Elite Funders Partner API

One header, two key modes

Every request is authenticated with your partner API key in the Authorization header (or x-api-key). Live keys start with efp_live_ and create real deals; test keys start with efp_test_ and never write anything — see Sandbox. The only route that needs no key is GET /v1/openapi.json, which serves the machine-readable spec.

Authorization: Bearer efp_live_<your-key>

Ping, submit, track — three calls

curl "https://mddbqtczelajfpsnviaz.supabase.co/functions/v1/partner-api-v1/v1/ping" \
  -H "Authorization: Bearer $EF_API_KEY"

Include documents inline (base64) and set auto_submit: true to validate and submit in one call, or leave it off to create a draft you finish later. The Idempotency-Key header makes retries safe.

curl -X POST "https://mddbqtczelajfpsnviaz.supabase.co/functions/v1/partner-api-v1/v1/submissions" \
  -H "Authorization: Bearer $EF_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: crm-10442-attempt-1" \
  --data @deal.json

{
  "external_ref": "CRM-10442",
  "product_type": "mca",
  "business": {
    "legalName": "Blue Harbor Logistics LLC",
    "dba": "Blue Harbor",
    "entityType": "LLC",
    "industry": "Transportation",
    "inceptionDate": "03/2019",
    "phone": "3055550123",
    "monthlyRevenueEstimate": 85000,
    "ein": "123456789",
    "address": { "line1": "450 Port Blvd", "city": "Miami", "state": "FL", "zip": "33132" }
  },
  "owners": [{
    "firstName": "Jordan",
    "lastName": "Rivera",
    "email": "[email protected]",
    "phone": "3055550124",
    "ownershipPct": 100,
    "ssn": "123456789",
    "dob": "1984-06-02",
    "ficoMidpoint": 680,
    "address": { "line1": "88 Coral Way", "city": "Miami", "state": "FL", "zip": "33145" }
  }],
  "funding": { "requestedAmount": 75000, "useOfFunds": "Equipment and inventory", "openPositions": 0, "openBalance": 0 },
  "attestation": {
    "originalAppOnFile": true,
    "consentCredit": true,
    "consentTcpa": true,
    "consentEsign": true,
    "signatureName": "Jordan Rivera",
    "signedAt": "2026-09-15T14:30:00Z"
  },
  "documents": [
    { "kind": "statement", "ym": "2026-08", "filename": "aug-2026.pdf", "content_base64": "JVBERi0xLjc..." }
  ],
  "auto_submit": false
}

# attach more documents while the submission is a draft
curl -X POST "https://mddbqtczelajfpsnviaz.supabase.co/functions/v1/partner-api-v1/v1/submissions/$SUBMISSION_ID/documents" \
  -H "Authorization: Bearer $EF_API_KEY" -H "Content-Type: application/json" \
  --data '{"kind":"statement","ym":"2026-07","filename":"jul-2026.pdf","content_base64":"JVBERi0xLjc..."}'

# run the validation gates and submit the deal
curl -X POST "https://mddbqtczelajfpsnviaz.supabase.co/functions/v1/partner-api-v1/v1/submissions/$SUBMISSION_ID/submit" \
  -H "Authorization: Bearer $EF_API_KEY"

From here, poll GET /v1/submissions/{id} for status and timeline — or skip polling entirely and register a webhook. A 422 from /submit lists exactly what is missing; fix it and call /submit again.

Endpoints

All paths are relative to the base URL. Every route except GET /v1/openapi.json requires your API key.

Supported product_type values: mca (default), term_loan, loc, sba, equipment, heloc.

Documents

Documents are sent inline as base64 — up to 8 MB per file, 20 files per submission, and a 25 MB request body (split large batches across multiple /documents calls). Bank statements are required for all products; the count varies by state, so call GET /v1/products?state=XX for the exact requirement.

Statuses

Once a deal is submitted, it moves through six partner-safe statuses. The API returns both a machine status code and a human status_label.

Webhooks

Register an HTTPS endpoint and we POST you a signed event whenever a deal moves. Events: submission.received, submission.under_review, submission.approved, submission.declined, submission.funded, and submission.offer_expiring. Failed deliveries are retried 5 times over ~14 hours; an endpoint is auto-disabled after 20 consecutive failures. Use POST /v1/webhooks/{id}/test to fire a signed sample event any time.

POST https://yourapp.example/webhooks/elitefunders
X-Elite-Event: submission.approved
X-Elite-Signature: t=1789574400,v1=5f8a2c…

{
  "id": "7f0c5a4e-91d2-4c33-8f0a-2f6f6f1f2a9b",
  "event": "submission.approved",
  "mode": "live",
  "data": {
    "submission_id": "c1a2b3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "external_ref": "CRM-10442",
    "business_name": "Blue Harbor Logistics LLC",
    "status": "approved",
    "status_label": "Approved"
  },
  "created_at": "2026-09-16T18:00:00.000Z"
}

Verifying signatures

Every delivery carries X-Elite-Signature: t=<unix>,v1=<hex>, where v1 is HMAC-SHA256(secret, "<t>.<rawBody>") using the signing secret shown once when you registered the endpoint. Reject the delivery if the timestamp is more than 300 seconds off, or if the signature does not match. Always sign the raw request body — parse the JSON only after verification.

const crypto = require("node:crypto");

function verifyEliteSignature(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("="))
  );
  const t = Number(parts.t);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");
  const given = String(parts.v1 || "");
  return (
    given.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(given))
  );
}

// Express example — keep the raw body for signing
app.post("/webhooks/elitefunders", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyEliteSignature(req.body.toString("utf8"), req.get("X-Elite-Signature") || "", process.env.ELITE_WEBHOOK_SECRET)) {
    return res.status(400).send("bad signature");
  }
  const event = JSON.parse(req.body);
  // handle event.event / event.data …
  res.sendStatus(200);
});

import hmac, hashlib, time

def verify_elite_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in signature_header.split(","))
    try:
        t = int(parts["t"])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > 300:
        return False
    expected = hmac.new(
        secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))

# Flask example — sign the raw body, parse JSON only after verifying
@app.route("/webhooks/elitefunders", methods=["POST"])
def elite_webhook():
    if not verify_elite_signature(
        request.get_data(),
        request.headers.get("X-Elite-Signature", ""),
        os.environ["ELITE_WEBHOOK_SECRET"],
    ):
        return "bad signature", 400
    event = request.get_json()
    # handle event["event"] / event["data"] …
    return "", 200

Errors & rate limits

Errors come back as a consistent JSON envelope with a machine-readable code and a request_id — include the request_id when contacting support. Every response also carries it in the X-Request-Id header.

{
  "error": {
    "code": "validation_failed",
    "message": "Submission did not pass validation gates. Fix the listed items and call /submit again.",
    "details": { "errors": ["…"], "warnings": ["…"] }
  },
  "request_id": "a1b2c3d4-…"
}

Rate limits are per key, per hour — one limit for requests overall and a separate one for submission creates, both sized to your account. GET /v1/ping reports your usage for the current hour. Use Idempotency-Key on POST /v1/submissions so a retried request returns the original submission instead of creating a duplicate.

Sandbox — test keys

Test keys (efp_test_) run the entire flow against the real validation gates but never create a real application or deal. Use one to integrate end-to-end before you switch to live:

1. Create a submission and attach documents exactly as you would live.
2. Call /submit — the full validation gates run. Failures return the same 422 with the same error list a live key would see.
3. On success the submission gets status test_accepted and nothing enters the pipeline.
4. Register a webhook and use POST /v1/webhooks/{id}/test to receive a signed sample event (delivered with "mode": "test") and prove out your signature verification.
5. Swap in your efp_live_ key. No other code changes.