Skip to content
Docs

API reference

Build on Figure’s APIs

Every endpoint, with request and response schemas and ready-to-run samples in cURL, Node.js, and Python.

production

https://api.figure.com

test

https://api.test.figure.com

APIs

HELOC Inquiries

25 endpoints

Create HELOC inquiries for your borrowers, retrieve live offers, resolve exceptions, and hand off to Figure.

  • POST/products/heloc/v1/inquiry/start
  • GET/products/heloc/v1/details/{appUuid}
  • PUT/products/heloc/v1/inquiry/{appUuid}/cancel
View reference

HELOC Pre-Qualification

2 endpoints

Return pre-qualified HELOC offers to prospective borrowers from your own site, then hand them to Figure to apply.

  • POST/products/heloc/pre-qualify/v2
  • POST/products/heloc/pre-qualify/v1
View reference

Asset Onboarding

13 endpoints

Onboard third-party loans to Provenance and keep them current with servicing tapes.

  • POST/api/onboard
  • POST/api/onboard/{id}
  • GET/api/onboard/{id}
View reference

Portfolio Manager

20 endpoints

Download loan tapes, payment history, and ownership history for the assets you hold.

  • GET/external/secure/api/v1/portfolio/asset/types
  • GET/external/secure/api/v1/portfolio/layouts/{assetType}
  • GET/external/secure/api/v1/portfolio/download/owned/{assetType}/{layout}
View reference

Authentication

Send your API key in the apikey header with every request, along with a User-Agent header. Most HTTP clients add the User-Agent for you. Requests without both headers are rejected.

Figure provides your API key during partner onboarding. Endpoints that need it are marked API key required. HELOC Pre-Qualification identifies you with your affiliate UUID instead.

API basicsin Guides
Authenticated request
curl \
  https://api.test.figure.com/management/v1/loan-originator \
  -H "apikey: $FIGURE_API_KEY" \
  -H "User-Agent: acme-lending/1.0"

Encrypted payloads

Endpoints that take borrower data expect the body as a JWE, encrypted with Figure’s public key using RSA-OAEP-256 and A256GCM, and sent as { "encrypted": "<JWE>" }. Those endpoints say so above their request body, and the fields listed are the payload before encryption.

To have a response encrypted too, add X-Encrypt-Response: true. Figure exchanges the keys for this with you during onboarding.

Can’t create a JWE yourself? Encrypt a payload does it for you.

Data protection (JWE)in Guides
Encrypted request body
{
  "encrypted": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0..."
}

Response format

Every response wraps its result in the same envelope. data holds the endpoint’s result, and messages carries any information, warnings, or errors.

Dollar amounts are decimals to the cent, such as 99.99. Rates are decimals, so 0.98765 is 98.765%. Each endpoint’s path includes its major version.

Common response format
{
  // "data" is specific to each endpoint
  "data": { ... },
  "messages": [
    { "level": "ERROR", "message": "..." }
  ]
}

Webhooks

Instead of polling, Figure sends a POST to the HTTPS endpoint you register during onboarding when an inquiry is ready for its next step, and as the application’s status changes. Return 200 OK to acknowledge it. Otherwise Figure retries with exponential backoff.

Payloads can be encrypted with your public key. After a webhook arrives, retrieve the inquiry details for the full, updated inquiry.

Webhooksin Guides
Inquiry webhook payload
{
  "applicationUuid": "82f5176b-7dbf-4f37-b40d-6e9580f3d4f1",
  "loanOriginatorNmls": "NMLS_1234",
  "productType": "HELOC",
  "eventTimestamp": "2025-06-26T12:54:16.726009161Z",
  "nextInquiryStepType": "OFFERS_AVAILABLE",
  "organization": "..."
}