VendorLogic
Request access

Docs / API and agents

Application drafts API

Save and resume an unsent credit application across devices; one sealed draft per signed-in customer and application form, kept 30 days.

A signed-in customer's unsent application is saved on the server so it resumes on another device. Anonymous applicants (email link, QR or sales-rep link without an account) have no user to attach a draft to and keep the browser-only draft.

All routes need a session and the applications.create permission (otherwise 403). The draft is always the caller's own: the user comes from the session, never from the URL, so another user's or another organization's draft is a 404, not a 403. Responses are private, no-store.

Method and pathWhat
GET /applicant/drafts/:configVersionIdthe caller's draft of that published form version: { form, customResponses, step, savedAt }. 404 when there is none or it expired.
PUT /applicant/drafts/:configVersionIdcreate or overwrite it. Body { form, customResponses?, step? }, at most 100 KB. 404 for an unknown form version, 400 for a malformed body, 503 when field encryption keys are not configured. Returns { savedAt }.
DELETE /applicant/drafts/:configVersionIddiscard it. Always { ok: true }.

What is stored#

  • The form is sealed (AES-256-GCM, bound to the user and the form version) before it reaches the database; there is no plaintext copy.
  • Never stored: the signature image, the signed name, and the principals (owners and officers, which carry SSN last four). The server drops those keys even if a client sends them; a customer re-enters principals and signs on the device that submits.
  • One draft per user and form version. Each save overwrites it and restarts the expiry.

Lifetime#

A draft expires 30 days after its last save: reads stop returning it at once, and the daily retention-cleanup job deletes the row. Submitting the application deletes the caller's draft of that form version in the same transaction as the submission.