The FinDesk API gives external systems programmatic access to the same resources the FinDesk web app uses — loan applications, the people and organisations attached to them, referrers, quotes, and contracts.
It is a JSON-over-HTTPS API authenticated with bearer tokens. Every authenticated request runs in the context of a single team (enterprise), and every response is scoped to that team's data.
Base URLs
Two versions of the API are live. The version is part of the URL — pick one explicitly per call.
https://app.findesk.com.au/api/v1
https://app.findesk.com.au/api/v2
/api/v1 is the original surface. /api/v2 is the current default and includes input normalisation that older clients did not get. Unless you have an existing v1 integration, build against /api/v2.
What's in the API
| Surface | Notes |
|---|---|
Auth — POST /api/v{1,2}/login |
Exchange email + password for a Sanctum bearer token. |
| Core resources | Applications, People, Organisations, Quotes (read-only). Leads, People, Organisations support full CRUD. |
| Account | Read-only listings for enterprises (teams) and users. |
| Webhooks | Inbound endpoints for BoldSign and DocuSign signature events. See Webhooks. |
The full per-resource reference lives under Core resources in the sidebar.
How requests are scoped
Every authenticated request must include the team UUID it should operate on:
X-Enterprise-Id: 1f8a9b2c-...-9e0f
Tokens are tied to a user. The user may belong to several teams; the X-Enterprise-Id header decides which one the request reads from. Calls without a matching team membership return 403 Forbidden.
Where to go next
- Authentication — how to obtain and use a bearer token.
- Errors — status codes and response shapes you should expect.
- Pagination — how list endpoints page results.
- Rate limits — current throttling rules.