Update or decide a case
curl --request PATCH \
--url https://app.sahlfinancial.com/api/v1/cases/{case_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"status": "approved",
"decision_note": "Income and documents verified."
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({status: 'approved', decision_note: 'Income and documents verified.'})
};
fetch('https://app.sahlfinancial.com/api/v1/cases/{case_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.sahlfinancial.com/api/v1/cases/{case_id}"
payload = {
"status": "approved",
"decision_note": "Income and documents verified."
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"id": "7e3b9a14-2d6c-4c85-b1f0-6a8d4e2c9b37",
"tenant_id": "0b6f5a3e-7c1d-4e0a-9d2f-3a1c5e8b7f10",
"document_id": null,
"applicant_name": "Test Client",
"applicant_cin": "AB123456",
"borrower_type": "private_sector",
"status": "approved",
"priority": "medium",
"score": 742,
"risk_level": "low",
"eligible_amount": 350000,
"score_breakdown": null,
"ai_insight": null,
"decision": "approved",
"decision_at": "2026-10-07T09:14:22Z",
"decision_by": "5d2c7e91-4b8a-4f63-a0c5-91e7d3b2c4a8",
"decision_note": null,
"assigned_to": null,
"environment": "sandbox",
"external_reference": null,
"metadata_json": null,
"created_at": "2026-10-07T09:14:22Z",
"updated_at": "2026-10-07T09:14:22Z"
}{
"detail": "Invalid or expired token"
}{
"detail": "Insufficient permissions"
}{
"detail": "Case not found"
}{
"detail": [
{
"type": "missing",
"loc": [
"body",
"bank_code"
],
"msg": "Field required",
"input": {}
}
]
}{
"code": "rate_limit_exceeded",
"message": "Too many requests. Please slow down."
}Update or decide a case
Who can call it: tenant_admin, tenant_reviewer or platform_admin.
Only the fields you send change. Setting status to approved, refused or manual_review records the decision, its time and the deciding user. Fires the case.updated webhook.
Auth: dashboard session (Authorization: Bearer <access token>). Not available with a partner API key.
Update or decide a case
curl --request PATCH \
--url https://app.sahlfinancial.com/api/v1/cases/{case_id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"status": "approved",
"decision_note": "Income and documents verified."
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({status: 'approved', decision_note: 'Income and documents verified.'})
};
fetch('https://app.sahlfinancial.com/api/v1/cases/{case_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.sahlfinancial.com/api/v1/cases/{case_id}"
payload = {
"status": "approved",
"decision_note": "Income and documents verified."
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"id": "7e3b9a14-2d6c-4c85-b1f0-6a8d4e2c9b37",
"tenant_id": "0b6f5a3e-7c1d-4e0a-9d2f-3a1c5e8b7f10",
"document_id": null,
"applicant_name": "Test Client",
"applicant_cin": "AB123456",
"borrower_type": "private_sector",
"status": "approved",
"priority": "medium",
"score": 742,
"risk_level": "low",
"eligible_amount": 350000,
"score_breakdown": null,
"ai_insight": null,
"decision": "approved",
"decision_at": "2026-10-07T09:14:22Z",
"decision_by": "5d2c7e91-4b8a-4f63-a0c5-91e7d3b2c4a8",
"decision_note": null,
"assigned_to": null,
"environment": "sandbox",
"external_reference": null,
"metadata_json": null,
"created_at": "2026-10-07T09:14:22Z",
"updated_at": "2026-10-07T09:14:22Z"
}{
"detail": "Invalid or expired token"
}{
"detail": "Insufficient permissions"
}{
"detail": "Case not found"
}{
"detail": [
{
"type": "missing",
"loc": [
"body",
"bank_code"
],
"msg": "Field required",
"input": {}
}
]
}{
"code": "rate_limit_exceeded",
"message": "Too many requests. Please slow down."
}Authorizations
The access token (JWT) of a signed-in console user, from POST /v1/auth/login. It lasts 30 minutes. It is not an API key: a partner API key is refused here. There is no cookie.
Path Parameters
Body
application/json
Available options:
new, docs_received, identity_verified, bank_connected, scoring, scored, approved, refused, manual_review, expired Available options:
low, medium, high, urgent Available options:
approved, refused, manual_review Maximum string length:
2000Maximum string length:
255Maximum string length:
32Available options:
private_sector, public_sector, retiree, professional, merchant Response
OK