> ## Documentation Index > Fetch the complete documentation index at: https://docs.nextlevelmca.com/llms.txt > Use this file to discover all available pages before exploring further. # Set lender API configuration > Switch the lender to a funder integration (`submission_method: "api"` + `funder_api_spec_id` + `api_credentials`) or back to `email`. Credentials are one comma-separated string in the order of the integration’s `credential_spec`, stored encrypted and returned masked; omit them to keep the stored ones. Switching environment with new credentials replaces them. Once on `api`, `POST /deals/{dealId}/submissions` sends to this lender through the integration and `use_api` is true. 400 `invalid_api_config` when the integration is unknown or switched off, the credential count is wrong, or credentials are missing. ## OpenAPI ````yaml /openapi/public-v1.json put /v1/lenders/{id}/api-config openapi: 3.0.0 info: title: NextLevel MCA Public API description: >- REST API for the NextLevel MCA deal platform. Objects flow Businesses → People → Deals → Submissions → Offers → Advances. **Authentication.** Send `Authorization: Bearer ` with an API key (`nlmca_live_…`, created in Settings → Developers) or an OAuth access token. Keys are scoped to one location. **Conventions.** JSON only. Cursor pagination (`limit` ≤ 100, `cursor` from `meta.next_cursor`). Every success is `{ data, meta }`; every error is `{ error: { type, message, code, param, request_id } }`. POST endpoints accept `Idempotency-Key` (24h replay). Rate limit 300 requests/min per credential (`X-RateLimit-*` headers). **Scopes.** Keys with no scopes have all of them. Otherwise: - `businesses:read` — Read businesses and their notes, tasks and activity - `businesses:write` — Create and update businesses, notes and tasks - `people:read` — Read people (contacts and owners) - `people:write` — Create and update people - `deals:read` — Read deals, submissions and the pipeline - `deals:write` — Create and update deals, move stages - `documents:read` — Read documents and statement analysis - `documents:write` — Upload documents and request documents from merchants - `lenders:read` — Read lenders, criteria and lender matches - `lenders:write` — Create and update lenders and criteria - `submissions:write` — Submit deals to lenders and withdraw submissions - `offers:read` — Read offers - `offers:write` — Log and update offers, set the primary offer - `advances:read` — Read funded advances and renewal flags - `advances:write` — Update advances - `portal:send` — Generate and send merchant portal links - `webhooks:manage` — Manage webhook subscriptions version: '1.0' contact: {} servers: - url: https://api.nextlevelmca.com description: Production security: - bearer: [] tags: - name: Businesses description: Merchant businesses and their notes, tasks and activity - name: People description: Contacts and owners. Phone lookups normalise to E.164. - name: Deals description: Deals, stage moves, renewals and the pipeline - name: Documents description: Documents, presigned uploads, document requests and statement analysis - name: Lenders description: Lenders and their criteria - name: Lender matches description: Criteria-driven lender matching for a deal - name: Submissions description: Sending deals to lenders - name: Offers description: Lender offers and the primary offer - name: Advances description: Funded advances and renewal readiness - name: Merchant portal description: Magic links for the merchant portal - name: Webhooks description: Outbound event subscriptions paths: /v1/lenders/{id}/api-config: put: tags: - Lenders summary: Set lender API configuration description: >- Switch the lender to a funder integration (`submission_method: "api"` + `funder_api_spec_id` + `api_credentials`) or back to `email`. Credentials are one comma-separated string in the order of the integration’s `credential_spec`, stored encrypted and returned masked; omit them to keep the stored ones. Switching environment with new credentials replaces them. Once on `api`, `POST /deals/{dealId}/submissions` sends to this lender through the integration and `use_api` is true. 400 `invalid_api_config` when the integration is unknown or switched off, the credential count is wrong, or credentials are missing. operationId: lenders_putApiConfig parameters: - name: id required: true in: path description: Lender id schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateLenderApiConfigDto' responses: '200': description: OK content: application/json: schema: type: object required: - data - meta properties: data: $ref: '#/components/schemas/LenderApiConfigDto' meta: $ref: '#/components/schemas/EmptyMetaDto' '400': description: Validation failed. `error.param` names the field. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '401': description: Missing, invalid, expired or revoked credential. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '403': description: Credential lacks the scope, or the role lacks the permission. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '404': description: Resource not found in this location. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' '429': description: Rate limit exceeded. See `X-RateLimit-*` and `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelopeDto' security: - bearer: [] components: schemas: UpdateLenderApiConfigDto: type: object properties: submission_method: type: string enum: - email - api description: >- `api` routes submissions through the funder integration; `email` switches back (the stored credentials are kept). funder_api_spec_id: type: string description: >- Funder integration id from `GET /lenders/api-specs`. Required the first time `submission_method` is set to `api`. maxLength: 50 api_environment: type: string enum: - development - production default: development description: >- Environment the credentials belong to. Switching to `production` with new credentials replaces the development string. api_credentials: type: string description: >- Credentials as one comma-separated string in the order of the integration’s `credential_spec`. Write-only: stored encrypted, returned masked. Omit to keep the stored credentials; required when the integration changes. maxLength: 4000 required: - submission_method LenderApiConfigDto: type: object properties: lender_id: type: string description: Lender id. submission_method: type: string enum: - email - api description: '`email` or `api`.' funder_api_spec_id: type: string nullable: true description: Funder integration id. spec_display_name: type: string nullable: true description: Funder name. api_environment: type: string enum: - development - production description: Environment the stored credentials belong to. credentials_masked: type: string nullable: true description: >- Masked credentials: `••••` + the last 4 characters of the last field. Null when none are stored. credential_fields: description: Fields expected in `api_credentials`, in order. type: array items: $ref: '#/components/schemas/CredentialFieldDto' api_last_verified_at: type: string nullable: true description: When the credentials last passed a connection test (ISO 8601). api_last_error: type: string nullable: true description: >- Last error from the funder (credentials rejected, failed test). Cleared when the configuration is saved. capabilities: nullable: true allOf: - $ref: '#/components/schemas/FunderCapabilitiesDto' tier: type: string nullable: true enum: - A - B - C description: Integration tier. required: - lender_id - submission_method - funder_api_spec_id - spec_display_name - api_environment - credentials_masked - credential_fields - api_last_verified_at - api_last_error - capabilities - tier EmptyMetaDto: type: object properties: {} ErrorEnvelopeDto: type: object properties: error: $ref: '#/components/schemas/PublicErrorDto' required: - error CredentialFieldDto: type: object properties: key: type: string description: Field key. label: type: string description: Label to show next to the field. secret: type: boolean description: True for secrets (never returned). hint: type: string description: Hint on where the value comes from or what it accepts. required: - key - label - secret FunderCapabilitiesDto: type: object properties: polls: type: boolean description: >- The funder exposes application status; NextLevel polls it (15 min for 2 h, hourly to 24 h, every 6 h to 7 days). returns_offers: type: boolean description: >- The funder returns structured offers, which are logged on the deal automatically. uploads_docs: type: boolean description: Documents are forwarded with the application. sandbox: type: boolean description: A sandbox exists; `development` credentials are tested against it. max_owners: type: number description: Owners forwarded to the funder (highest ownership first). required: - polls - returns_offers - uploads_docs - sandbox - max_owners PublicErrorDto: type: object properties: type: type: string enum: - validation_error - authentication_error - permission_error - not_found - conflict - rate_limit_error - api_error message: type: string description: Human-readable explanation, safe to show to an operator or an agent. code: type: string description: >- Stable machine-readable code, e.g. `missing_scope`, `duplicate_business`. param: type: string description: Request field the error refers to, when applicable. request_id: type: string description: Echo of the `X-Request-Id` header. Quote it when contacting support. required: - type - message - request_id securitySchemes: bearer: scheme: bearer bearerFormat: API key or JWT type: http description: API key (`nlmca_live_…`) or OAuth access token ```` ## Related topics - [Get lender API configuration](/api-reference/lenders/get-lender-api-configuration.md) - [Security](/mcp/oauth-and-security.md) - [Set the primary offer](/api-reference/offers/set-the-primary-offer.md)