Record the lender's decision on an assessment

POST/api/v1/credit/underwriting/assessments/{assessment_id}/decision

Records approved or declined on a completed assessment, with an optional merchant_message shown to the merchant as written and an internal note (never returned to an API token or put in an event). Approving opens the merchant's line through the path auto-approval uses (approved_limit_cents and approved_term_days default to the requested ones and must fit the program, CREDIT_512 and CREDIT_513), or links the line already open for the merchant; open_line: false records the approval and opens nothing. If the line cannot be opened nothing is recorded. Declining queues the adverse-action notice when the program's compliance policy has it on. Emits credit.underwriting.decided. One decision per assessment: repeating it returns the record (200), a different one is 409 CREDIT_553; a pending or failed assessment is 409 CREDIT_552. An API token with the credit scope, or a console operator (a live business needs a fresh two-factor check).

Operation ID: decide_underwriting_assessment·View as markdown·OpenAPI slice

Authentication

Bearer token authentication. Pass your DayZero API token in the Authorization header and the target business UUID in x-business-id.

Parameters

Path

assessment_idstringrequired: The completed assessment to decide.

Request body

Schema: UnderwritingDecisionRequest

decisionstringrequired

approved or declined.

One of: approved, declined

decline_reason_codesarray · string

Decline only: principal reason codes from the program's lender-approved decline_reason_catalog.

merchant_messagestring

Shown to the merchant as written.

notestring

Internal. Never returned to an API token or put in an event.

approved_limit_centsinteger

Approve only. Defaults to requested_limit_cents, or the assessment's sized limit (limit_sizing) when that is lower; must sit in the program's limit envelope (CREDIT_512).

approved_term_daysinteger

Approve only. Defaults to requested_term_days; must be one of the program's terms (CREDIT_513).

approved_rate_bpsinteger

Approve only. The rate a line opened by the approval takes, in basis points. Defaults to the scorecard's rate_by_grade for the assessment's grade, else the program's default_rate_bps.

open_lineboolean

Approve only. Open the line now, or link the one that already exists for this merchant. False records the approval and opens nothing.

Responses

200Successful Response

Schema: SuccessEnvelope_UnderwritingAssessmentResponse_

successboolean
messagestring
codestring
dataUnderwritingAssessmentResponse

400Bad Request - Invalid input

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

401Unauthorized - Missing or expired token, an MCP OAuth token used against the REST API, or no access to this business

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

403Forbidden - Insufficient permissions

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

404Not Found - Resource does not exist

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

409Conflict - Resource already exists or is in an incompatible state

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

422Validation Error

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

Code samples

POST/api/v1/credit/underwriting/assessments/{assessment_id}/decision

bash

curl -X POST 'https://api.ondayzero.com/api/v1/credit/underwriting/assessments/{assessment_id}/decision' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID' \
  -H 'Content-Type: application/json' \
  -d '{
  "decision": "approved"
}'