approved, declined, or canceled.
Application Object
entities (sub-object)
Maximum 20 entities per relationship type.
details (sub-object)
details.credit (sub-object)
details.credit.report (sub-object)
The credit report is optional for most programs, but when you supply one, pulled_at and source are always required, and exactly one of score or non_score_value must be provided — the two are mutually exclusive.
Programs whose underwriting policy requires credit bureau data on every approval have an additional check enabled, which requires the report on approved applications. See Validation Rules and Errors.
details.adverse_action_notice (sub-object)
Required when status is declined. All three fields are required when the object is present.
decision (sub-object)
documents (array of objects)
Consent types —
esign_agreement, credit_pull_consent, consent_to_link_account, consent_to_link_hsa, negative_option_consent — require consented_at. Every other type is a disclosure and requires displayed_at. Supplying the wrong timestamp for the type fails validation.Mutability
PATCH /v0/applications/{id} accepts status, details, decision, documents, and metadata. id, created_at, updated_at, and entities are immutable — entities are set when the application is created, and no endpoint adds or removes entity relationships afterward.
Two behaviours to plan for: documents and metadata replace wholesale rather than merging, so send the full intended array or object. And every update runs the same validations as creation, so a correction to declined must also carry details.adverse_action_notice.
For merge-patch semantics, the per-field notes, and the 422 behaviour on immutable fields, see Update an Application.

