> ## Documentation Index > Fetch the complete documentation index at: https://docs.lead.bank/llms.txt > Use this file to discover all available pages before exploring further. # Update an Application > Updates properties on an existing application. Uses JSON Merge Patch semantics (RFC 7396): omitted fields are unchanged, explicit values overwrite, nested objects merge recursively. Note: Entity relationships cannot be modified via this endpoint. Use POST /entity_relationships/batch to add and DELETE /entity_relationships/{entity_id} to remove. ## Idempotency The Idempotency-Key header is required. Update mutable properties on an existing application. The endpoint uses JSON Merge Patch semantics (RFC 7396): omitted fields stay unchanged, explicit values overwrite, and nested objects merge recursively. ## Mutable Fields The following top-level fields accept updates on this endpoint. | Field | Notes | | ----------- | -------------------------------------------------------------------------------------------------------------------------- | | `status` | Correct a previously reported terminal state. Allowed values: `approved`, `declined`, `canceled`. | | `details` | Partial update of `product_name`, `credit`, and `adverse_action_notice`. Subfields merge recursively per JSON Merge Patch. | | `decision` | Partial update of the decision sub-object. | | `documents` | Replaces the entire array. To add or remove a single document, send the full intended array. | | `metadata` | Replaces the entire metadata object. | All updates are subject to the same field validations that apply on `POST /v0/applications`. See [Applications API validations](/api-integrations/applications/validations) for the rule set. ## Immutable Fields The following fields cannot be modified after the application is created. * `id` — Server-generated on creation. * `created_at`, `updated_at` — Server-managed timestamps. * `entities` (account holders, authorized signers) — Use `POST /v0/applications/{id}/entity_relationships/batch` to add entities and `DELETE /v0/applications/{id}/entity_relationships/{entity_id}` to remove them. A PATCH that targets an immutable field returns `422 parameters_invalid` with the offending field name in `invalid_parameters`. ## Idempotency The `Idempotency-Key` header is required on every request. ## OpenAPI ````yaml PATCH /v0/applications/{id} openapi: 3.0.1 info: title: Lead Bank description: Lead Bank's APIs version: v1.0 servers: - url: https://api.sandbox.lead.bank - url: https://api.lead.bank security: - bearerAuth: [] tags: - name: ACH - name: Account Number - name: OAuth - name: Events - name: Instant Payments - name: Lending - name: Simulation - name: Internal Transfer - name: Disbursement - name: Entity - name: Wire - name: Originator - name: Funding - name: Balances - name: Compliance - name: UserAccount - name: Blockchain Payment paths: /v0/applications/{id}: patch: tags: - Compliance summary: Update an application description: > Updates properties on an existing application. Uses JSON Merge Patch semantics (RFC 7396): omitted fields are unchanged, explicit values overwrite, nested objects merge recursively. Note: Entity relationships cannot be modified via this endpoint. Use POST /entity_relationships/batch to add and DELETE /entity_relationships/{entity_id} to remove. ## Idempotency The Idempotency-Key header is required. operationId: update-an-application parameters: - name: id in: path required: true description: Application ID schema: $ref: '#/components/schemas/ApplicationID' - name: Idempotency-Key in: header required: true description: Unique key to ensure idempotent requests schema: type: string maxLength: 255 example: app-update-12345-abc requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PatchApplicationRequest' examples: update_metadata: summary: Update metadata value: metadata: external_id: APP-2024-001 update_credit: summary: Update credit details value: details: credit: limit: 7500000 update_decision: summary: Update decision value: decision: decided_at: '2026-01-15T14:30:00Z' reason: Updated after additional review responses: '200': description: Application updated successfully. content: application/json: schema: $ref: '#/components/schemas/Application' '400': description: Malformed request or missing required header. content: application/json: schema: $ref: '#/components/schemas/APIError' '401': description: Valid access token was not used to call the API. content: application/json: schema: $ref: '#/components/schemas/APIError' '403': description: Valid access token lacks the proper scopes. content: application/json: schema: $ref: '#/components/schemas/APIError' '404': description: Application ID passed in is not found. content: application/json: schema: $ref: '#/components/schemas/APIError' '409': description: Conflict - idempotency key reuse with different payload. content: application/json: schema: $ref: '#/components/schemas/APIError' '422': description: Request validation failed. content: application/json: schema: $ref: '#/components/schemas/APIError' '429': description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/APIError' '500': description: Server error. Please try your request again. content: application/json: schema: $ref: '#/components/schemas/APIError' components: schemas: ApplicationID: type: string description: Unique identifier for the application. Prefixed with `application_`. example: application_xyz123 pattern: ^application_\w+$ PatchApplicationRequest: type: object description: Request body for updating an existing application properties: status: $ref: '#/components/schemas/ApplicationStatus' details: $ref: '#/components/schemas/PatchApplicationDetails' decision: $ref: '#/components/schemas/Decision' documents: type: array description: Documents associated with the application items: $ref: '#/components/schemas/CreateComplianceDocument' metadata: type: object description: Arbitrary metadata associated with the application additionalProperties: type: string Application: type: object description: An application object representing a credit application readOnly: true properties: id: $ref: '#/components/schemas/ApplicationID' client_application_id: type: string readOnly: true description: > Client-provided identifier for the application. Optional: present only for applications created via file upload, and omitted for applications created through the API, which are identified solely by their server-generated ID. created_at: type: string format: date-time description: >- Lead server-generated ISO 8601 timestamp when the application was created. updated_at: type: string format: date-time description: >- Lead server-generated ISO 8601 timestamp when the application was last updated. status: $ref: '#/components/schemas/ApplicationStatus' entities: $ref: '#/components/schemas/ApplicationEntities' details: $ref: '#/components/schemas/ApplicationDetails' decision: $ref: '#/components/schemas/ApplicationDecision' documents: type: array description: Documents associated with the application items: $ref: '#/components/schemas/ApplicationComplianceDocument' metadata: type: object description: Arbitrary metadata associated with the application additionalProperties: type: string APIError: type: object properties: code: type: string description: The error code. title: type: string description: The error title. detail: type: string description: A detailed error description. status: type: string description: The HTTP status code. invalid_parameters: type: array description: Invalid request parameters with reasons, if applicable. items: $ref: '#/components/schemas/InvalidParameterDetail' instance: type: string description: >- The object causing this specific occurrence of the error, if applicable. ApplicationStatus: type: string description: >- Terminal state of the application. Possible values: `approved`, `declined`, `canceled`. enum: - approved - declined - canceled PatchApplicationDetails: type: object description: Details for updating an application (all fields optional) properties: product_name: type: string description: >- Your internal product name. This tells Lead's Due Diligence team which product this application, if approved, would open an account for. example: Growth Business Credit Line credit: $ref: '#/components/schemas/PatchApplicationCredit' adverse_action_notice: $ref: '#/components/schemas/AdverseActionNotice' Decision: type: object description: Decision-related information for the application properties: decided_at: type: string format: date-time description: ISO 8601 timestamp when the underwriting decision was made. reason: type: string description: The reason for the decision. exception_approval_reason: type: string description: >- This should only be provided if the decision was made as an exception to underwriting criteria. Reason for exception approval, if this decision was made as an exception to the traditional underwriting process. required: - decided_at - reason CreateComplianceDocument: type: object description: > Document reference for creating applications and accounts. One of `displayed_at` or `consented_at` is required depending on document type: - `displayed_at`: Required for aan, loan_agreement, loc_agreement, truth_in_lending_document, ach_authorization, notice_of_incompleteness, credit_score_notice, offer_summary, personal_guarantee, consumer_credit_auth, partner_privacy_policy, lead_privacy_policy, terms_of_use, fcra_notice, tcpa_consent, patriot_act_notice, mla_notice, pre_approval_terms, eft_authorization, prohibited_industry_certification, decision_maker_document, bo_certification, missed_payments_policy, lead_funds_transfer_agreement - `consented_at`: Required for esign_agreement, credit_pull_consent, consent_to_link_account, consent_to_link_hsa, negative_option_consent properties: document_id: type: string description: >- Unique identifier for the document being referenced. Please use the file name of the file delivered to Lead's `/documents` SFTP directory. example: document_2N5Hk8xYmQpL9rBvC3jD type: $ref: '#/components/schemas/ComplianceDocumentType' displayed_at: type: string format: date-time description: >- ISO 8601 timestamp when the document was displayed to the applicant. Present on disclosure documents. consented_at: type: string format: date-time description: >- ISO 8601 timestamp when the applicant consented to the document. Present on consent documents. version: type: string description: >- It is recommended to use this for static documents uploaded once and uploaded for many users. Uploads with a new version should have a different document_id as well. example: v1 required: - document_id - type oneOf: - title: Disclosure description: Disclosure document — `displayed_at` is required. properties: type: type: string enum: - aan - loan_agreement - loc_agreement - truth_in_lending_document - ach_authorization - notice_of_incompleteness - credit_score_notice - offer_summary - personal_guarantee - consumer_credit_auth - partner_privacy_policy - lead_privacy_policy - terms_of_use - fcra_notice - tcpa_consent - patriot_act_notice - mla_notice - pre_approval_terms - eft_authorization - prohibited_industry_certification - decision_maker_document - bo_certification - missed_payments_policy - lead_funds_transfer_agreement required: - displayed_at - title: Consent description: Consent document — `consented_at` is required. properties: type: type: string enum: - esign_agreement - credit_pull_consent - consent_to_link_account - consent_to_link_hsa - negative_option_consent required: - consented_at ApplicationEntities: type: object readOnly: true description: Entity relationships associated with the application (response only) properties: account_holder_type: type: string description: >- Denotes whether the application is for a consumer or commercial account. `consumer` if all account holders are individuals; `commercial` if all account holders are businesses or sole proprietors. enum: - consumer - commercial example: commercial account_holders: type: array description: List of entity IDs that are account holders items: $ref: '#/components/schemas/EntityID' authorized_signers: type: array description: List of entity IDs that are authorized signers items: $ref: '#/components/schemas/EntityID' ApplicationDetails: type: object readOnly: true description: Application details (response, all properties optional) properties: product_name: type: string description: >- Your internal product name. This tells Lead's Due Diligence team which product this application, if approved, would open an account for. example: Growth Business Credit Line credit: $ref: '#/components/schemas/ApplicationCredit' adverse_action_notice: $ref: '#/components/schemas/ApplicationAdverseActionNotice' ApplicationDecision: type: object readOnly: true description: Decision-related information (response, all properties optional) properties: decided_at: type: string format: date-time description: ISO 8601 timestamp when the underwriting decision was made. reason: type: string description: The reason for the decision. exception_approval_reason: type: string description: >- This should only be provided if the decision was made as an exception to underwriting criteria. Reason for exception approval, if this decision was made as an exception to the traditional underwriting process. ApplicationComplianceDocument: type: object readOnly: true description: >- Document reference associated with an application (response, all properties optional) properties: document_id: type: string description: >- Unique identifier for the document being referenced. Please use the file name of the file delivered to Lead's `/documents` SFTP directory. example: document_2N5Hk8xYmQpL9rBvC3jD type: $ref: '#/components/schemas/ComplianceDocumentType' displayed_at: type: string format: date-time description: >- ISO 8601 timestamp when the document was displayed to the applicant. Present on disclosure documents. consented_at: type: string format: date-time description: >- ISO 8601 timestamp when the applicant consented to the document. Present on consent documents. version: type: string description: >- It is recommended to use this for static documents uploaded once and uploaded for many users. Uploads with a new version should have a different document_id as well. example: v1 InvalidParameterDetail: type: object properties: parameter: type: string description: Which parameter is invalid. example: transaction_type reason: type: string description: Why the parameter is invalid. PatchApplicationCredit: type: object description: Credit details for updating an application (all fields optional) properties: is_secured: type: boolean description: >- Indicates if this is a secured credit/deposit product. `true` if the product is secured (collateral attached); `false` otherwise. is_mla: type: boolean description: >- `true` if the applicant is subject to the Military Lending Act; `false` otherwise. currency: $ref: '#/components/schemas/ComplianceCurrencyCode' underwriting_grade: type: string description: >- Your internal underwriting grade for the applicant. Accepts any string mapped to your specific scoring framework. example: '99' limit: type: integer description: >- The credit limit assigned to the applicant, in minor units (e.g., cents). minimum: 0 example: 5000000 max_limit: type: integer description: >- The maximum credit limit the applicant was approved for based on original underwriting, in minor units (e.g., cents). minimum: 0 example: 10000000 report: $ref: '#/components/schemas/CreditReport' AdverseActionNotice: type: object description: Adverse action notice information properties: delivered_at: type: string format: date-time description: >- ISO 8601 timestamp when the adverse action notice was sent to the applicant. reason: type: string description: The reason stated in the adverse action notice. delivery_method: type: string description: >- How the notice was delivered to the applicant. Possible values: `email`, `text`, `other`. enum: - email - text - other required: - delivered_at - reason - delivery_method ComplianceDocumentType: type: string description: Type of document associated with an application enum: - aan - loan_agreement - loc_agreement - truth_in_lending_document - ach_authorization - notice_of_incompleteness - credit_score_notice - offer_summary - personal_guarantee - consumer_credit_auth - partner_privacy_policy - lead_privacy_policy - terms_of_use - esign_agreement - credit_pull_consent - fcra_notice - tcpa_consent - patriot_act_notice - mla_notice - pre_approval_terms - eft_authorization - prohibited_industry_certification - decision_maker_document - bo_certification - missed_payments_policy - consent_to_link_account - consent_to_link_hsa - negative_option_consent - lead_funds_transfer_agreement EntityID: type: string description: The ID of your entity. example: entity_xyz123 pattern: ^entity_[^\s]{1,33}$ ApplicationCredit: type: object readOnly: true description: Credit details for an application (response, all properties optional) properties: is_secured: type: boolean description: >- Indicates if this is a secured credit/deposit product. `true` if the product is secured (collateral attached); `false` otherwise. is_mla: type: boolean description: >- `true` if the applicant is subject to the Military Lending Act; `false` otherwise. currency: $ref: '#/components/schemas/ComplianceCurrencyCode' underwriting_grade: type: string description: >- Your internal underwriting grade for the applicant. Accepts any string mapped to your specific scoring framework. example: '99' limit: type: integer description: >- The credit limit assigned to the applicant, in minor units (e.g., cents). minimum: 0 example: 5000000 max_limit: type: integer description: >- The maximum credit limit the applicant was approved for based on original underwriting, in minor units (e.g., cents). minimum: 0 example: 10000000 report: $ref: '#/components/schemas/ApplicationCreditReport' ApplicationAdverseActionNotice: type: object readOnly: true description: Adverse action notice information (response, all properties optional) properties: delivered_at: type: string format: date-time description: >- ISO 8601 timestamp when the adverse action notice was sent to the applicant. reason: type: string description: The reason stated in the adverse action notice. delivery_method: type: string description: >- How the notice was delivered to the applicant. Possible values: `email`, `text`, `other`. enum: - email - text - other ComplianceCurrencyCode: type: string description: A three-letter currency code as defined in ISO 4217 enum: - AED - AFN - ALL - AMD - AOA - ARS - AUD - AWG - AZN - BAM - BBD - BDT - BGN - BHD - BIF - BMD - BND - BOB - BRL - BSD - BTN - BWP - BYN - BZD - CAD - CDF - CHF - CLP - CNH - CNY - COP - CRC - CUC - CUP - CVE - CZK - DJF - DKK - DOP - DZD - EGP - ERN - ETB - EUR - FJD - FKP - GBP - GEL - GGP - GHS - GIP - GMD - GNF - GTQ - GYD - HKD - HNL - HTG - HUF - IDR - ILS - IMP - INR - IQD - IRR - ISK - JEP - JMD - JOD - JPY - KES - KGS - KHR - KMF - KPW - KRW - KWD - KYD - KZT - LAK - LBP - LKR - LRD - LSL - LYD - MAD - MDL - MGA - MKD - MMK - MNT - MOP - MRU - MUR - MVR - MWK - MXN - MYR - MZN - NAD - NGN - NIO - NOK - NPR - NZD - OMR - PAB - PEN - PGK - PHP - PKR - PLN - PYG - QAR - RON - RSD - RUB - RWF - SAR - SBD - SCR - SDG - SEK - SGD - SHP - SLE - SOS - SRD - SSP - STD - STN - SVC - SYP - SZL - THB - TJS - TMT - TND - TOP - TRY - TTD - TWD - TZS - UAH - UGX - USD - UYU - UYW - UZS - VES - VND - VUV - WST - XAF - XCD - XCG - XMW - XOF - XPF - YER - ZAR - ZMW - ZWG CreditReport: type: object description: > Credit report information. Exactly one of `score` or `non_score_value` must be provided; `pulled_at` and `source` are always required when a credit report is supplied. required: - pulled_at - source properties: score: type: integer description: >- Credit score returned by the bureau. Supported range is 300-850. Mutually exclusive with `non_score_value`. minimum: 300 maximum: 850 non_score_value: type: string description: >- Indicates the state of a credit file when a numeric score is not available. Mutually exclusive with `score`. enum: - unestablished - frozen pulled_at: type: string format: date-time description: ISO 8601 timestamp when the credit report was pulled. source: type: string description: >- Credit bureau that issued the report. Possible values: `equifax`, `experian`, `transunion`. enum: - equifax - transunion - experian ApplicationCreditReport: type: object readOnly: true description: Credit report information (response, all properties optional) properties: score: type: integer description: >- Credit score returned by the bureau. Supported range is 300-850. Mutually exclusive with `non_score_value`. minimum: 300 maximum: 850 non_score_value: type: string description: >- Indicates the state of a credit file when a numeric score is not available. Mutually exclusive with `score`. enum: - unestablished - frozen pulled_at: type: string format: date-time description: ISO 8601 timestamp when the credit report was pulled. source: type: string description: >- Credit bureau that issued the report. Possible values: `equifax`, `experian`, `transunion`. enum: - equifax - transunion - experian securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````