Lead Bank Compliance API
The Compliance API from Lead Bank — 11 operation(s) for compliance.
OpenAPI Specification
openapi: 3.0.1
info:
title: Lead Bank Account Number Compliance API
description: Lead Bank's APIs
version: v1.0
servers:
- url: https://api.sandbox.lead.bank
- url: https://api.lead.bank
security:
- bearerAuth: []
tags:
- name: Compliance
paths:
/v0/applications:
post:
tags:
- Compliance
operationId: create-an-application
summary: Create an application
description: 'Creates a new credit application in terminal status.
## Business Rules
- Applications MUST be created in terminal status (approved, declined, canceled)
- Maximum 20 entities per relationship type
- Cannot mix individual entities with business or sole_prop entities in account_holders; business and sole_prop entities may be combined
- Credit fields required for all applications
- Adverse action notice required for declined applications
- Authorized signers required for commercial account holders
- client_application_id cannot start with reserved prefix ''application_''
- credit.limit cannot exceed credit.max_limit
## Idempotency
The Idempotency-Key header is required. Reusing a key with a different request
body will return a 422 error.
'
parameters:
- name: Idempotency-Key
in: header
required: true
description: Unique key to ensure idempotent requests
schema:
type: string
maxLength: 255
example: app-create-12345-abc
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateApplicationRequest'
examples:
approved_commercial:
summary: Approved commercial application
value:
client_application_id: APP-2024-001
status: approved
entities:
account_holder_type: commercial
account_holders:
- entity_123456789
authorized_signers:
- entity_987654321
details:
product_name: Growth Business Credit Line
credit:
is_secured: true
is_mla: false
currency: USD
underwriting_grade: '99'
limit: 5000000
max_limit: 10000000
report:
score: 780
pulled_at: '2025-11-15T09:30:00Z'
source: experian
decision:
decided_at: '2025-11-17T14:00:00Z'
reason: Approved based on strong cash flow and collateral.
exception_approval_reason: Manual override of automated debt-to-income threshold.
documents:
- document_id: doc_consent_001
type: credit_pull_consent
consented_at: '2025-11-15T09:00:00Z'
declined_consumer:
summary: Declined consumer application
value:
client_application_id: APP-2024-002
status: declined
entities:
account_holder_type: consumer
account_holders:
- entity_consumer_555000111
details:
product_name: Everyday Consumer Card
credit:
is_secured: false
is_mla: true
currency: USD
underwriting_grade: D
limit: 0
max_limit: 0
report:
score: 580
pulled_at: '2025-11-16T10:15:00Z'
source: transunion
adverse_action_notice:
delivered_at: '2025-11-16T10:17:00Z'
reason: Delinquent past credit obligations.
delivery_method: email
decision:
decided_at: '2025-11-16T10:16:00Z'
reason: Does not meet minimum credit score requirements.
documents:
- document_id: doc_aan_999
type: aan
displayed_at: '2025-11-16T10:17:00Z'
canceled_commercial:
summary: Canceled commercial application
value:
client_application_id: APP-2024-003
status: canceled
entities:
account_holder_type: commercial
account_holders:
- entity_biz_777888999
authorized_signers:
- entity_person_111222333
details:
product_name: Secured Starter Loan
credit:
is_secured: true
is_mla: false
currency: USD
limit: 0
max_limit: 0
decision:
decided_at: '2025-11-17T08:00:00Z'
reason: Applicant withdrew request.
documents: []
responses:
'200':
description: Application created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Application'
'400':
description: Malformed request or missing required header.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
examples:
invalid_json:
summary: Malformed JSON
value:
code: payload_invalid
title: Your request body did not parse.
detail: We couldn't parse your request body, please check that your request body is valid JSON.
invalid_parameters: []
missing_idempotency_key:
summary: Missing Idempotency-Key header
value:
code: idempotency_error
title: A required HTTP header is missing.
detail: Please add the Idempotency-Key header to the request.
invalid_parameters: []
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'409':
description: An application with the same data already exists.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'422':
description: Request validation failed.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
examples:
missing_required_fields:
summary: Missing required parameters
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: The request is well-formed but contains semantic errors.
invalid_parameters:
- name: status
reason: missing
- name: entities
reason: missing
invalid_client_id_prefix:
summary: Invalid client_application_id prefix
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: client_application_id cannot start with the reserved prefix 'application_'.
invalid_parameters:
- name: client_application_id
reason: invalid_namespace
missing_aan_for_declined:
summary: Missing adverse action notice for declined status
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: details.decision.adverse_action_notice is required when status is 'declined'.
invalid_parameters:
- name: details.decision.adverse_action_notice
reason: missing_for_status_declined
missing_decision_reason:
summary: Missing decision reason
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: details.decision.reason is required when status is 'approved', 'declined', or 'canceled'.
invalid_parameters:
- name: details.decision.reason
reason: missing
entity_not_found:
summary: Entity ID not found
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: No Entity exists for the provided entity_id 'entity_123...'
invalid_parameters:
- name: entities.account_holders[0]
reason: not_found
limit_exceeds_max:
summary: Credit limit exceeds max limit
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: credit_limit (10000) cannot exceed max_credit_limit (5000).
invalid_parameters:
- name: details.credit.limit
reason: exceeds_max_limit
idempotency_mismatch:
summary: Idempotency key reused with different request
value:
code: idempotency_request_inconsistent
title: The request made does not match the previous request made with this idempotency key.
detail: If you are trying to make a new request, then please update the idempotency key; otherwise, please use the same request body to make this request.
invalid_parameters: []
'429':
description: Rate limit exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: rate_limit_exceeded
title: You've reached the rate limit for this call.
detail: If you are continuously hitting rate limits please contact the Lead team.
invalid_parameters: []
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
/v0/applications/{id}:
get:
tags:
- Compliance
operationId: retrieve-an-application
summary: Retrieve an application
description: 'Retrieves a specific application by its ID.
Accepts either a server-generated ID (application_*) or client-provided application ID.
The server detects the ID type by prefix.
'
parameters:
- name: id
in: path
required: true
description: Server-generated ID (application_*) application ID
schema:
$ref: '#/components/schemas/ApplicationID'
responses:
'200':
description: Application object retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Application'
'400':
description: The format of the application ID is invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: parameters_invalid
title: Your request parameters did not validate.
detail: The format of the application ID is invalid.
invalid_parameters:
- name: id
reason: String must match format application_*
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'404':
description: Application ID passed in is not found.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'429':
description: Rate limit exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: rate_limit_exceeded
title: You've reached the rate limit for this call, your request was not processed.
detail: If you are continuously hitting rate limits please contact the Lead team
invalid_parameters: []
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
patch:
tags:
- Compliance
operationId: update-an-application
summary: Update an application
description: 'Updates properties on an existing application.
Uses JSON Merge Patch semantics (RFC 7396): omitted fields are unchanged,
explicit values overwrite, nested objects merge recursively.
Note: Entity relationships cannot be modified via this endpoint.
Use POST /entity_relationships/batch to add and DELETE /entity_relationships/{entity_id} to remove.
## Idempotency
The Idempotency-Key header is required.
'
parameters:
- name: id
in: path
required: true
description: Application ID
schema:
$ref: '#/components/schemas/ApplicationID'
- name: Idempotency-Key
in: header
required: true
description: Unique key to ensure idempotent requests
schema:
type: string
maxLength: 255
example: app-update-12345-abc
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PatchApplicationRequest'
examples:
update_metadata:
summary: Update metadata
value:
metadata:
external_id: APP-2024-001
update_credit:
summary: Update credit details
value:
details:
credit:
limit: 7500000
update_decision:
summary: Update decision
value:
decision:
decided_at: '2026-01-15T14:30:00Z'
reason: Updated after additional review
responses:
'200':
description: Application updated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Application'
'400':
description: Malformed request or missing required header.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'404':
description: Application ID passed in is not found.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'409':
description: Conflict - idempotency key reuse with different payload.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'422':
description: Request validation failed.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'429':
description: Rate limit exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
/v0/applications/{id}/entity_relationships:
get:
tags:
- Compliance
operationId: list-application-entity-relationships
summary: List application entity relationships
description: Lists all entity relationships for a specific application.
parameters:
- name: id
in: path
required: true
description: Application ID
schema:
$ref: '#/components/schemas/ApplicationID'
- name: limit
in: query
required: false
description: Maximum number of results to return. Defaults to 25, max 100.
schema:
type: integer
minimum: 1
maximum: 100
default: 25
- name: starting_after
in: query
required: false
description: A cursor for pagination. Returns results starting after this cursor.
schema:
type: string
responses:
'200':
description: List of entity relationships for the application.
content:
application/json:
schema:
type: object
properties:
has_more:
type: boolean
description: Indicates whether more results are available beyond this page.
cursor:
type: string
description: Cursor to retrieve the next page of results. Only present when has_more is true.
objects:
type: array
items:
$ref: '#/components/schemas/EntityRelationship'
required:
- has_more
- objects
'400':
description: Your request parameters did not validate.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'404':
description: Application ID does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'429':
description: Too many requests. Please slow down your request rate.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
/v0/accounts:
post:
tags:
- Compliance
operationId: create-an-account
summary: Create an account
description: 'Creates a new account.
## Business Rules
- Status is set to `active` by default on creation
- Maximum 20 entities per relationship type
- Cannot mix individual entities with business or sole_prop entities in account_holders; business and sole_prop entities may be combined
- Authorized signers required for business/sole_prop account holders
- application_id is required for credit accounts
## Idempotency
The Idempotency-Key header is required. Reusing a key with a different request
body will return a 422 error.
'
parameters:
- name: Idempotency-Key
in: header
required: true
description: Unique key to ensure idempotent requests
schema:
type: string
maxLength: 255
example: acct-create-12345-abc
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAccountRequest'
examples:
consumer_deposit:
summary: Consumer deposit account
value:
capabilities:
- deposit
entities:
account_holder_type: consumer
account_holders:
- entity_consumer_123
details:
product_name: Everyday Checking
metadata: {}
documents: []
commercial_credit:
summary: Commercial credit account
value:
application_id: application_xyz123
capabilities:
- credit_with_underwriting
entities:
account_holder_type: commercial
account_holders:
- entity_biz_456
authorized_signers:
- entity_signer_789
details:
product_name: Business Credit Line
credit:
is_secured: false
is_mla: false
underwriting_grade: A
currency: USD
available_credit: 5000000
limit: 5000000
max_limit: 10000000
metadata:
external_id: BIZ-2024-001
documents:
- document_id: doc_terms_001
type: loan_agreement
displayed_at: '2025-11-15T09:00:00Z'
responses:
'200':
description: Account created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Account'
'400':
description: Malformed request or missing required header.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
examples:
invalid_json:
summary: Malformed JSON
value:
code: payload_invalid
title: Your request body did not parse.
detail: We couldn't parse your request body, please check that your request body is valid JSON.
invalid_parameters: []
missing_idempotency_key:
summary: Missing Idempotency-Key header
value:
code: idempotency_error
title: A required HTTP header is missing.
detail: Please add the Idempotency-Key header to the request.
invalid_parameters: []
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'422':
description: Request validation failed.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
examples:
missing_required_fields:
summary: Missing required parameters
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: The request is well-formed but contains semantic errors.
invalid_parameters:
- name: capabilities
reason: missing
- name: entities
reason: missing
entity_not_found:
summary: Entity ID not found
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: No Entity exists for the provided entity_id 'entity_123...'
invalid_parameters:
- name: entities.account_holders[0]
reason: not_found
missing_authorized_signers:
summary: Missing authorized signers for commercial account
value:
code: parameters_invalid
title: Your request parameters did not validate.
detail: Authorized signers are required for commercial account holders.
invalid_parameters:
- name: entities.authorized_signers
reason: missing_for_commercial
idempotency_mismatch:
summary: Idempotency key reused with different request
value:
code: idempotency_request_inconsistent
title: The request made does not match the previous request made with this idempotency key.
detail: If you are trying to make a new request, then please update the idempotency key; otherwise, please use the same request body to make this request.
invalid_parameters: []
'429':
description: Rate limit exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: rate_limit_exceeded
title: You've reached the rate limit for this call.
detail: If you are continuously hitting rate limits please contact the Lead team.
invalid_parameters: []
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
/v0/accounts/{id}:
get:
tags:
- Compliance
operationId: retrieve-an-account
summary: Retrieve an account
description: 'Retrieves a specific account by its ID.
Accepts a server-generated ID (account_*).
Note: Entity relationships are not included in the response.
Use GET /v0/accounts/{id}/entity_relationships to retrieve them.
'
parameters:
- name: id
in: path
required: true
description: Account ID
schema:
$ref: '#/components/schemas/AccountID'
example: account_2N5Hk8xYmQpL9rBvC3jD
responses:
'200':
description: Account object retrieved successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Account'
'400':
description: The format of the account ID is invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: parameters_invalid
title: Your request parameters did not validate.
detail: The format of the account ID is invalid.
invalid_parameters:
- name: id
reason: String must match format account_*
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'404':
description: Account ID passed in is not found.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'429':
description: Rate limit exceeded.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
example:
code: rate_limit_exceeded
title: You've reached the rate limit for this call, your request was not processed.
detail: If you are continuously hitting rate limits please contact the Lead team.
invalid_parameters: []
'500':
description: Server error. Please try your request again.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
patch:
tags:
- Compliance
operationId: update-an-account
summary: Update an account
description: 'Updates properties on an existing account.
Note: To manage entity relationships, use the /entity_relationships endpoints.
Status changes should use dedicated endpoints (/activate, /deactivate, /close).
## Idempotency
The Idempotency-Key header is required.
'
parameters:
- name: id
in: path
required: true
description: Account ID
schema:
$ref: '#/components/schemas/AccountID'
- name: Idempotency-Key
in: header
required: true
description: Unique key to ensure idempotent requests
schema:
type: string
maxLength: 255
example: acct-update-12345-abc
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PatchAccountRequest'
examples:
update_metadata:
summary: Update metadata
value:
metadata:
external_id: BIZ-2024-002
update_credit:
summary: Update credit details
value:
details:
credit:
available_credit: 3000000
limit: 3000000
responses:
'200':
description: Account updated successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/Account'
'400':
description: Malformed request or missing required header.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'401':
description: Valid access token was not used to call the API.
content:
application/json:
schema:
$ref: '#/components/schemas/APIError'
'403':
description: Valid access token lacks the proper scopes.
content:
application/json:
schema:
$ref: '#/components/schemas/APIEr
# --- truncated at 32 KB (88 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/lead-bank/refs/heads/main/openapi/lead-bank-compliance-api-openapi.yml