Skip to main content

Encryption API

Overview​

If you are unable to implement JWE encryption in your own systems, Figure provides an API endpoint that encrypts a JSON payload on your behalf using Figure's public key. The encrypted output is a standard JWE compact serialization string that can be used anywhere Figure expects encrypted data — for example, as a query parameter when redirecting a borrower to Figure.

Authentication​

This endpoint uses the same authentication as all other Figure Partner API endpoints:

  • apikey header — Your API key, provided during onboarding.

See Getting Started for more information on required headers.

Request​

URL
POST https://api.figure.com/encryption/v1/encrypt

Headers​

HeaderRequiredDescription
apikeyYesYour API key
Content-TypeYesMust be application/json

Body​

The request body is any valid JSON object representing the data you want to encrypt. For example, if you are encrypting inquiry prefill data:

Example Payload
{
  "applicant": {
    "name": {
      "firstName": "Jane",
      "lastName": "Doe"
    },
    "email": "jane.doe@example.com",
    "phone": "555-123-4567"
  },
  "property": {
    "address": {
      "street1": "123 Main St",
      "city": "Anytown",
      "state": "CA",
      "zip": "90210"
    }
  }
}

Example Request​

cURL
curl -X POST https://api.figure.com/encryption/v1/encrypt \
  -H "apikey: <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "applicant": {
      "name": { "firstName": "Jane", "lastName": "Doe" },
      "email": "jane.doe@example.com"
    }
  }'

Response​

Response Payload
{
  "encrypted": "<JWE compact serialization string>"
}

The encrypted field contains a JWE compact serialization string (five base64url-encoded segments separated by periods). See JSON Web Encryption (JWE) for details on the JWE format.

Store a Payload Request​

Use the payload request endpoint when Figure should store the payload and create a URL for a customer to be redirected to. Unlike /encryption/v1/encrypt, this endpoint returns a redirect URL and does not return the encrypted payload directly.

Request​

URL
POST https://api.figure.com/encryption/v1/payload-requests
Payload shape depends on payloadType

The payload object's schema is entirely determined by payloadType — each supported type has its own set of fields. Select the matching tab below for an example. Only HELOC_APPLICATION is supported today; more types will be added here as they become available.

Request Payload
{
  "payloadType": "HELOC_APPLICATION",
  "payload": {
    "name": {
      "firstName": "Carlos",
      "lastName": "Johnson"
    },
    "dob": "1947-07-30",
    "propertyAddress": {
      "street1": "1066 Arbol Way",
      "city": "San Jose",
      "state": "CA",
      "zip": "95126",
      "occupancyType": "HOME",
      "ownership": "SOLE"
    },
    "homeAddress": {
      "street1": "1066 Arbol Way",
      "city": "San Jose",
      "state": "CA",
      "zip": "95126"
    },
    "isListedForSale": false,
    "income": {
      "employmentType": "FULL_TIME",
      "income": 120000.0
    },
    "email": "carlos.johnson@example.com",
    "phoneNumber": "4155551234"
  },
  "loanOriginatorUuid": "00000000-0000-0000-0000-000000000000" // Example UUID
}

payloadType acts as a discriminator selecting which payload schema above applies. loanOriginatorUuid is optional when the payload already identifies the loan originator.

An encrypted version of the above payload is also accepted

Encrypted Request Payload
{
  "encrypted": "<JWE compact serialization string>"
}

Response​

Response Payload
{
  "redirectUrl": "https://apply.figure.com/heloc/register/...", // This will vary depending the configuration of the organization
  "requestPayloadUuid": "00000000-0000-0000-0000-000000000000", // Example UUID
  "expiresAt": "2026-08-20T12:00:00Z"
}
  • redirectUrl is the borrower-facing URL created for the stored payload request.
  • requestPayloadUuid uniquely identifies the stored payload request.
  • expiresAt is the date and time when the request expires.

Send the borrower to redirectUrl to continue the Figure application flow. Requests will be matched by the identity email (or similar value) to prevent erronous decryption attempts. Customers will be authenticated before decryption is allowed.

Error Responses​

ScenarioHTTP StatusDescription
Missing or invalid API key401The apikey header is missing or invalid
Invalid JSON body400The request body is not valid JSON
Server error500An unexpected error occurred during encryption