v0.2.0

Drawserv Lender API

Read and write your Drawserv book from your own systems: projects, draws, inspections, budgets, documents and events. One key per institution, scoped to what your portal already shows.

What it covers

Scope

The API returns what your portal login shows: the same lender, the same department, the same fields. Underwriting work product (risk score and tier, quality rating, staff notes, the lien mark, company verification, inspector fees) is not in any schema. A record outside your view is a 404, never a 403.

Field names match the Drawserv data model. Money is dollars to the cent, as JSON numbers.

Access

• Keys. A key acts for your institution, optionally one department, never a person. Drawserv staff issue it, show it once, store a hash and can revoke it. Send it as a bearer token.
• Scopes. A key carries scopes as its ceiling. A new key starts with the 5 read scopes. IP allowlist and expiry are optional.
• Request log. Every request is recorded: key, method, path, status, duration, address, request id.
• Sandbox. dsk_test_ keys run against a scrubbed copy of your book. Nothing there reaches production.

Scopes

First call

GET /me needs no scope. It returns the lender, the department and the key.

curl https://app.drawserv.com/api/v1/me \
  -H "Authorization: Bearer dsk_live_…"

Then GET /projects for the book and GET /draws?scope=working for what is in flight. Lists are paged (page, per_page up to 200). Every response carries an X-Request-Id to quote if something looks wrong.

# the book, newest first
curl "https://app.drawserv.com/api/v1/projects?per_page=100" -H "Authorization: Bearer dsk_live_…"

# draws in flight
curl "https://app.drawserv.com/api/v1/draws?scope=working" -H "Authorization: Bearer dsk_live_…"

# one draw: lines, approvals, lien waivers
curl "https://app.drawserv.com/api/v1/draws/<drawId>" -H "Authorization: Bearer dsk_live_…"

Endpoints

Every operation in the contract, its phase (P1 the read door, P2 writes and documents, P3 events and webhooks, P5 Ask Corbin for lenders), and whether it is served today. The reference has parameters, schemas and an example for each.

Errors

Every non-2xx response is one object with one of a closed set of codes. The code is the contract; the message is for a person.

{
  "error": {
    "code": "forbidden_scope",
    "message": "This key does not carry draws:read.",
    "requestId": "req_…"
  }
}

Versioning

/v1 in the path. Changes are additive: a field is never renamed or retyped, an enum value never changes meaning, a retired value stays declared. A breaking change ships as /v2 beside /v1, with twelve months’ notice.

Tools Coming

Thin clients of the same contract, declared in the reference and not served yet. The reference’s appendices list every tool and command.

Security

Read-only by default. Rows and columns scoped by the portal’s own rules. A hashed secret shown once, scopes, optional IP allowlist and expiry, immediate revocation, a log of every request, and a service identity that cannot sign in. Webhooks are signed with HMAC-SHA256 over a timestamped body. SOC 2 materials are on the Trust Center.