MCA Manager Public API

v1.5.0 · openapi.json · Postman collection · guide · webhooks · keys

REST API for MCA Manager. Authenticate with a per-tenant API key (Authorization: Bearer mca_live_… or mca_test_…) or an OAuth 2.0 access token from /oauth/token (mca_at_…; see /help/connected-apps), scoped per resource (read / write). The base URL is your company host, e.g. https://acme.mcamgr.com. Every response carries X-Request-Id and X-RateLimit-Limit / X-RateLimit-Remaining; errors share one envelope { error, code, details?, requestId }. Lists paginate by cursor. POSTs honour Idempotency-Key. Outbound webhooks (Settings → Webhooks or /api/v1/webhook-endpoints) POST a signed envelope { id, event, version, occurredAt, data } for the events listed at /help/webhooks.

Conventions

• Auth: Authorization: Bearer mca_live_…; each operation names the scope it needs (e.g. deals:write; write implies read).
• Errors: { error, code, details?, requestId }. Quote requestId (also in X-Request-Id) when reporting a problem.
• Lists: limit (≤200) + cursor → { items, count, hasMore, nextCursor }; sort=field:asc|desc, expand=, fields=, ids=, q=, date windows.
• Writes: send Idempotency-Key on POSTs; money is a decimal string ("425.00"); timestamps are UTC ISO-8601.
• Rate limit: 120 requests per minute per key; X-RateLimit-Remaining counts down, 429 carries Retry-After.

Webhook events

• deal.created — A deal was created (staff, API, portal or email intake).
• deal.updated — A deal's fields were edited (staff or API). changed names the fields; values are not repeated — fetch the deal.
• deal.deleted — A deal was deleted (only possible while nothing references it). A tombstone for updatedSince sync.
• deal.state_changed — A deal moved to a new state (funded, collections, closed, defaulted…).
• merchant.created — A merchant record was created.
• lead.created — A lead was created.
• lead.status_changed — A lead's status changed.
• submission.status_changed — A funder submission moved to a new pipeline status.
• payment.created — A payment row was created: a pull scheduled, a fee charged, a payment recorded or imported (rows from history loads only when recent). A schedule rebuild sends one per new pull.
• payment.cancelled — A payment was cancelled (by staff, a payoff close-out, a schedule repair or rebuild). Kept on record; never collected.
• payment.deleted — A mistaken manual payment was deleted (its journal reversed). A tombstone for updatedSince sync.
• payment.refunded — Money went back to the merchant (a refund was paid out); also sent as payment.paid with a negative credit amount.
• payment.paid — A payment was marked paid (staff, processor, import or API). type and direction tell a collection from a fee or a refund (a refund is a negative credit).
• payment.bounced — A payment was returned; carries the NACHA return code when known.
• merchant.bank_account_changed — A merchant's bank account was added, edited, re-ordered or removed. Never carries account or routing numbers.
• person.merged — Two person records were merged; contacts on the dropped one now point at the kept one.
• contract.generated — A contract requested through the API (POST /deals/{id}/contracts) was generated: a draft signature request is ready to review and send.
• contract.failed — A contract requested through the API could not be generated; carries the reason (no signers chosen, template archived, conversion failed…).
• esign.sent — A signature request went out to its signers (staff or API).
• esign.voided — A signature request was withdrawn; its signer links stop working.
• esign.signed — One party signed a document sent for signature.
• esign.completed — Every party signed; carries the filed document id and url.
• esign.declined — A signer declined; the request stopped and carries their reason.
• webhook.test — Sent by the Send test button.

Schemas