Advanta funder API

GET/v1/health

Whether the API is up. Public: no key, no data, no database call.

Scope

None: public, no key

Returns

200{ status, api_version, time }

Errors

None

Advanta's own checks read it every 5 minutes; the results are on the public status page.

curl -s "$BASE/v1/health"

GET/v1/me

Who is calling: the key, its funder, its environment and its scopes.

Scope

Any valid key

Returns

200{ api_version, environment, funder, key }

Errors

405method_not_allowed

key.prefix is the first 12 characters of the key. key.expires_at is null for a key that does not expire; key.prospect names who a sandbox key was issued to.

curl -s "$BASE/v1/me" \
  -H "Authorization: Bearer $ADVANTA_KEY"

{
  "api_version": "2026-09-23",
  "environment": "sandbox",
  "funder": {
    "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3",
    "name": "Compartment Demo (LU)"
  },
  "key": {
    "id": "0b3c6a52-5d0e-4b53-9d0e-1c2b3a4d5e6f",
    "name": "sandbox · Example prospect",
    "prefix": "adv_fk_1a2b3",
    "scopes": ["requests:read", "limits:read", "webhooks:write"],
    "created_at": "2026-09-23T18:00:00Z",
    "expires_at": "2026-10-07T18:00:00Z",
    "prospect": "Example prospect"
  }
}

GET/v1/requests

The requests routed to you (you can act on them) and those you already acted on (read only, even after a re-routing), newest first, each with your own offer in my_offer if you made one.

Scope

requests:read

Returns

200{ funder, count, requests[] }

Errors

Only the common ones (401, 403, 500).

A request carries id, request_ref, type (factoring or confirming), status, total_amount, advance_amount, the seller in company_name and company_nif, invoice_count, assigned_bank_id, consent_level_required (what every debtor must sign before it can be funded, set when it was routed), its timestamps and, per debtor, debtor_consent. The spec lists every field.

curl -s "$BASE/v1/requests?status=all&limit=50" \
  -H "Authorization: Bearer $ADVANTA_KEY"

const BASE = 'https://bzsengbmlzzhztjfvcag.supabase.co/functions/v1/funder-api';
const headers = { Authorization: `Bearer ${process.env.ADVANTA_KEY}` };

const res = await fetch(`${BASE}/v1/requests?status=open&limit=200`, { headers });
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const { funder, requests } = await res.json();

// Routed to you (you can act on them) and not priced by you yet
const toPrice = requests.filter((r) => r.assigned_bank_id === funder.bank_id && !r.my_offer);
for (const r of toPrice) console.log(r.request_ref, r.type, r.total_amount, r.company_name);

{
  "funder": {
    "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3",
    "name": "Compartment Demo (LU)"
  },
  "count": 1,
  "requests": [
    {
      "id": "4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87",
      "request_ref": "FR-2026-0042",
      "type": "factoring",
      "status": "terms_sent",
      "total_amount": 18450.00,
      "company_name": "Example Seller, S.L.",
      "invoice_count": 3,
      "assigned_bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3",
      "consent_level_required": "acknowledgment",
      "created_at": "2026-09-22T09:12:00Z",
      "my_offer": {
        "funding_request_id": "4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87",
        "rate": 2.4,
        "advance_pct": 90,
        "days": 60,
        "status": "pending",
        "submitted_at": "2026-09-23T10:30:00Z",
        "accepted_at": null
      },
      "debtor_consent": [
        {
          "debtor_name": "Example Buyer, S.A.",
          "debtor_tax_id": "A00000000",
          "status": "pending",
          "level_required": "acknowledgment",
          "level_achieved": null,
          "meets_requirement": false
        }
      ]
    }
  ]
}

GET/v1/requests/{id}

The underwriting packet of one request: the request, its receivables, the seller's latest Advanta Score, your own offer and risk, the fraud signals and disputes on the request as your portal shows them.

Scope

requests:read

Returns

200{ request, debtor_consent[], receivables[], score, my_offer, risk }

Errors

404not_found

score runs from 300 to 850, with a grade from A to E and its dimensions. It is computed on the spot when the seller has none yet, and is null if that fails. Each receivable has invoice_no, invoice_amount, invoice_date, invoice_due_date and the debtor in customer_name. debtor_consent gives each debtor's notice status, the level required and the level signed (level_achieved), meets_requirement, the channel, the declaration text signed and who signed it.

risk.signals lists the fraud signals still open or confirmed, each with a stable code (for example amount_above_history) and a severity. A hard one (for example an amount changed while the invoice is in a request, a credit note against it or an open dispute) stops routing and funding until Advanta's operations team reviews it; the others only flag. risk.disputes lists every dispute recorded against the request.

curl -s "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/requests/{id}/decision

Offer terms, decline, fund, or record a settlement. The request must be routed to you, else 409 not_routed_to_you.

The body takes one of four shapes, chosen by decision:

Scope

decisions:write

Returns

201{ decision, request_id, offer_id, expires_at, status } (offer)

200{ decision, request_id, status } (decline)

200{ decision, request_id, status, funded_at } (fund)

200{ decision, request_id, settlement_id, status, received_total, request_total, outstanding } (settle)

Errors

400reason_required

403not_your_request (settle only: you are not the funder of record)

404not_found

409not_routed_to_you, invalid_state, credit_limit, funding_gate_failed, funding_amount_mismatch, debtor_not_eligible_for_funder, documents_missing_for_funder

422invalid_terms, invalid_amount, invalid_received_at, invalid_funding_details, step_back_message_required, invalid_decision

curl -s -X POST "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/decision" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"decision":"offer","rate":2.4,"advance_pct":90,"days":60,"valid_days":7,"notes":"Subject to the notice being acknowledged"}'

async function offer(requestId, terms) {
  const res = await fetch(`${BASE}/v1/requests/${requestId}/decision`, {
    method: 'POST',
    headers: { ...headers, 'Content-Type': 'application/json' },
    body: JSON.stringify({ decision: 'offer', ...terms }),
  });
  const body = await res.json();
  if (res.status === 201) return body; // { decision, request_id, offer_id, expires_at, status }
  const { code, message, debtors } = body.error;
  if (code === 'debtor_not_eligible_for_funder') {
    for (const d of debtors) console.warn(d.name ?? d.debtor_key, d.reason, d.invoices);
  }
  throw new Error(`${res.status} ${code}: ${message}`);
}

await offer('4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87', { rate: 2.4, advance_pct: 90, days: 60, valid_days: 7 });

{
  "decision": "offer",
  "request_id": "4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87",
  "offer_id": "7a9e3c1b-2d4f-4e6a-8b0c-5d1e2f3a4b5c",
  "expires_at": "2026-09-30T10:30:00Z",
  "status": "terms_sent"
}

{ "decision": "decline", "reason": "concentration", "notes": "We cannot fund this buyer this quarter", "internal_note": "Group exposure above our internal limit" }

{ "decision": "fund", "value_date": "2026-10-01", "reference": "TRF-2026-1001-07" }

{ "decision": "settle", "amount": 12500.00, "received_at": "2026-10-30T10:00:00Z", "reference": "ADV-A1F51301-1000" }

POST/v1/requests/{id}/consent-level

Raise what the debtors of one request must sign. Only upwards, only on a factoring request routed to you and in flight, and only before any of its debtors has answered.

Scope

decisions:write

Returns

200{ request_id, consent_level_required, changed, from }

Errors

404not_found

409not_routed_to_you, level_lower, notice_already_decided, not_factoring, request_not_in_flight

422level_invalid, reason_required

curl -s -X POST "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/consent-level" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"level":"acceptance","reason":"Credit committee asked for acceptance on this buyer"}'

GET/v1/requests/{id}/documents

The deal file of one request. When the request was routed to you, and again when it was funded, Advanta recorded which version of each document you require satisfied you: its file name, SHA-256, issue and validity dates, and when and how Advanta verified it. That record never changes, even when the seller uploads newer versions; each entry also says where the document stands today, and current lists the seller's current documents.

Scope

requests:read

Returns

200{ request_id, seller_country, today, required_now, snapshots[], current[] }

Errors

404not_found

Every entry with a file carries a download_url valid for two minutes (url_expires_in), and each URL issued is logged. Compare the SHA-256 of what you download with the one recorded.

curl -s "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/documents" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/required-documents

The documents you require from sellers, per seller country, and the catalogue they are chosen from: each document's code, its name in seven languages, issuer, usual validity and sensitivity. The usual validity only pre-fills: the date printed on the document is what the seller records and Advanta checks.

Scope

requests:read

Returns

200{ funder, required, catalogue[] }

Errors

Only the common ones (401, 403, 500).

A request is routed to you, your offer is recorded and the request is funded only while every document on your list for the seller's country is verified by Advanta and valid on that date; otherwise 409 documents_missing_for_funder.

curl -s "$BASE/v1/required-documents" \
  -H "Authorization: Bearer $ADVANTA_KEY"

PUT/v1/required-documents

Replace your list for one seller country; an empty list clears it. Codes come from the catalogue, and the change is kept on Advanta's evidence chain with note. Requests already with you stay with you; your next offer or funding on one of them waits until the seller meets the new list (open_requests_not_meeting counts them).

Scope

settings:write or decisions:write

Returns

200{ …required documents, changed, country, codes, open_requests_not_meeting }

Errors

422body_required, country_invalid, codes_invalid, note_invalid, country_without_catalogue, document_code_unknown

curl -s -X PUT "$BASE/v1/required-documents" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"country":"PT","codes":["cert_hacienda","cert_seguridad_social","cirbe"],"note":"Credit committee of 23 September"}'

GET/v1/settings

What your debtors must sign before you fund: the level every debtor must sign before a factoring request routed to you can be funded (receipt, then acknowledgment, then acceptance), whether only counsel-approved declaration texts count, your open requests per level, and which levels each governing law has declaration texts for, in which languages.

Scope

requests:read

Returns

200{ funder, debtor_consent_level, require_counsel_approved_texts, open_requests_by_level, levels, levels_by_law, texts_counsel_approved }

Errors

Only the common ones (401, 403, 500).

curl -s "$BASE/v1/settings" \
  -H "Authorization: Bearer $ADVANTA_KEY"

PUT/v1/settings

Change what your debtors must sign. The change applies to requests routed to you from then on; a request already routed keeps the level it was routed with. reason is kept on Advanta's evidence chain.

Scope

settings:write or decisions:write

Returns

200{ …settings, changed, open_requests_keep_their_level }

Errors

422level_invalid, invalid_flag, reason_required

curl -s -X PUT "$BASE/v1/settings" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"debtor_consent_level":"acknowledgment","reason":"Credit committee decision of 22 September"}'

GET/v1/programme

Your programme terms: your default, the terms you set for particular companies, the companies you can set terms for (those with a request routed to you, and your own clients), and your factoring requests counted by the terms they carry. A request takes the terms in force when it is routed to you and keeps them.

Scope

requests:read

Returns

200{ funder, bank_id, default, companies[], sellers[], requests }

Errors

Only the common ones (401, 403, 500).

disclosure: announced (the default): each debtor is notified and acknowledges the assignment before you fund. confidential: when the request is routed to you, the notice to each debtor is prepared, fingerprinted (SHA-256) and stored ready to send, and funding does not wait for the debtor. Before funding, every blocking invoice check must pass, the invoices must come from the seller's own books (ERP, e-invoice or SAF-T), every debtor must have a current prepared notice naming you and an address to send it to, and the seller's verification must be approved. The notices are sent when you announce the request, and automatically on a funded request when a trigger you turned on is met: announce_overdue_days, announce_on_dispute, announce_on_kyc_lapse.

recourse: with or without. recourse_days: days after an invoice's due date before a funded request not yet settled opens a claim (null: none). bank_data: off, requested (the seller is asked to connect its business bank account for you, read-only and with its consent) or required (funding also waits until the account you pay into is confirmed as the seller's own).

curl -s "$BASE/v1/programme" \
  -H "Authorization: Bearer $ADVANTA_KEY"

{
  "funder": { "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3", "name": "Example Funder" },
  "default": {
    "disclosure": "announced",
    "recourse": "with",
    "recourse_days": 30,
    "announce_overdue_days": null,
    "announce_on_dispute": false,
    "announce_on_kyc_lapse": false,
    "bank_data": "requested",
    "source": "funder_default",
    "updated_at": "2026-09-28T10:00:00Z"
  },
  "companies": [
    {
      "seller_id": "2f6d8a4e-1b3c-4d5e-9f70-8a1b2c3d4e5f",
      "company_name": "Example Seller, S.L.",
      "tax_id": "B00000000",
      "terms": { "disclosure": "confidential", "recourse": "with", "recourse_days": 30, "announce_overdue_days": 15, "announce_on_dispute": true, "announce_on_kyc_lapse": true, "bank_data": "required", "source": "seller" },
      "reason": "Credit committee of 28 September"
    }
  ],
  "requests": { "announced:with:open": 4, "confidential:with:funded": 1 }
}

PUT/v1/programme

Change your default (no seller_id) or one company's terms. Only the keys you send change; {"reset": true} with a seller_id returns that company to your default. The change applies to requests routed to you from then on; requests already routed keep their terms. reason is kept on Advanta's evidence chain.

Scope

settings:write or decisions:write

Returns

200{ funder, bank_id, seller_id, terms, changed, open_requests_keep_their_terms }

Errors

422body_invalid, seller_id_invalid, terms_invalid, terms_key_unknown, reason_required, seller_not_in_programme

curl -s -X PUT "$BASE/v1/programme" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"seller_id":"2f6d8a4e-1b3c-4d5e-9f70-8a1b2c3d4e5f","terms":{"disclosure":"confidential","announce_overdue_days":15,"announce_on_dispute":true,"announce_on_kyc_lapse":true,"bank_data":"required"},"reason":"Credit committee of 28 September"}'

POST/v1/requests/{id}/announce

Announce a confidential request routed to you: it becomes announced and the notices prepared for it are sent to its debtors, who then acknowledge them as in an announced programme. Possible while the request is pending, under review, with terms sent, approved or funded. A request.announced event follows; once a notice has been sent the request stays announced.

Scope

decisions:write

Returns

200{ request_id, disclosure, trigger, notices, sending_queued }

Errors

403not_routed_to_you

404not_found

422body_invalid, reason_required, already_announced, request_closed

curl -s -X POST "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/announce" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Invoice 2026-118 is 20 days overdue"}'

GET/v1/requests/{id}/notices

The request's notices of assignment, one per debtor, each with its prepared document when there is one: the exact subject and HTML the debtor receives, its language, governing law and SHA-256. For a request routed to you, or one you acted on.

Scope

requests:read

Returns

200{ request_id, count, notices[] }

Errors

404not_found

The HTML carries a placeholder, ACK_LINK in double braces, where the debtor's acknowledgment link goes; the link holds a secret and is never shown. current says the document still matches the notice's invoices and amount.

curl -s "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/notices" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/requests/{id}/cash-flow

What the seller shares with you from its business bank account, read-only and with its consent, through a licensed account-information provider: the connection, its accounts (the last four characters of each IBAN) and their balances, twelve months of movements by month, and the check of its payout account. cash_flow is null while the seller has not connected an account for you.

Scope

requests:read

Returns

200{ request_id, bank_data, cash_flow, bank_data_problems[], payment_alerts[] }

Errors

404not_found

bank_data_problems says what funding still waits for when your terms require bank data. payment_alerts are the payments the seller received from a debtor of this request after you funded it under confidential terms. A seller's consent is given to one funder: you see only what it shares with you.

curl -s "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/cash-flow" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/recourse

Your funded factoring requests by recourse type (with, without, and not_recorded for those routed before 28 September 2026), the claims counted by kind and status, and the claims, open ones first. A claim opens once per request, when a funded request is not settled recourse_days after an invoice's due date: recourse, against the seller, for the amount advanced plus your fees, less what you already collected; debtor_default, without recourse, for your own collections and insurance.

Scope

requests:read

Returns

200{ funder, bank_id, currency, as_of, by_type[], claims[], list[] }

Errors

422status_invalid

The seller repays a recourse claim into pay_to_iban quoting pay_reference. When the payments you record from then on (a statement line you confirm, or the settle decision) cover claim_amount, the claim is settled and the request closes as settled by recourse: the invoices go back to the seller, still unpaid by the debtor.

curl -s "$BASE/v1/recourse?status=open" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/recourse/{id}/close

Close an open claim of yours: a recourse claim is withdrawn (waived, or agreed otherwise with the seller), a debtor default is written_off (passed to your collections or your insurer). reason is kept on Advanta's evidence chain.

Scope

decisions:write

Returns

200{ claim_id, status }

Errors

403not_your_claim

404not_found

422body_invalid, status_invalid, reason_required, close_invalid, claim_closed

curl -s -X POST "$BASE/v1/recourse/$CLAIM_ID/close" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"withdrawn","reason":"Payment plan agreed with the seller on 2 October"}'

GET/v1/bank-data

Your own collection account, connected by your administrator in the portal and read the same way: its movements go through the same matching as POST /v1/statements, so collections match your funded requests without uploading files. Also how many sellers share their account with you, the payment alerts on your requests (the last 180 days) and the provider's charges recorded against you, by month.

Scope

requests:read

Returns

200{ funder, bank_id, own_accounts[], sellers_sharing, payment_alerts[], charges[] }

Errors

Only the common ones (401, 403, 500).

unit_price_eur and amount_eur are null until the provider's price is fixed.

curl -s "$BASE/v1/bank-data" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/credit-limits

Your book per debtor: your limit and what is outstanding, committed, offered and still available, in euros.

Scope

limits:read or requests:read

Returns

200{ funder, currency, count, debtors[] }

Errors

Only the common ones (401, 403, 500).

Each debtor carries debtor_key, debtor_name, debtor_country, limit_status, limit_amount, outstanding, committed, offered, available, overdue_count, oldest_overdue, frozen, decided_at and note.

curl -s "$BASE/v1/credit-limits" \
  -H "Authorization: Bearer $ADVANTA_KEY"

PUT/v1/credit-limits

Set or revise your limit on a debtor, or refuse the debtor. The database refuses any later offer this limit cannot hold.

Scope

limits:write or decisions:write

Returns

200{ credit_limit }

Errors

422debtor_tax_id_required, invalid_amount, invalid_limit

curl -s -X PUT "$BASE/v1/credit-limits" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"debtor_tax_id":"A00000000","debtor_country":"ES","debtor_name":"Example Buyer, S.A.","amount":250000,"status":"active"}'

POST/v1/credit-limits/import

Load up to 2,000 limits on debtors in one call: your own book, or your credit insurer's limits. Each row is checked exactly as PUT /v1/credit-limits checks one and is answered on its own: a row that fails does not stop the others, and a debtor that appears twice in one call is refused the second time.

Scope

limits:write or decisions:write

Returns

200{ funder, source, source_ref, received, written, refused, rows[] }

Errors

413too_many_rows

422rows_required, invalid_source, source_ref_invalid, source_ref_too_long

Every limit written records its source and reference, on the limit and on its history. The answer counts received, written and refused, and answers each row with row (counted from 1), debtor_tax_id and ok: a written row adds debtor_key, status and amount; a refused row gives its error (invalid_amount, debtor_tax_id_required, duplicate_debtor, invalid_status, amount_required, invalid_country, row_invalid or invalid_limit) and may add a detail.

curl -s -X POST "$BASE/v1/credit-limits/import" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"source":"insurer","source_ref":"Insurer limits 2026-09","rows":[{"debtor_tax_id":"A00000000","debtor_country":"ES","debtor_name":"Example Buyer, S.A.","amount":250000},{"debtor_tax_id":"500000000","debtor_country":"PT","status":"refused"}]}'

GET/v1/seller-limits

Your book per seller, with the same figures as the debtor book.

Scope

limits:read or requests:read

Returns

200{ funder, currency, count, sellers[] }

Errors

Only the common ones (401, 403, 500).

Each seller carries seller_id, seller_name, seller_nif, seller_country and the same limit and exposure fields as a debtor.

curl -s "$BASE/v1/seller-limits" \
  -H "Authorization: Bearer $ADVANTA_KEY"

PUT/v1/seller-limits

Set or revise your limit on a seller, or refuse the seller.

Scope

limits:write or decisions:write

Returns

200{ seller_limit }

Errors

404not_found

422seller_id_required, invalid_amount, invalid_limit

curl -s -X PUT "$BASE/v1/seller-limits" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"seller_id":"2f6d8a4e-1b3c-4d5e-9f70-8a1b2c3d4e5f","amount":100000,"status":"active","note":"Annual review"}'

GET/v1/payer-record

How a buyer pays its suppliers, as aggregates only, from the ledgers of the suppliers connected to Advanta. The record is published when at least three suppliers observe the buyer; otherwise status says why and every figure is null. You can read it only for a buyer on a request in your scope or on your debtor list; a sandbox key reads the demonstration plane's record.

Scope

limits:read or requests:read

Returns

200{ funder, payer_record }

Errors

404not_found (the buyer is on no request in your scope and not on your debtor list)

422tax_id_required

Figures include observers, invoice_count, avg_days_to_pay, median_days_to_pay, on_time_pct, the settlement delay (avg_settle_delay_days, median_settle_delay_days, p75_settle_delay_days, worst_settle_delay_days), open and overdue counts, window_from and refreshed_at. payer_record is null when there is no record.

curl -s "$BASE/v1/payer-record?tax_id=A00000000&country=ES" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/requests/{id}/debtors

What Advanta knows about each debtor on a factoring request routed to you, or one you acted on: its level on Advanta since level_since (notice: it knows Advanta from the notice only; account: it claimed its payer account; books: it connected its accounting system; buyer: it runs a buyer programme, and buyer_programme is true), the seller's own history with it, its official payment period when it is a public body, and your own limit on it.

Scope

requests:read

Returns

200{ funder, request_id, count, debtors[] }

Errors

404not_found

score is the debtor's own score (grade, 0 to 100, when and by which model version). It is given only when the debtor shares its data with the funders that finance invoices owed by it, is at level books or buyer, and the request is routed to you (not one you only acted on); otherwise it is null. pair_history is the seller's history with this debtor over 36 months, with the payer record's rules: real invoices only, and lateness only against due dates stated on the document or in the ERP. public_payment_period is the latest official average payment period of a public body (DGAL for Portuguese municipalities, Hacienda for Spanish local entities). credit_limit is your limit on the debtor, where it came from (source, source_ref) and what is used (exposure: outstanding plus committed plus offered, in euros).

curl -s "$BASE/v1/requests/4c1e0d2a-8f3b-4f6e-9a55-3c2b1d0e9f87/debtors" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/statements

Send the statement of your collection account for matching: a CAMT.053 (XML) or CSV file, at most 4 MiB and 5,000 transactions. Each credit is matched against your own funded requests, first on the reference the debtor quoted. Nothing is settled until you confirm a match in the portal. The same file twice is refused, by its SHA-256.

Scope

statements:write or decisions:write

Returns

201{ import_id, file_sha256, lines, credits, duplicates, proposed, suggested, unmatched, ignored, … }

Errors

409statement_already_imported

413file_too_large, too_many_lines

422file_required, file_unreadable, file_empty, statement_unreadable, statement_has_no_transactions, line_invalid

curl -s -X POST "$BASE/v1/statements?file_name=statement-2026-10-30.xml&kind=camt053" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/xml" \
  --data-binary @statement-2026-10-30.xml

GET/v1/client-links

Your own open link (prescriber_id null) and each prescriber's current link, with its state (active, disabled or expired) and its url while it works.

Scope

requests:read, clients:write or decisions:write

Returns

200{ funder, count, client_links[] }

Errors

422lang_invalid

A company that opens a link gives its name, tax number, country and e-mail, and receives your invitation by e-mail. When it accepts, it is your client: its requests are routed only to you, and its origin (the link, the prescriber, the date) is recorded. Opening a link never creates an account by itself.

Each link also carries arrivals (the companies whose first arrival to you was through it) and claims_last_day (sign-ups through it in the last 24 hours; a link takes at most 20 an hour and 100 a day).

curl -s "$BASE/v1/client-links?lang=es" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/client-links

Issue your own open link, or a prescriber's with prescriber_id. There is one working link per owner: while one still works, send replace: true to replace it (the old one stops working at once), otherwise 409 link_exists. Only the SHA-256 of the link's token is stored, and the issue is recorded on Advanta's evidence chain.

Scope

clients:write or decisions:write

Returns

201{ client_link }

Errors

404not_found

409link_exists

422body_invalid, prescriber_id_invalid, expires_at_invalid, reason_invalid, replace_invalid, lang_invalid

A link issued with a sandbox key makes test invitations only, and the key needs decisions:write: the demonstration funder's links are shared by every demonstration.

curl -s -X POST "$BASE/v1/client-links" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"replace":true,"reason":"The old link was forwarded too widely","lang":"es"}'

{
  "client_link": {
    "id": "8d3e1f2a-4b5c-4d6e-9f70-1a2b3c4d5e6f",
    "prescriber_id": null,
    "state": "active",
    "created_at": "2026-09-26T10:00:00Z",
    "expires_at": null,
    "disabled_at": null,
    "disabled_reason": null,
    "replaced_by": null,
    "arrivals": 0,
    "claims_last_day": 0,
    "url": "https://app.advanta.capital/join?link=…&lang=es"
  }
}

POST/v1/client-links/{id}/disable

Switch a link off. It stops working at once; the companies that already arrived through it keep their origin. Switching off a link that is already off changes nothing (changed is false). To give out a new one, call POST /v1/client-links.

Scope

clients:write or decisions:write

Returns

200{ link_id, changed, state: "disabled" }

Errors

404not_found

405method_not_allowed

422body_invalid, reason_invalid

curl -s -X POST "$BASE/v1/client-links/$LINK_ID/disable" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Campaign ended"}'

GET/v1/prescribers

Your prescribers, the people and firms that bring you clients (accountants, advisers, brokers), active first, each with its current link and the number of companies that arrived through it. They are yours, not Advanta's partners. The same list as the Clients page of your portal.

Scope

requests:read, clients:write or decisions:write

Returns

200{ funder, count, prescribers[] }

Errors

422lang_invalid

A sandbox key reads the demonstration funder's prescribers, which every demonstration shares.

curl -s "$BASE/v1/prescribers?lang=es" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/prescribers

Add a prescriber. Its own open link is issued with it, in prescriber.link.url. Its name and e-mail stay off Advanta's evidence chain: only their hashes go on it.

Scope

clients:write or decisions:write

Returns

201{ prescriber }

Errors

409prescriber_exists

422body_required, name_required, name_invalid, email_invalid, email_not_reserved, notes_too_long, lang_invalid

With a sandbox key this changes shared demonstration state, so the key needs decisions:write.

curl -s -X POST "$BASE/v1/prescribers" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Gestoría Norte","email":"ana@gestoria-norte.example","notes":"Accountant in Bilbao","lang":"es"}'

{
  "prescriber": {
    "id": "5f1c2a8e-3b7d-4e0a-9c61-2d4b8e7f9a10",
    "name": "Gestoría Norte",
    "email": "ana@gestoria-norte.example",
    "notes": "Accountant in Bilbao",
    "active": true,
    "created_at": "2026-09-10T09:00:00Z",
    "disabled_at": null,
    "link": {
      "id": "1e2f3a4b-5c6d-4e7f-8a9b-0c1d2e3f4a5b",
      "prescriber_id": "5f1c2a8e-3b7d-4e0a-9c61-2d4b8e7f9a10",
      "state": "active",
      "expires_at": null,
      "arrivals": 0,
      "url": "https://app.advanta.capital/join?link=…&lang=es"
    }
  }
}

POST/v1/prescribers/{id}/disable

Switch a prescriber off. Its link stops working at once; the companies it brought stay attributed to it. Switching off a prescriber that is already off changes nothing (changed is false). Recorded on Advanta's evidence chain.

Scope

clients:write or decisions:write

Returns

200{ prescriber, changed }

Errors

404not_found

405method_not_allowed

422body_invalid, reason_invalid

curl -s -X POST "$BASE/v1/prescribers/$PRESCRIBER_ID/disable" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Agreement ended"}'

GET/v1/prescribers/report

What each prescriber brought you: one group per prescriber, then your own link (own_link), your invitations by name (named) and your onboarding links (api). Per group and per company: when it arrived, when its account was opened (joined), when its company verification was approved (onboarded), the requests routed to you, the amount requested and the amount funded. The same numbers as your portal.

Scope

requests:read, clients:write or decisions:write

Returns

200{ funder, plane, generated_at, currency, totals, groups[] }

Errors

405method_not_allowed

A company counts once, for whoever brought it to you first. The amount funded is the advance (else the total) of funded or settled requests, in euros; totals adds up every group. Only your own data and only companies on your data plane: a sandbox key does not see what other sandbox keys made through the API.

curl -s "$BASE/v1/prescribers/report" \
  -H "Authorization: Bearer $ADVANTA_KEY"

{
  "funder": {
    "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3",
    "name": "Compartment Demo (LU)"
  },
  "plane": "sandbox",
  "generated_at": "2026-09-26T10:00:00Z",
  "currency": "EUR",
  "totals": { "arrived": 1, "joined": 1, "onboarded": 1, "requests": 1, "amount_requested": 18450.00, "amount_funded": 16605.00 },
  "groups": [
    {
      "kind": "prescriber",
      "prescriber_id": "5f1c2a8e-3b7d-4e0a-9c61-2d4b8e7f9a10",
      "name": "Gestoría Norte",
      "active": true,
      "since": "2026-09-10T09:00:00Z",
      "arrived": 1,
      "joined": 1,
      "onboarded": 1,
      "requests": 1,
      "amount_requested": 18450.00,
      "amount_funded": 16605.00,
      "companies": [
        {
          "company_name": "Example Seller, S.L.",
          "company_tax_id": "B00000000",
          "country": "ES",
          "arrived_at": "2026-09-15T11:02:00Z",
          "joined_at": "2026-09-15T11:20:00Z",
          "onboarded_at": "2026-09-16T09:15:00Z",
          "requests": 1,
          "amount_requested": 18450.00,
          "amount_funded": 16605.00
        }
      ]
    }
  ]
}

GET/v1/client-invitations

Every invitation of yours, newest first: through a link, by name in the portal, or with an onboarding link. Each says how the company came (via: link, named or api), the prescriber that brought it if any, its state (pending, accepted, revoked or expired), the company, the contact and the dates.

Scope

requests:read, clients:write or decisions:write

Returns

200{ funder, count, invitations[] }

Errors

405method_not_allowed

Only your own data plane. A sandbox key does not see the invitations other sandbox keys made.

curl -s "$BASE/v1/client-invitations?limit=50" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/opportunities

The digest of a day, from your own clients (the companies whose home funder you are) that allow you to see their invoices. Every morning at about 06:30 Madrid time, after the nightly prequalification, Advanta lists the invoices that became eligible under your rules since the previous digest (kind new) and what changed in those you were shown before: paid, disputed (the client recorded that its debtor contests it) or no_longer_eligible.

Scope

requests:read

Returns

200{ funder, date, digest, lines[] }

Errors

404not_found

405method_not_allowed

422invalid_date

A line carries the invoice, its debtor with its tax id, the amount still owed, the due date, and the client with its sector (NACE section), grade and size band; new lines come first, then the changes. no_longer_eligible has a reason: requested (the client asked to finance it), cancelled, removed (gone from the client's books), left_programme, not_shared (the client stopped sharing) or rules (it no longer meets your rules).

digest holds the totals: how many clients share and how many do not yet, what is eligible today, what is new and what changed. stale is true when the night's run did not complete: nothing was compared that morning. A digest is a list the database computed, not an offer: a request is checked again when it is made, and you decide on it as always. The opportunities.daily webhook says when a digest with something in it is ready.

curl -s "$BASE/v1/opportunities?date=2026-10-07" \
  -H "Authorization: Bearer $ADVANTA_KEY"

{
  "funder": { "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3", "name": "Example Funder" },
  "date": "2026-10-07",
  "digest": {
    "digest_id": "9b2d4c1e-0f3a-4e5b-8c6d-7a8b9c0d1e2f",
    "date": "2026-10-07",
    "stale": false,
    "snapshot_at": "2026-10-07T03:30:12Z",
    "clients": { "sharing": 9, "not_sharing": 1 },
    "eligible": { "count": 42, "total": 318450.00 },
    "new": { "count": 6, "total": 41200.00 },
    "changes": { "paid": 2, "disputed": 0, "no_longer_eligible": 1 },
    "currency": "EUR",
    "lines": "/v1/opportunities?date=2026-10-07"
  },
  "lines": [
    {
      "kind": "new",
      "reason": null,
      "invoice_id": "0c5e7f3a-2b4d-4c6e-9f81-3a5b7c9d1e2f",
      "number": "FV 2026/1184",
      "debtor": { "name": "Example Buyer, S.A.", "tax_id": "A00000000", "country": "ES" },
      "amount": 12400.00,
      "currency": "EUR",
      "due_date": "2026-12-15",
      "client": { "seller_id": "2f6d8a4e-1b3c-4d5e-9f70-8a1b2c3d4e5f", "name": "Example Seller, S.L.", "tax_id": "B00000000", "sector": "C", "grade": "B", "size_band": "small" }
    }
  ]
}

GET/v1/webhooks

Your active endpoints, without their secrets, and the event types you can subscribe to. A sandbox key sees only the endpoints it created.

Scope

webhooks:write, decisions:write or requests:read

Returns

200{ count, webhooks[], event_types[] }

Errors

Only the common ones (401, 403, 500).

curl -s "$BASE/v1/webhooks" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/webhooks

Register an endpoint. The response holds its signing secret, which is not shown again.

Scope

webhooks:write or decisions:write

Returns

201{ webhook, secret, signature }

Errors

409too_many_endpoints

422body_required, url_required, url_invalid, url_too_long, url_must_be_https, url_has_credentials, url_port_not_allowed, url_host_not_allowed, url_not_allowed, events_invalid, unknown_event_type, invalid_description

At most 10 active endpoints.

curl -s -X POST "$BASE/v1/webhooks" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://hooks.example.com/advanta","events":["request.routed","notice.acknowledged","notice.disputed","request.funded","settlement.recorded"],"description":"Credit desk"}'

const res = await fetch(`${BASE}/v1/webhooks`, {
  method: 'POST',
  headers: { ...headers, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    url: 'https://hooks.example.com/advanta',
    events: ['request.routed', 'notice.acknowledged', 'notice.disputed', 'request.funded', 'settlement.recorded'],
    description: 'Credit desk',
  }),
});
const body = await res.json();
if (res.status !== 201) throw new Error(`${res.status} ${body.error.code}: ${body.error.message}`);

// The secret is shown once: store it now, in your own secret store.
await secretStore.put(`advanta-webhook-${body.webhook.id}`, body.secret);

{
  "webhook": {
    "id": "e3b1c2d4-5f6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "https://hooks.example.com/advanta",
    "description": "Credit desk",
    "events": ["notice.acknowledged", "notice.disputed", "request.funded", "request.routed", "settlement.recorded"],
    "active": true,
    "secret_prefix": "whsec_1a2b3c",
    "created_via": "api"
  },
  "secret": "whsec_…",
  "signature": { "header": "Advanta-Signature", "scheme": "HMAC-SHA256 of \"<t>.<raw body>\"", "tolerance_seconds": 300 }
}

DELETE/v1/webhooks/{id}

Stop an endpoint. Deliveries still pending are cancelled and its secrets are deleted.

Scope

webhooks:write or decisions:write

Returns

200{ id, active: false, deleted: true, cancelled_deliveries }

Errors

404not_found

curl -s -X DELETE "$BASE/v1/webhooks/$WEBHOOK_ID" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/webhooks/{id}/rotate-secret

A new signing secret, shown once. The previous secret keeps signing, as a second v1 in the header, for keep_previous_hours, so you can switch without losing events.

Scope

webhooks:write or decisions:write

Returns

200{ webhook, secret, previous_secret_valid_until }

Errors

404not_found

422invalid_keep_previous_hours

curl -s -X POST "$BASE/v1/webhooks/$WEBHOOK_ID/rotate-secret" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keep_previous_hours":24}'

POST/v1/webhooks/{id}/test

Queue a webhook.test event to this endpoint. The next dispatcher run delivers it, within about a minute.

Scope

webhooks:write or decisions:write

Returns

202{ endpoint_id, event_id, delivery_id, status: "pending" }

Errors

404not_found

curl -s -X POST "$BASE/v1/webhooks/$WEBHOOK_ID/test" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/webhooks/{id}/deliveries

The delivery log of an endpoint, newest first: status (pending, delivered, failed or cancelled), attempts, response code, last error, next attempt, and the SHA-256 of the exact body sent.

Scope

webhooks:write, decisions:write or requests:read

Returns

200{ count, deliveries[] }

Errors

404not_found

curl -s "$BASE/v1/webhooks/$WEBHOOK_ID/deliveries?limit=20" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/onboarding-links

A single-use onboarding link for one of your suppliers, attributed to you. Advanta sends no e-mail: you give url to your supplier. When the supplier has submitted its company verification you receive onboarding.completed, and the supplier is sent back to your return_url with a signed status.

Scope

onboarding:write or decisions:write

Returns

201{ onboarding_link, url, expires_at, environment, return_secret, return }

Errors

409company_already_registered, email_has_account, invitation_pending_exists, country_not_served

422body_required, country_invalid, company_vat_invalid, contact_email_invalid, contact_name_invalid, company_name_invalid, company_name_required, return_url_invalid, return_url_not_allowed, metadata_invalid, locale_invalid, valid_days_invalid, country_not_served

The response holds return_secret (ors_ followed by 64 hexadecimal characters), shown once: store it now. Only the SHA-256 of the link's token is stored. A link made with a sandbox key registers the supplier as a test company on the demonstration plane.

When the supplier comes back, return_url carries advanta_onboarding (the link id), advanta_status (completed), advanta_ts (Unix seconds) and advanta_sig: the hex HMAC-SHA256 of <advanta_onboarding>.<advanta_status>.<advanta_ts>, keyed with your return_secret. Check it before your page trusts the status, and refuse a return more than 600 seconds from your clock; the last example below does both.

curl -s -X POST "$BASE/v1/onboarding-links" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"company_vat":"PT500000000","country":"PT","contact_email":"ana@fornecedor.example","contact_name":"Ana Sousa","company_name":"Fornecedor Exemplo, Lda.","return_url":"https://portal.example.com/onboarding/done","metadata":{"supplier_ref":"S-42"},"locale":"pt"}'

{
  "onboarding_link": {
    "id": "c2d4e6f8-1a3b-4c5d-8e7f-9a0b1c2d3e4f",
    "status": "pending",
    "company_name": "Fornecedor Exemplo, Lda.",
    "country": "PT",
    "return_url": "https://portal.example.com/onboarding/done",
    "metadata": { "supplier_ref": "S-42" },
    "expires_at": "2026-10-10T10:00:00Z",
    "completed_at": null,
    "seller_id": null
  },
  "url": "https://app.advanta.capital/accept-invite?invitation=…&lang=pt",
  "expires_at": "2026-10-10T10:00:00Z",
  "environment": "sandbox",
  "return_secret": "ors_…",
  "return": {
    "parameters": ["advanta_onboarding", "advanta_status", "advanta_ts", "advanta_sig"],
    "signature": "hex HMAC-SHA256(return_secret, \"<advanta_onboarding>.<advanta_status>.<advanta_ts>\")"
  }
}

import crypto from 'node:crypto';

// On the page behind your return_url.
// url:          the full address the supplier came back to
// returnSecret: the "ors_…" string POST /v1/onboarding-links returned, stored when you made the link
export function verifyAdvantaReturn(url, returnSecret, nowSeconds = Math.floor(Date.now() / 1000)) {
  const q = new URL(url).searchParams;
  const id = q.get('advanta_onboarding') ?? '';
  const status = q.get('advanta_status') ?? '';
  const ts = q.get('advanta_ts') ?? '';
  const sig = q.get('advanta_sig') ?? '';
  if (!id || !status || !/^[0-9]{1,12}$/.test(ts) || !/^[0-9a-f]{64}$/.test(sig)) return null;
  if (Math.abs(nowSeconds - Number(ts)) > 600) return null; // too old: ask your back end instead

  const expected = crypto.createHmac('sha256', returnSecret).update(`${id}.${status}.${ts}`).digest();
  if (!crypto.timingSafeEqual(Buffer.from(sig, 'hex'), expected)) return null;
  return { onboardingLinkId: id, status }; // status is "completed"
}

GET/v1/onboarding-links

Your onboarding links, newest first, each with its status: pending, account_created, completed, expired or revoked. A sandbox key sees the links it created.

Scope

onboarding:write, decisions:write or requests:read

Returns

200{ count, onboarding_links[] }

Errors

Only the common ones (401, 403, 500).

curl -s "$BASE/v1/onboarding-links?limit=20" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/onboarding-links/{id}

One onboarding link and where the supplier is. Once it is completed, seller_id is the id GET /v1/seller-limits uses.

Scope

onboarding:write, decisions:write or requests:read

Returns

200{ onboarding_link }

Errors

404not_found

405method_not_allowed

curl -s "$BASE/v1/onboarding-links/$ONBOARDING_ID" \
  -H "Authorization: Bearer $ADVANTA_KEY"

POST/v1/exports

Start an export of everything your funder can see: requests and their history, offers, invoices with their verification, sellers (company data, the KYC summary you may see, the representative's verification), debtors, notices with the debtors' answers and the certificates' data, the evidence chain entries about your operations with the hashes and day roots to verify them, settlements and statements, gate refusals, your rules and limits, your team, webhook endpoints (never a secret), API keys (never a key), your audit trail and your documents. It is built in the background, usually within a minute; export.ready tells you when.

Scope

exports:write or decisions:write

Returns

202{ funder, export }

Errors

403export_live_key_required

409export_in_progress

422body_invalid, lang_invalid

429export_rate_limited

A live key only: a sandbox key answers 403 export_live_key_required (the demonstration funder is shared). One export at a time, at most 10 in 24 hours. The same export is on the portal's Export page, under settings.

curl -s -X POST "$BASE/v1/exports" \
  -H "Authorization: Bearer $ADVANTA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"lang":"es"}'

{
  "funder": { "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3", "name": "Example Funder" },
  "export": {
    "id": "5e1f0a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
    "subject": "funder",
    "status": "queued",
    "plane": "live",
    "requested_via": "api",
    "actor_role": "api:treasury",
    "lang": "es",
    "created_at": "2026-09-27T09:00:02.114000Z",
    "download_available": false,
    "manifest_sha256": null,
    "progress": { "entities_done": 0, "entities_total": 47, "rows": 0, "volumes_written": 0, "phase": "data" }
  }
}

GET/v1/exports

Your exports, from the portal and the API, newest first, with their status, size and manifest_sha256.

Scope

exports:write or decisions:write

Returns

200{ funder, count, exports[] }

Errors

403export_live_key_required

405method_not_allowed

curl -s "$BASE/v1/exports?limit=20" \
  -H "Authorization: Bearer $ADVANTA_KEY"

GET/v1/exports/{id}

One export. While it is built: status queued or running, with progress. Once ready, and for 24 hours: files, each volume with a link valid for one hour at most (never past those 24 hours). Ask again for fresh links; every call that returns links is recorded. After 24 hours the files are deleted and the record stays.

Scope

exports:write or decisions:write

Returns

200{ funder, export, files[] }

Errors

403export_live_key_required

404not_found

405method_not_allowed

manifest_sha256 is the SHA-256 of manifest.json written without that field, keys sorted, no spaces. Advanta recorded the same value on the evidence chain (entry export.ready); verify.py recomputes it and checks every file and the evidence entries.

curl -s "$BASE/v1/exports/5e1f0a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b" \
  -H "Authorization: Bearer $ADVANTA_KEY"

{
  "funder": { "bank_id": "6d164c92-02cc-4f9a-ae8d-3f7f5ef043d3", "name": "Example Funder" },
  "export": {
    "id": "5e1f0a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
    "status": "ready",
    "completed_at": "2026-09-27T09:00:41.502000Z",
    "expires_at": "2026-09-28T09:00:41.502000Z",
    "download_available": true,
    "manifest_sha256": "1c822b8797ba58903eca0689cc0c93138e7d396e01a038d133b5c1f3aeec7497",
    "size_bytes": 482113,
    "file_count": 101,
    "documents_mode": "files",
    "row_counts": { "requests": 212, "invoices": 1480, "evidence_entries": 903 }
  },
  "files": [
    {
      "name": "advanta-export-2026-09-27-5e1f0a2b-v001.zip",
      "bytes": 482113,
      "sha256": "9b0e5c1d2a7f4e6b8c3d1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a291807",
      "url": "https://…/object/sign/data-exports/…",
      "url_expires_at": "2026-09-27T10:00:41.502000Z"
    }
  ]
}

# Every volume into one folder, then the checker the export carries
curl -s "$BASE/v1/exports/$EXPORT_ID" -H "Authorization: Bearer $ADVANTA_KEY" \
  | jq -r '.files[].url' | while read -r u; do curl -s -o "v$((++n)).zip" "$u"; done
for z in v*.zip; do unzip -q -o "$z" -d export; done
python3 export/advanta-export-*/verify.py   # files, manifest digest and evidence chain

GET/v1/exports/{id}/documents

When the documents were too large to include (documents_mode links): every document of the export with a link valid for 15 minutes, a page at a time. The list is computed when you ask, so a document you may no longer read is not in it.

Scope

exports:write or decisions:write

Returns

200{ funder, export_id, documents[], next_after }

Errors

403export_live_key_required

404not_found

409export_not_ready, export_failed

410export_expired

curl -s "$BASE/v1/exports/5e1f0a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b/documents?limit=100" \
  -H "Authorization: Bearer $ADVANTA_KEY"