-15T09:30:00.125293+00:00" } ], "status": "active", "created_at": "2024-01-15T09:30:00.125293+00:00", "updated_at": "2024-04-10T14:45:00.955345+00:00", "borrower": null, "borrower_name": "Acme Corporation", "loan_type": "CommercialTerm", "loan_sub_type": "TermLoan", "loan_type_label": "Commercial Term", "loan_sub_type_label": "Term Loan", "name": "Acme Corp Term Loan 2024", "loan_number": "ACME-2024-0001", "requested_amount": "250000.00", "rate_type": "Fixed", "interest_rate": 5.75, "term_months": 60, "priority": "high", "notes": null, "guarantors": null, "documents": null } ], "has_more": false, "next_cursor": null } ``` **SDK Code** ```python import requests url = "https://api.spreadspace.app/api/loans" querystring = {"limit":"20"} headers = { "SpreadSpace-Version": "2026-10-07", "Authorization": "Bearer " } response = requests.get(url, headers=headers, params=querystring) print(response.json()) ``` ```javascript const url = 'https://api.spreadspace.app/api/loans?limit=20'; const options = { method: 'GET', headers: {'SpreadSpace-Version': '2026-10-07', Authorization: 'Bearer '} }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.spreadspace.app/api/loans?limit=20" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("SpreadSpace-Version", "2026-10-07") req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.spreadspace.app/api/loans?limit=20") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["SpreadSpace-Version"] = '2026-10-07' request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.spreadspace.app/api/loans?limit=20") .header("SpreadSpace-Version", "2026-10-07") .header("Authorization", "Bearer ") .asString(); ``` ```php request('GET', 'https://api.spreadspace.app/api/loans?limit=20', [ 'headers' => [ 'Authorization' => 'Bearer ', 'SpreadSpace-Version' => '2026-10-07', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.spreadspace.app/api/loans?limit=20"); var request = new RestRequest(Method.GET); request.AddHeader("SpreadSpace-Version", "2026-10-07"); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "SpreadSpace-Version": "2026-10-07", "Authorization": "Bearer " ] let request = NSMutableURLRequest(url: NSURL(string: "https://api.spreadspace.app/api/loans?limit=20")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```