Developer documentation
RCN API overview
The concepts, resources and operating model behind a Redmont Credit Network integration.
What the API does
RCN is shared credit infrastructure for participating institutions. The API lets an institution identify an individual or organisation, report credit accounts and lifecycle events, query an explainable credit profile, request a durable report, and monitor material risk changes.
Decision support, not a lending decision
RCN returns risk information. Your institution remains responsible for identity checks, affordability analysis, underwriting, pricing, approvals, declines and compliance with applicable law.
| Resource | Purpose | Typical scope |
|---|---|---|
| Subjects | Canonical individual or organisation identity | credit:read / credit:report |
| Accounts | Institution-owned credit facilities | accounts:write |
| Events | Append-only account history and corrections | events:write |
| Credit | Score, grade, confidence, risk and reasons | credit:read |
| Reports | Saved point-in-time assessment | reports:request |
| Webhooks | Signed notifications for material changes | webhooks:manage |
Recommended integration lifecycle
- Create separate test and live API keys with the minimum scopes required.
- Search for an existing subject before creating one; treat duplicate responses as a review signal.
- Create the credit account with a stable external_account_id and an Idempotency-Key.
- Report every meaningful lifecycle event in chronological order with unique source_reference values.
- Query the credit profile only for a documented purpose and correct inquiry type.
- Subscribe to material-risk webhooks and verify every signature before processing.
- Reconcile reporting health, audit logs, failed webhooks and disputes on an operational schedule.
API conventions
- Base path: /api/v1. JSON is used for request and response bodies.
- Identifiers are opaque UUID strings. Store them exactly; never infer meaning from their shape.
- Times are ISO 8601 timestamps. Send an explicit UTC offset, preferably Z.
- Money is sent as JSON numbers with at most two decimal places; currency is a three-letter uppercase code and defaults to DCR.
- Bearer authentication is required except for login, invitation acceptance and explicitly public endpoints.
- X-Request-ID is accepted and returned. Log it with every integration operation.