API documentation

Authentication

Generate an API key in Console → Webhooks & API (org admins). Keys are shown once and stored only as a SHA-256 hash. Send it as a Bearer token:

Authorization: Bearer amb_live_...

Create a case

One call creates the case, fans it out into the verification legs your loan product requires, routes each leg to the best agency, and records the consent artifact.

POST /api/v1/cases
Content-Type: application/json

{
  "applicant": "Ramesh Powar",
  "loan_id":   "UCD1000093",          // your LOS reference
  "category":  "used-car",            // used-car | home | lap | business | ...
  "pincode":   "440024",
  "city":      "Nagpur",
  "address":   "Plot 8, Mitra Vihar, Ramna Maruti Rd",
  "contact":   "9822011001",
  "channel":   "Dealer",              // Direct | Dealer | DSA | C2C | Refinance
  "consent":   true                   // DPDP attestation, recorded on the case
}

→ 201 { "ok": true, "case_ref": "AMB-81464", "tasks_created": 1 }

Batch ingest (LOS / warehouse)

Push up to 200 cases per call — the pattern for scheduled exports from your LOS or data warehouse. Partial success is expected and reported row by row; every batch appears in your console’s ingest report with per-row accept/reject results.

POST /api/v1/cases/batch
Content-Type: application/json

{
  "cases": [
    { "applicant": "Ramesh Powar", "loan_id": "UCD1000093", "category": "used-car",
      "pincode": "440024", "address": "Plot 8, Mitra Vihar", "contact": "9822011001",
      "trigger_reason": "Address mismatch in KYC", "consent": true },
    { "applicant": "Sana Sheikh", "loan_id": "HL5590210", "category": "home",
      "pincode": "411038", "consent": true }
  ]
}

→ 200 {
  "ok": true, "batch_id": "…", "total": 2, "created": 2, "failed": 0,
  "results": [
    { "row": 0, "ok": true, "loan_id": "UCD1000093", "case_ref": "AMB-81465" },
    { "row": 1, "ok": true, "loan_id": "HL5590210",  "case_ref": "AMB-81466" }
  ]
}

Fraud signal check

Screen an applicant against the cross-lender network before you lend — address velocity, distinct lenders, and negative-FI history. Free-standing: no case is created.

POST /api/v1/signals/check
Content-Type: application/json

{ "applicant": "Ramesh Powar", "pincode": "440024" }

→ 200 {
  "ok": true,
  "signal": {
    "address_velocity_30d": 3,
    "distinct_lenders_30d": 2,
    "negative_fi_on_record": false,
    "risk": "HIGH"                    // LOW | MEDIUM | HIGH
  }
}

Webhooks

Register an endpoint in the console; Ambrezo POSTs a signed JSON event at every milestone. Failed deliveries retry automatically (3 attempts) and can be replayed from the console.

case.createdtask.routedtask.assignedreport.reworkreport.delivered

Verify the signature on every event:

// headers
X-Ambrezo-Event:     report.delivered
X-Ambrezo-Signature: sha256=<hmac>

// verification (node)
const expected = "sha256=" + crypto
  .createHmac("sha256", WEBHOOK_SECRET)   // from the console
  .update(rawBody)
  .digest("hex");
const valid = timingSafeEqual(expected, signatureHeader);

report.delivered payload includes the outcome and a durable report URL:

{
  "event": "report.delivered",
  "case_ref": "AMB-81464",
  "external_loan_id": "UCD1000093",
  "applicant": "Ramesh Powar",
  "task_ref": "AMB-T-87C89D",
  "fi_type": "rv",
  "recommendation": "Positive",
  "report_url": "https://ambrezo.com/report/<task-id>",
  "submitted_at": "2026-07-10T13:58:00Z",
  "timestamp": "2026-07-10T15:20:04Z"
}

Errors

401 { "error": "invalid api key" }        // wrong or revoked key
400 { "error": "applicant and pincode are required" }
400 { "error": "<validation message>" }