Sandbox and going live

The sandbox

	Sandbox	Live
Base URL	https://partners.sandbox.finto.lt	https://partners.finto.lt
Keys	fnt_test_...	fnt_live_...
Data	Generated only	Real applications
IP allow-list	Optional	Required
Webhooks	Sent and signed as in live	Sent and signed
Extra endpoints	/v1/sandbox/*	None (404)

The sandbox runs the same code as live, separately: its own database, files, keys, webhook secrets and network. It sends nothing to the outside world except your webhooks: no emails, no messages to real people, no calls to other lenders.

Test data is deleted 30 days after it is created. You can create up to 200 test applications per day.

Test identities

Applications are generated with fictitious names, phone numbers and addresses. Personal codes come from the public Smart-ID and Mobile-ID test identities, so they can never match a real person.

The PDF is rendered from the same template as in live, with the generated data, but in the sandbox it carries no electronic signature; signature in the JSON is filled as in live. To try your signature validation, ask Finto for a sample PDF signed with a test identity.

Creating test applications

POST /v1/sandbox/applications
Content-Type: application/json

{ "scenario": "joint", "amount": 9000, "termMonths": 48 }

Every field is optional. The application is addressed to you only, signed, and you get application.submitted as with a real one.

scenario	What you get
standard (default)	Cash loan, one applicant, employment income, no obligations
car_lease	Car leasing with a down payment and declared monthly expenses
car_loan	Car loan
refinancing	Refinancing of existing obligations
joint	Applying with the spouse; the spouse's incomes included
multiple_incomes	Employment plus self-employment and other income
high_obligations	Existing monthly payments close to the income
pep	The client is a politically exposed person
not_own_benefit	The financing is for another person (beneficial owner set)
minimal	Only required fields: every optional field is null, termMonths too

product, amount and termMonths override the scenario's values.

Playing the client and Finto

POST /v1/sandbox/applications/{applicationId}/simulate
Content-Type: application/json

{ "action": "select_offer" }

action	What happens	Event
select_offer	The client chooses your current offer. Needs your current status to be approved with a valid offer, otherwise 409	offer.selected
choose_other_offer	The client signs with another lender	application.closed (other_offer_chosen)
decline	The client no longer wants the financing	application.closed (client_declined)
expire	The application reaches expiresAt	application.closed (expired)
withdraw	The client withdraws consent	application.withdrawn
add_document	The client provides an income statement for you	application.updated (documents)
add_spouse_data	Finto adds the spouse's name, personal code and email	application.updated (data)
update_data	Finto corrects the client's phone number	application.updated (data)

The response contains the event, which is also delivered to your webhook and the feed. When your own decision closes the application (for example disbursed), you get the event as in live, without a simulated action.

Going live

The go-live check

Before Finto issues a live key, your integration passes this check in the sandbox. Finto watches the results in the sandbox, and you can run it at your own pace.

1. Connection. GET /v1/me works from your allowed IP addresses; you know where you see the key's expiry.
2. Webhooks. You receive a ping (POST /v1/events/test) and verify its signature; a request with a wrong signature is rejected by your endpoint.
3. New application. On application.submitted you fetch the application and download the signed PDF (visible in Finto's access log), and send in_review with your lenderReference and the applicationVersion.
4. Decisions. Across a few test applications you send: approved with a complete offer; approved for a different amount or term than requested; rejected (with a rejectionReason if you share reasons); info_required, then after add_document a new decision on the new version.
5. Idempotency. Repeating a decision with the same Idempotency-Key returns the stored decision and creates no second one.
6. Outcome. After select_offer you send contract_signed and disbursed; on another application, cancelled. On a paid-out one, the agreement's later fate: cancelled with withdrawal_right, or terminated.
7. Endings. You handle application.closed (stop the review) and application.withdrawn (stop processing; the application returns 410).
8. Missed webhooks. With your endpoint switched off, events created meanwhile are picked up from GET /v1/events once you are back.

Onboarding steps

1. Agreements. Finto and you sign the intermediation agreement and the data provision agreement; Finto is added to your public list of credit intermediaries.
2. Your profile at Finto. Legal name and company code (they are printed in the creditor table of the signed application), the products and limits you lend for, the hosts of your continueUrl, and contacts: business, technical (receives keys and secrets) and security incidents.
3. Sandbox access. A sandbox key through a one-time link, these docs, and a call with your IT team if you like.
4. Integration in the sandbox.
5. The go-live check above.
6. Live access. A live key, your IP allow-list and your webhook URL. From an agreed date you appear in the creditor table of new applications.
7. First weeks. Finto staff follow your first applications closely; tell us about anything unexpected.