curl --request PATCH \
--url https://api.sandbox.lead.bank/v2/applications/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"details": {
"underwriting": {
"limit": 7500000
}
}
}
'{
"id": "application_xyz123",
"status": "approved",
"product_name": "Growth Business Credit Line",
"entities": {
"account_holder_type": "commercial",
"account_holders": [
"entity_xyz123"
],
"authorized_signers": [
"entity_xyz123"
]
},
"details": {
"underwriting": {
"is_secured": true,
"is_mla": true,
"currency_code": "AED",
"underwriting_grade": "A2",
"limit": 5000000,
"max_limit": 10000000,
"report": {
"score": 123,
"non_score_value": "unestablished",
"pulled_at": "2023-11-07T05:31:56Z",
"source": "equifax"
}
},
"adverse_action_notice": {
"delivered_at": "2023-11-07T05:31:56Z",
"reason": "<string>",
"delivery_method": "email"
}
},
"documents": [
{
"file_id": "file_7RwQ2mK9pL4xT1vN8jS5",
"timestamp": "2026-09-14T14:20:11Z",
"version": "v2"
}
],
"created_at": "2026-05-14T15:59:30Z",
"updated_at": "2026-05-14T15:59:30Z",
"client_application_id": "APP-2024-001",
"decision": {
"decided_at": "2023-11-07T05:31:56Z",
"reason": "<string>",
"exception_approval_reason": "<string>"
},
"legacy_documents": [
{
"document_id": "loan_agreement_01_2026.pdf",
"type": "aan",
"displayed_at": "2023-11-07T05:31:56Z",
"consented_at": "2023-11-07T05:31:56Z",
"version": "v1"
}
],
"metadata": {}
}{
"code": "request_malformed",
"message": "The request is invalid and cannot be parsed by the server.",
"errors": [
{
"code": "body_malformed",
"message": "The request body is missing or isn't a JSON object."
}
]
}{
"code": "token_invalid",
"message": "The bearer token is missing, expired, malformed, or invalid."
}{
"code": "object_not_found",
"message": "No object exists at the requested ID, or it is not visible to this caller."
}{
"code": "idempotency_key_in_use",
"message": "A concurrent request using this Idempotency-Key is still in flight."
}{
"code": "content_too_large",
"message": "The request is over a size limit for this endpoint. Make it smaller and resend it.",
"errors": [
{
"code": "body_too_large",
"message": "metadata is over this endpoint's size limit.",
"parameters": [
"metadata"
]
}
]
}{
"code": "parameters_invalid",
"message": "One or more parameters are invalid.",
"errors": [
{
"code": "parameter_bound_exceeded",
"message": "details.underwriting.limit (12000000) cannot exceed details.underwriting.max_limit (10000000).",
"parameters": [
"details.underwriting.limit"
]
}
]
}{
"code": "rate_limit_exceeded",
"message": "You have exceeded the rate limit for this endpoint. Retry with backoff."
}{
"code": "internal_server_error",
"message": "Something went wrong on our end. Contact Lead with the Request-Id if this persists."
}{
"code": "service_unavailable",
"message": "The service is temporarily unavailable. Retry after the indicated delay."
}{
"code": "gateway_timeout",
"message": "An upstream system timed out. Retry with backoff."
}Update an Application
Update the product name, details, decision, documents, or metadata on an Application. See Create and update for how PATCH handles each field.
curl --request PATCH \
--url https://api.sandbox.lead.bank/v2/applications/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"details": {
"underwriting": {
"limit": 7500000
}
}
}
'{
"id": "application_xyz123",
"status": "approved",
"product_name": "Growth Business Credit Line",
"entities": {
"account_holder_type": "commercial",
"account_holders": [
"entity_xyz123"
],
"authorized_signers": [
"entity_xyz123"
]
},
"details": {
"underwriting": {
"is_secured": true,
"is_mla": true,
"currency_code": "AED",
"underwriting_grade": "A2",
"limit": 5000000,
"max_limit": 10000000,
"report": {
"score": 123,
"non_score_value": "unestablished",
"pulled_at": "2023-11-07T05:31:56Z",
"source": "equifax"
}
},
"adverse_action_notice": {
"delivered_at": "2023-11-07T05:31:56Z",
"reason": "<string>",
"delivery_method": "email"
}
},
"documents": [
{
"file_id": "file_7RwQ2mK9pL4xT1vN8jS5",
"timestamp": "2026-09-14T14:20:11Z",
"version": "v2"
}
],
"created_at": "2026-05-14T15:59:30Z",
"updated_at": "2026-05-14T15:59:30Z",
"client_application_id": "APP-2024-001",
"decision": {
"decided_at": "2023-11-07T05:31:56Z",
"reason": "<string>",
"exception_approval_reason": "<string>"
},
"legacy_documents": [
{
"document_id": "loan_agreement_01_2026.pdf",
"type": "aan",
"displayed_at": "2023-11-07T05:31:56Z",
"consented_at": "2023-11-07T05:31:56Z",
"version": "v1"
}
],
"metadata": {}
}{
"code": "request_malformed",
"message": "The request is invalid and cannot be parsed by the server.",
"errors": [
{
"code": "body_malformed",
"message": "The request body is missing or isn't a JSON object."
}
]
}{
"code": "token_invalid",
"message": "The bearer token is missing, expired, malformed, or invalid."
}{
"code": "object_not_found",
"message": "No object exists at the requested ID, or it is not visible to this caller."
}{
"code": "idempotency_key_in_use",
"message": "A concurrent request using this Idempotency-Key is still in flight."
}{
"code": "content_too_large",
"message": "The request is over a size limit for this endpoint. Make it smaller and resend it.",
"errors": [
{
"code": "body_too_large",
"message": "metadata is over this endpoint's size limit.",
"parameters": [
"metadata"
]
}
]
}{
"code": "parameters_invalid",
"message": "One or more parameters are invalid.",
"errors": [
{
"code": "parameter_bound_exceeded",
"message": "details.underwriting.limit (12000000) cannot exceed details.underwriting.max_limit (10000000).",
"parameters": [
"details.underwriting.limit"
]
}
]
}{
"code": "rate_limit_exceeded",
"message": "You have exceeded the rate limit for this endpoint. Retry with backoff."
}{
"code": "internal_server_error",
"message": "Something went wrong on our end. Contact Lead with the Request-Id if this persists."
}{
"code": "service_unavailable",
"message": "The service is temporarily unavailable. Retry after the indicated delay."
}{
"code": "gateway_timeout",
"message": "An upstream system timed out. Retry with backoff."
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
A unique key for this request, up to 255 characters. Retrying with the same key and body returns the original response without applying the update twice. See Idempotency.
255Path Parameters
Application ID, prefixed application_.
Unique identifier for the application. Prefixed with application_.
^application_\w+$"application_xyz123"
Body
Request body for PATCH /v2/applications/{id}. Omitted fields are unchanged, and nested objects merge. null is not accepted, so a field cannot be cleared once set.
status is accepted and ignored: status cannot change after creation, so a PATCH that includes status returns 200 and leaves the status unchanged. entities cannot change after creation. Lead ignores entities, client_application_id, legacy_documents, and any other field this endpoint does not define, if sent.
The application's status. Applications created through the API are always approved, declined, or canceled, the statuses POST accepts.
submitted and under_review appear only on applications you reported in an Application file before a decision was made. They are read only: POST does not accept them, and a PATCH that includes status leaves it unchanged.
approved, declined, canceled, submitted, under_review "approved"
Your internal product name.
"Growth Business Credit Line"
Details to change. Nested objects merge; omitted fields are unchanged.
Show child attributes
Show child attributes
Decision fields to change. Fields you send replace the stored values; omitted fields are unchanged.
Show child attributes
Show child attributes
The full intended array of compliance documents. A supplied array replaces the whole array, and Lead re-checks every file_id. To add a document, send every existing entry plus the new one.
Show child attributes
Show child attributes
Key-value pairs for your own use.
Show child attributes
Show child attributes
Response
Application updated.
An application, your report of an underwriting decision. Applications created on v0 are returned in this shape.
Unique identifier for the application. Prefixed with application_.
^application_\w+$"application_xyz123"
The application's status. Applications created through the API are always approved, declined, or canceled, the statuses POST accepts.
submitted and under_review appear only on applications you reported in an Application file before a decision was made. They are read only: POST does not accept them, and a PATCH that includes status leaves it unchanged.
approved, declined, canceled, submitted, under_review "approved"
Your internal product name.
"Growth Business Credit Line"
The entities on the application. Authorized users are not returned here; list them with GET /v2/applications/{id}/entity_relationships.
Show child attributes
Show child attributes
Underwriting and adverse action notice details.
Show child attributes
Show child attributes
Compliance documents linked on v2, each referencing an uploaded file. Always an array.
Show child attributes
Show child attributes
When the application was created. RFC 3339, UTC.
"2026-05-14T15:59:30Z"
When the application was last updated. RFC 3339, UTC.
"2026-05-14T15:59:30Z"
Your ID for applications you reported in an Application file. Lead omits it for applications created through the API.
"APP-2024-001"
When and why the underwriting decision was made. Absent when status is submitted or under_review.
Show child attributes
Show child attributes
Document entries created on v0 Applications, returned exactly as sent. Read only: ignored if included on a POST or PATCH.
Show child attributes
Show child attributes
Key-value pairs for your own use.
Show child attributes
Show child attributes
Was this page helpful?