Skip to content
/
Down Payment Link Retriev...

Direct API Guide

Documentation version 3.01, 20.11.2025

Please note, that the given document is only applicable for partners integrating in Estonia and Latvia.

Inbank API for Partners is designed for integrating third-party applications to Inbank's credit system. The API aims to follow RESTful best practices as closely as possible to achieve its main goal — to be flexible and applicable to multiple use cases. The current document describes the API endpoints available to partners.

For any questions regarding the integration process, contact Inbank at:

Note the partner is responsible for authenticating the customer before the partner transmits customer data to Inbank. Acceptable authentication methods are ID card, Mobile ID or Smart-ID. The partner must be able to prove the customer's authentication to Inbank.

Full integration with Inbank API gives merchants access to the following Inbank products:

Hire Purchase

The Inbank Hire Purchase solution gives customers the opportunity to pay for purchases in installments with an affordable interest rate. Read more about Inbank Hire Purchase on our website.

Split into parts

This payment solution offers clients to buy goods and services and pay for them later in several equal instalments. Split into parts is free of charge for customers, while merchants get paid upfront in full the next working day. Read more about this payment solution on our website.

Flow Overview

API Request Flows in Case of Positive Decision

API Request Flow

*Note that step 6 is only required if the flow is using SMS signing.

API Request Flow with Partner Approval

*Note that step 6 is only required if the flow is using SMS signing.

API Request Flow with Down Payment

API Request Flow with Down Payment and Partner Approval

API Request Flows in Case of income_proof_required Decision

* Note that for all API flows in case of income_proof_required decision with income_proof_type returned as manual_internal_verification, instead of steps 2 and 3 the manual statement upload should be performed. More information can be found here.

API Request Flow

API Request Flow with Partner Approval

API Request Flow with Down Payment

API Request Flow with Down Payment and Partner Approval

Demo Environment

Inbank provides a separate environment for development and integration testing. The testing environment remains available after the integration with Inbank has been completed. The testing and production environments differ, each having individual data sets.

Demo API environment for Estonia: https://demo-api.inbank.ee

Demo API environment for Latvia: https://demo-api.inbank.lv

For testing purposes, the system returns preconfigured decisions. Positive decisions are given for amounts 0 - 500, 15 000 - 16 000.

The credit application process may include an OTP code exchange via SMS. The demo environments do not send out SMS messages. If you are testing the Split into parts payment product, the SMS message is hardcoded to value 0000.

To test the financing products in Estonia and Latvia, you can safely use your own Estonian/Latvian ID-code and ID-card, as the demo environment does not initiate real binding contracts. Alternatively in Estonia, you can use our demo user, the identity code of which is 10101010005. Besides the identity code, you will also need a name and a phone number for authentication and signing.

To use an ID-card or Mobile-ID in the demo environment, you need to register them at:

You can also use Smart-ID by downloading the following apps:

To use Smart-ID for testing, your account level should be Qualified. You can check the account level at https://sid.demo.sk.ee/portal/login.

Credit Contract State Model

Inbank will send callbacks about changes to the credit contract status. Contracts can have the following statuses:



StatusDescription

unsigned

A contract has been created, but has not yet been signed by the customer and/or Inbank.
signed

The contract has been signed by both the customer and Inbank.

For the flow which includes merchant approval, this state indicates that the credit has been granted by Inbank and the system is now awaiting approval from the partner to activate the contract.

activatedThis is the target state: credit contract between customer and Inbank has been activated, merchant is liable for the delivery of goods/services.
cancelled

The credit contract has been cancelled. This state applies only to contracts which previously were unsigned or signed.

For the flow which includes merchant approval, signed contracts get the status cancelled when the merchant has not approved the contract.

terminatedAn existing credit contract has been terminated. This state can only be applied to contracts which previously were activated.

Authentication

Inbank will provide you with an API key, used for authentication, and a unique identifier of your shop, required for building API URLs. The API-key should remain private at all times.

To obtain access to the API endpoints, place the API key in the Authorization header of the request. The Authorization header should have the Bearer scheme and your API key, for example:

Authorization: Bearer e93174d3b9158a01c861c65fab0e7f96

The API server will then verify the API key authenticity.

In most cases, you will need to use a shop identifier (shopUuid) in the path of the API endpoint. Shop identifier is provided to you by Inbank together with the API key.

In case of unsuccessful authorization, the system will return the following message:

{
    "error": [
        "unauthorized"
    ]
}

Content-Type

HTTP header Content-Type application/json is expected in all requests, unless otherwise specified in the endpoint description. Example:

Content-Type: applications/json

Callbacks

When sending a credit application via Inbank Partner API the e-shop has the option to provide the callbackUrl - the URL to which Inbank will send server-to-server callback notifications on financing process status change events. Callback requests are lightweight triggers for initiating activities on the merchant side. They contain only minimal information.

Inbank sends callbacks about the following state transition events:

Status in callback messageDescription
Decision related callbacks
POSITIVEThe credit application received a positive decision and the customer can move forward in the financing process.
NEGATIVEThe credit application received a negative, Inbank cannot offer financing to the customer.
FAILEDThe decision process has encountered issues and the decision cannot be made. If this status persists, please contact the Inbank integration team.
INCOME_PROOF_REQUIREDTo make a decision Inbank needs the customer to provide income proof documents.
Contract related callbacks
UNSIGNEDThe contact has been created and is now waiting for customer signature.
SIGNEDThe customer has signed the credit contract.
ACTIVATEDThe credit contract is now activated, the financing of the purchase has been completed.
CANCELLEDThe contract has been cancelled.
TERMINATEDThe previously activated contract has been terminated.
ACTIVATION_REQUIRES_PARTNER_APPROVALThe financing has been granted by Inbank. Partner's approval is now needed for contract activation. Applicable if the flow requires merchant approval of credit contracts.
DOWN_PAYMENT_PAID_BY_CUSTOMERThe customer has successfully paid the required down payment. Applicable if the flow includes making a down payment.

To avoid processing accidental or malicious traffic to callback endpoints, the handlers should first verify the authenticity of the request. For more details, see the Callback authenticity validation chapter.

E-shop should process the incoming messages, at a minimum, in the following way:

  • Validate the authenticity of the request, to avoid further processing of invalid traffic.
  • Look up the credit application UUID either from the incoming message, or from the internal database as it was returned when the application was sent.
  • Inspect the status message and process the order payment status based on it.
  • Redirect the user to the respective dialog, i.e. the “payment complete” page.

Note in case duplicated callbacks should arrive for a single payment session, please make sure that only the first callback is processed.

Request Structure

Callbacks are sent as http POST requests, ("Content-Type" => "application/x-www-form-urlencoded"). The POST form has the following structure:

ParameterExample valueDescription
message%7B%22type%22%3A%22DECISION%22%2C%22status%22%3A%22POSITIVE
%22%2C%22creditApplicationUuid%22%3A%2259d2194c-634f-4632-91b6-300b58e628ce%22%7D		URL-encoded JSON structure containing information about the financing process.
hmacc196e985640a6291723dc2717d264f82e70126c34b107f3be5b22201cb147c9
8b9709f5184a7f2fe82684d6086eee07df8a46c28fc0edfdd14fd306579244664

HMAC value.

For more details, see HMAC calculation logic described in the Callback authenticity chapter.

timestamp

1549411200

Current Unix timestamp at issuing server.
See https://en.wikipedia.org/wiki/Unix_time for more details.

Request header

{"Content-Type":"application/x-www-form-urlencoded"}

Request body

message=%7B%22type%22%3A%22DECISION%22%2C%22status%22%3A%22INCOME_PROOF_REQUIRED%22%2C%22creditApplicationUuid
%22%3A%22bb3853ce-2034-499e-8b08-42625fdf068b%22%7D&hmac=29087d41b6171ee7598c7789b507429a8227cdf46e68d6f14626f
62ef6d1a5894f3fbdc31c96e885e2dafde7abf24054a8c67a923c58dc86749208abb8a1f721&timestamp=1722587395319

Callback Message Content

The message contains minimal information, it is meant as a trigger to obtaining more detailed information over Partner API. The message body contains:

  • type - type of the Inbank entity the status of which is reflected in the callback. Possible types are CONTRACT and DECISION.
  • creditApplicationUuid - credit application UUID.
  • status - status of the financing process at the moment of message dispatch.

Callback Authenticity Validation

We use message authenticity hash (HMAC) transported within the POST request form field hmac.

To validate the message authenticity you need to calculate the verifying HMAC based on data from the request and your secret api_key, and compare the calculated HMAC with the HMAC value passed in the request.

Verifying HMAC is calculated as SHA512 HMAC, over the timestamp and message from the request, concatenated with . delimiter. Your shop API key is used as HMAC secret.

Pseudocode for example verifying HMAC calculation:

key = your_api_key;
req_timestamp = request[timestamp];
req_message = request[message];
req_data = req_timestamp+'.'+req_message;
v_hmac = hmac(“sha512”, key, req_data);

JavaScript example (Postman):

key = your_api_key;
req_timestamp = decodeURIComponent(request[timestamp]);
req_message = request[message];
req_data = req_timestamp + '.' + req_message;
v_hmac = CryptoJS.HmacSHA512(req_data, key);

PHP example:

$key = $settings->api_key;
$req_timestamp = $_POST['timestamp'];
$req_message = stripslashes($_POST['message']);
$v_hmac = hash_hmac('sha512', $req_timestamp . '.' . $req_message, $key);

API Endpoints

The API endpoints cover all the functionality necessary for full integration with Inbank systems.

Please note: Inbank payment methods should be available only for cart values that are within the price range agreed with Inbank. If you would like to receive the price range and other details of your Inbank product over API, please use the GET /products endpoint.

Languages
Servers
Demo environment
https://demo-api.inbank.ee/
Live environment
https://api.inbank.ee/

Calculations

Operations

Credit Applications

Credit applications are the initial step in the Inbank financing process. Once the application is reviewed and accepted by the customer, a credit contract is created.

Operations

Credit Contracts

Credit contracts contain the details of the financing agreement between the customer and Inbank. Once the contract is activated, the partner is to supply goods/services to the customer.

Operations

Contract Printout

Request

GET /partner/v3/shops/:shopUuid/contracts/:contractUuid/printouts

The details of the contract are included in the printout which can be retrieved using the GET /partner/v3/shops/:shopUuid/contracts/:contractUuid/printouts endpoint. The response includes the link to the contract printout file.

Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
Query
forceRegenerationboolean

Whether or not the resulting printout should be regenerated. Printout regeneration is required for cases when certain data is added to the contract after it is initially formed (e.g. purchase details). Force regeneration ensures that the contract printout includes all the new contract related data available in the system.

curl -i -X GET \
  'https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427/printouts?forceRegeneration=true' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Gets contract printout

Bodyapplication/json
uuidstring

Printout uuid.

Example: "8a5951fb-835f-4f5f-ae1a-508d5bdd15d5"
linkstring

Printout url.

Example: "https://test.link.com/attachments/printout/contract_89002917222"
Response
application/json
{
  "uuid": "8a5951fb-835f-4f5f-ae1a-508d5bdd15d5",
  "link": "https://test.link.com/attachments/printout/contract_89002917222"
}

Contract Signing

Request

POST /partner/v3/shops/:shopUuid/contracts/:contractUuid/signings

After the customer accepts the credit offer and has reviewed the contract, they can proceed to contract signing which is done via the POST /partner/v3/shops/:shopUuid/contracts/:contractUuid/signings endpoint. There are the following signing methods available:

  • redirect - the method is used for contract signing by redirecting the client to a separate environment. The response to this request returns the URL to which the client should be redirected. The signing environment can be built into your site as an iFrame or just opened in a new browser tab. This signing method is available for the Inbank Hire Purchase payment product.
  • digital - the method is used in cases when the partner has a separate signing solution. The request with the digital signing method is used as a confirmation that signing has been successful. This signing method is available for the Inbank Hire Purchase payment product.
  • paper - the method is used if you are collecting paper contracts signed by the customer. This signing method is available for Split into parts and Inbank Hire Purchase payment products.
  • sms - with this method the signing is done using an SMS code. After you send the request, the customer will receive an SMS with the code from Inbank. After that, the code is sent over to Inbank for confirmation via the PATCH /contracts/:contractUuid/signings request. This signing method is available for the Split into Parts payment products.
  • send_to_signing_sms and send_to_signing_email methods send a link to the Inbank environment where customers can sign the contract. The link is sent to the mobile number / email address which was indicated in the credit application. This signing method is available for the Inbank Hire Purchase payment product.
Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
Bodyapplication/jsonrequired
methodstringrequired

The signing method to be used.

Enum"paper""digital""sms""sms_nexmo""redirect""payment""send_to_signing_email""send_to_signing_sms"
Example: "redirect"
curl -i -X POST \
  https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427/signings \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "redirect"
  }'

Responses

Creates a new signing

Bodyapplication/json
contractobject
Response
application/json
{
  "contract": {
    "uuid": "6b9fd89c-ddbd-4e27-9291-3de50d000000",
    "number": 89003110000,
    "customerSigned": null,
    "redirectUrl": "https://gateway-sandbox.dokobit.com/signing/e1a14498554d876"
  }
}

Contract Merchant Approval

Request

POST /partner/v3/shops/:shopUuid/contracts/:contractUuid/merchant-approval

If the flow includes merchant approval, the merchant checks if the status of the contract is signed using the GET /partner/v3/shops/:shopUuid/contracts/:contractUuid request. When the contract is in the signed status, the merchant needs to approve or cancel the contract. As processing customer signing might take some time, the endpoint may need to be polled once every second for a maximum of 15 seconds.

To approve the contract, the e-shop needs to know the credit contract UUID, which is in the response to the POST/:applicationUuid/accept request.

The request does not require any parameters to be passed in its body.

Note that you can also approve contracts in the Partner Portal.

Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
curl -i -X POST \
  https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427/merchant-approval \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Merchant approval and activation

Response
No content

Contract Cancellation

Request

POST /partner/v3/shops/:shopUuid/contracts/:contractUuid/cancel

If the flow includes merchant approval, the merchant checks if the status of the contract is signed using the GET /partner/v3/shops/:shopUuid/contracts/:contractUuid request. When the contract is in the signed status, the merchant needs to approve or cancel the contract. As processing customer signing might take some time, the endpoint may need to be polled once every second for a maximum of 15 seconds.

To cancel the contract, the e-shop needs to know the credit contract UUID, which is in the response to the POST/:applicationUuid/accept request.

The request does not require any parameters to be passed in its body.

Note that you can also cancel contracts in the Partner Portal.

Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
curl -i -X POST \
  https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427/cancel \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Cancel contract

Response
No content

Contract Status

Request

GET /partner/v3/shops/:shopUuid/contracts/:contractUuid

Once the credit contract UUID has been retrieved and the contract has been signed, the partner can check the status of the credit contract using the GET /partner/v3/shops/:shopUuid/contracts/:contractUuid request. The response will include the status parameter. If the status is activated, the purchase has been successfully financed by Inbank and the purchase items can be forwarded to the customer.

If the flow includes merchant approval, the merchant checks if the status of the contract is signed. When the contract is in the signed status, the merchant needs to approve or cancel the contract. If the merchant approved the contract, they need to check if the contract status has been changed to activated, which indicates that the purchase was successfully financed by Inbank.

For the flow which is to include down payment transfer, the contract status needs to be checked twice as well:

  • Firstly, after contract signing, the partner checks that the status of the contract is signed to see if the signing process has been completed.
  • Secondly, after the POST /payment-link API call, the partner checks the status of the contract to make sure the down payment transfer has been successful. If the status is activated, the purchase has been successfully financed by Inbank and the purchase items can be forwarded to the customer.

As customer signing processing might take some time, the endpoint may need to be polled for a certain amount of time:

  • In case of digital, sms or paper signing methods, the endpoint needs to be polled once every second for a maximum of 15 seconds.
  • In case of the redirect, send_to_signing_sms and send_to_signing_email signing methods, there is no certain time when the customer will perform the signing. In this case, the endpoint needs to be polled at a reasonable interval for 7 days. This is also applicable if the flow includes the income proof verification process. For detailed information on the income proof flow, please contact your Inbank representative.
Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
curl -i -X GET \
  https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427 \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Returns contract details

Bodyapplication/json
contractobject

Returns contract details.

Response
application/json
{
  "contract": {
    "status": "unsigned",
    "terminationReason": null,
    "uuid": "11d1baeb-1da1-1c01-b111-12111211c1a1",
    "number": 89001350000,
    "payoutAccountNumber": "EE19824845453792774580000000",
    "activatedAt": null,
    "activatorName": null,
    "terminatedAt": null,
    "productCode": "insurance_fin",
    "customerSigned": null,
    "repSigned": null,
    "signedAt": null,
    "partnerApprovalAt": null,
    "customerUuid": "40837f6d-0000-0000-0000-59a5b1efedd8",
    "identificationSatisfied": true
  }
}

Contract Withdrawal

Request

POST /partner/v3/shops/:shopUuid/contracts/:contractUuid/merchant-withdrawal

Using this endpoint, information on Inbank Hire Purchase and Split into parts purchase returns can be submitted to Inbank.

This API call notifies Inbank that the merchant is willing to make withdrawal of the indicated contract. The exact terms of withdrawal need to be agreed with Inbank.

Note, that the current endpoint is suitable for full withdrawal only. If you would like to make a partial return, please refer to the Partial Returns Guide.

Security
bearerAuth
Path
shopUuidstringrequired

The unique identifier of the shop.

Example: a93f1f44-d5dd-4469-bfcc-c1de9e969213
contractUuidstringrequired

The unique identifier of the contract.

Example: 788ec8c4-c497-470b-8505-2303f151d427
curl -i -X POST \
  https://demo-api.inbank.ee/partner/v3/shops/a93f1f44-d5dd-4469-bfcc-c1de9e969213/contracts/788ec8c4-c497-470b-8505-2303f151d427/merchant-withdrawal \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Merchant withdrawal

Response
No content