Skip to content
attpro
Book a demo

Developers

Integrate in an afternoon, not a quarter

A REST API with predictable conventions, signed webhooks for everything that happens to a borrower, and plain file exchange for lenders whose LMS prefers it. This page is the map; the full reference and an OpenAPI document are issued with your sandbox tenant.

Request a sandboxIntegrations
GET /api/v1/borrowers · 200
$ curl https://api.attpro.in/api/v1/borrowers?dpd_min=31&limit=2 \
    -H "Authorization: Bearer attpro_live_XXXXXXXX"

{ "data": [
    { "id": "brw_01J8…", "loan_ref": "LN-2214",
      "dpd": 34, "outstanding_paise": 485000,
      "last_touch": "call.completed", "ptp": "2026-08-12" },
    { "id": "brw_01J9…", "loan_ref": "LN-1187",
      "dpd": 52, "outstanding_paise": 1210000,
      "last_touch": "touch.read", "ptp": null } ],
  "meta": { "cursor_next": "eyJpZCI6…" } }
On this page

Overview

Three ways in

Pick the one your stack already speaks. Most lenders start with files and add the API when they want same-day state.

REST API

JSON over HTTPS at /api/v1, per tenant, cursor-paginated, idempotent writes.

Webhooks

Signed POSTs to your endpoint for every borrower event, retried with backoff for 24 hours.

SFTP file exchange

A nightly CSV in, extracts out, with saved column mappings and a preflight dry run.

Authentication

API keys, scoped to a tenant

Keys are issued per tenant by an administrator in the platform, carry a role, and can be revoked at any time. Every request is logged against the key that made it.

bearer key
curl https://api.attpro.in/api/v1/borrowers?limit=50 \
  -H "Authorization: Bearer attpro_live_XXXXXXXX" \
  -H "Accept: application/json"

Keys are shown once at creation and stored envelope-encrypted. Rotate by issuing a new key and revoking the old; both stay valid during the overlap you choose.

Conventions

The same shape everywhere

Four rules that hold on every endpoint, so the second integration is a copy of the first.

Responses

Every list returns data and meta.cursor_next. Pass the cursor back to page; never offset.

list envelope
{ "data": [ ... ],
  "meta": { "cursor_next": "eyJpZCI6..." } }

Errors

RFC 7807 problem details with a stable type you can switch on.

422 · problem+json
{ "type": "https://attpro.in/errors/validation",
  "title": "Invalid field",
  "status": 422,
  "detail": "phone must be E.164",
  "instance": "/api/v1/borrowers" }

Idempotency

Send Idempotency-Key on any write you might retry. The same key returns the original result for 24 hours.

Money and time

Amounts are integers in paise. Timestamps are ISO 8601 in UTC; calling windows and reports are in IST.

Resources

What you can read and write

Eight resources cover the book. Each is the same record the operator sees in the app; there is no separate API model.

/borrowersAccounts under collection: identity, outstanding, DPD, custom fields, consent and DNC state, sibling loans.
/campaignsA book, a strategy and a window. Enrol borrowers, activate a working file, read progress.
/flowsPublished strategies and their runs per borrower, with every node visited and the branch taken.
/touchesEvery contact on every channel: status, delivery and read signals, disposition.
/callsVoice calls with recording, transcript, sentiment and QA annotations.
/paymentsPayment links, receipts, promises to pay and their kept / broken state.
/field-visitsAllocated and completed visits with geo-tag, time and outcome.
/dispositionsThe tenant's disposition taxonomy, editable, with the next-action each code implies.

Webhooks

Every borrower event, signed

Register an HTTPS endpoint per tenant. Each delivery carries an HMAC-SHA256 signature over the raw body; verify it before you trust the payload. Failed deliveries retry with backoff for 24 hours.

touch.delivered / touch.read / touch.repliedMessaging signals as the carrier reports them.
call.completedAn AI or human call ended, with disposition, duration and recording reference.
ptp.recorded / ptp.kept / ptp.brokenPromise lifecycle.
payment.receivedA payment reconciled to an account via the gateway callback.
field_visit.completedA doorstep visit captured on the officer's app.
borrower.dnc_changed / borrower.consent_changedConsent and do-not-call state changes.
flow_run.endedA borrower's run reached an end node, with the end branch.
delivery · payment.received
POST https://lender.example/hooks/attpro
X-Attpro-Signature: sha256=3f1c...
X-Attpro-Event: payment.received

{ "id": "evt_01J...", "occurred_at": "2026-08-12T05:01:10Z",
  "tenant": "t_acme", "type": "payment.received",
  "data": { "borrower_id": "...", "amount_paise": 485000, "method": "upi" } }

File exchange

A nightly CSV is enough to start

Drop the LMS extract on the SFTP endpoint we provision. The upload wizard's saved mapping applies, the file dry-runs, and only a clean file commits. Extracts of dispositions, promises and payments are produced on the schedule you set.

  • UTF-8 CSV, one row per account, any column order; mapping saved per lender.
  • Preflight reports duplicates, bad phones and missing mandatory fields before anything touches the book.
  • One active working file per campaign; a new file retires the old one and re-enrols in the background.

Sandbox and limits

A tenant to break things in

Sandbox tenants ship with a demo book, test numbers for voice, and provider stubs so nothing real is dialled or charged. Rate limits are generous for normal integration traffic and stated in the reference; ask if you plan to bulk-load.

webhook retries with backoff
24 h
idempotency-key replay window
24 h
default page size, cursor-paginated
50
real calls or charges from a sandbox
0
Request a sandbox tenant

Bring your LMS export.

A file-mapping session with an engineer is the first hour of onboarding. Bring one, and the demo runs on your own columns.

Book a demoTalk to an engineer