Appearance
Finto Partner API
IMPORTANT
Status: draft specification 1.0.0 for review (November 2026). The sandbox is being built to this specification. Your feedback is welcome before it opens; every later change is listed in the changelog.
The Finto Partner API connects credit institutions to loan applications submitted on finto.lt and autolizingas.lt.
A client fills in one application and signs it once, with Smart-ID or Mobile-ID. The signed document contains the client's data, the answers to the PEP and beneficial owner questions, and a table of the lenders the client asks Finto to send it to, with the client's consent that each of them checks the registers itself. Lenders in that table that are connected through this API receive the application and answer with a decision.
What you get
- A signed application. A PDF with the client's qualified electronic signature (Smart-ID or Mobile-ID), checked against the client's personal code, plus the same data as structured JSON.
- Consent for your own checks. The client agrees that you check them in credit bureaus, Sodra, the Centre of Registers and the Loan Risk Database of the Bank of Lithuania. The exact text is in signed-application.md.
- PEP and beneficial owner answers in every application.
- Events without personal data, as signed webhooks and as a gap-free feed you can read at any time.
- A sandbox where you create test applications and play the client's part yourself, without waiting for anyone.
Documentation
| Page | For |
|---|---|
| Quickstart | Your first integration in the sandbox, step by step, in 30 minutes |
| Lifecycle | States, decision statuses, what may follow what, and 16 scenarios |
| Application data | What each field means and how to map it |
| Conventions | Formats, idempotency, versions, order of decisions, limits, code generation |
| Events and webhooks | Delivery, retries, the feed, signature verification in five languages |
| Errors | Error format, every code, when to retry |
| Security | Keys, IP allow-lists, data protection, what we ask of you, your review |
| The signed application | What the client signs, word for word, for compliance and legal teams |
| Sandbox and going live | Test scenarios, simulated actions, the go-live check, onboarding |
| Changelog | Versioning rules, notice periods and changes |
| API reference | Every endpoint, field and limit, with examples |
| openapi.json | The API reference as OpenAPI 3.1. Import it into Postman, Insomnia or Bruno |
| openapi-3.0.json | The same as OpenAPI 3.0.3 with open enums, for code generators |
| Reference lender | A complete integration in one Node.js file |
| Apžvalga | Overview in Lithuanian for business and compliance teams |
Key facts
| Live | https://partners.finto.lt |
| Sandbox | https://partners.sandbox.finto.lt |
| Documentation | https://partners.finto.lt/docs |
| Authentication | Authorization: Bearer <key> from allow-listed IP addresses; keys expire within 12 months and can be revoked by you at any time |
| Format | JSON in UTF-8, camelCase fields, snake_case enum values, RFC 3339 times, euros as numbers |
| Webhooks | HTTPS POST to port 443, HMAC-SHA256 signature (Finto-Signature), retried for about two days |
| Events feed | Per lender, in order, without gaps; 30 days |
| Idempotency | Idempotency-Key header, required for decisions and uploads |
| Errors | application/problem+json (RFC 9457) with a stable code |
| Limits | 600 requests per minute per key |
| Versioning | /v1; compatible additions only, new enum values and event types announced 30 days ahead; breaking changes only in /v2 with 6 months' overlap |
The integration at a glance
You need four calls and one endpoint:
GET /v1/applications/{applicationId}: the application.GET /v1/applications/{applicationId}/documents/{documentId}: the signed PDF.POST /v1/applications/{applicationId}/decisions: your decision.GET /v1/events?after=<sequence>: the events feed.- Your webhook endpoint (optional, recommended).
Contact
Write to info@finto.lt to get sandbox access or to discuss the specification.