Patch Api Loans Id Assign

Authentication

AuthorizationBearer
Bearer token in the `Authorization` header. Integrators send an API key; the SpreadSpace dashboard sends a WorkOS JWT. The key prefix selects the mode against the same base URL: `ss_live_…` operates on live workspace data, while `ss_test_…` routes to the isolated developer sandbox tenant (test mode) where uploads return canned $0 sample extractions. See the "Testing (test mode)" section of the API description for details. Example: `Authorization: Bearer ss_live_…`.

Path parameters

idstringRequired

Headers

Idempotency-KeystringOptional<=255 characters
Stripe-style idempotency token. Optional. When provided on a POST/PATCH/PUT/DELETE call from a service-account principal, the server caches the response for 24h keyed on (api_key_id, header). Subsequent retries within 24h that present the same key replay the cached response verbatim with `Idempotency-Replay: true` set on the response. Replays for a key with a different request body return 409 `idempotency_request_mismatch`. Maximum length 255 characters; a typical value is a UUID generated by the client.
SpreadSpace-VersionstringOptionalformat: "^\d{4}-\d{2}-\d{2}$"

Date-stamped API surface version. Optional; sending no header (and having no per-key pin) resolves to the latest supported version 2026-05-03. Supported versions: 2026-05-03. Future breaking changes ship under new date stamps; existing callers keep the version they pinned.

Request

This endpoint expects an object.
user_idstring or nullOptionalformat: "uuid"
user_idslist of strings or nullOptional
lender_idstring or nullOptional<=128 characters

Response headers

X-Request-IDstring

Stripe-style per-request correlation ID. Echoed from the inbound X-Request-ID header when the client provides one, otherwise minted server-side as req_<24 hex chars>. Quote in support tickets so we can find the request’s logs.

Idempotency-Replayboolean

Set to true when the response is replayed from the idempotency cache for a request that re-presented an Idempotency-Key it had already used. Absent on the original (winner) response. Replays are byte-for-byte identical to the original response body.

SpreadSpace-Versionstring

The API surface version the server resolved for this request. Always present, regardless of whether the client supplied the request-side SpreadSpace-Version header. Default: 2026-05-03.

Response

OK
loan_idstring
borrower_idstring
assigneeslist of objects
statusstring
created_atdatetime
updated_atdatetime
has_effective_pii_accessboolean
borrower_namestring or null
portfolio_idstring or null
portfolio_namestring or null
loan_typestring or null
loan_sub_typestring or null
custom_type_idstring or nullformat: "uuid"
custom_sub_type_idstring or nullformat: "uuid"
loan_type_labelstring or null
loan_sub_type_labelstring or null
namestring or null
loan_numberstring or null
requested_amountdouble or null
rate_typestring or null
interest_ratedouble or null
term_monthsinteger or null
prioritystring or null
notesstring or null

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
409
Conflict Error
429
Too Many Requests Error
500
Internal Server Error