Accept legal documents
curl --request POST \
--url https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"documentSetVersion": "1.0.0",
"acceptedDocuments": [
{
"id": "privacy_policy",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1"
}
]
}
'import requests
url = "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept"
payload = {
"documentSetVersion": "1.0.0",
"acceptedDocuments": [
{
"id": "privacy_policy",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
documentSetVersion: '1.0.0',
acceptedDocuments: [{id: 'privacy_policy', hash: 'sha256:e5f6a7b8c9d0', version: '1'}]
})
};
fetch('https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'documentSetVersion' => '1.0.0',
'acceptedDocuments' => [
[
'id' => 'privacy_policy',
'hash' => 'sha256:e5f6a7b8c9d0',
'version' => '1'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept"
payload := strings.NewReader("{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"success": true,
"message": "Legal documents accepted successfully",
"acceptance": {
"documentSetVersion": "1.0.0",
"acceptedAt": "2026-02-05T10:30:00.000Z",
"acceptedDocuments": [
{
"id": "privacy_policy",
"name": "Privacy Policy",
"location": "https://assets.orenda.finance/term-docs/Privacy_Policy.pdf",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1",
"required": true,
"applicableTo": [
"consumer",
"business"
],
"effectiveDate": "2026-02-05"
}
]
}
}
}{
"success": false,
"code": "VALIDATION_ERROR",
"message": "documentSetVersion: Required"
}{
"message": "Unauthorized"
}{
"success": false,
"code": "RESOURCE_NOT_FOUND",
"message": "Application not found"
}{
"success": false,
"code": "INTERNAL_SERVER_ERROR",
"message": "Internal Server Error"
}Onboarding
Accept legal agreements
Accept the program’s terms to finish onboarding.
POST
/
v1
/
applications
/
{applicationId}
/
documents
/
legal
/
accept
Accept legal documents
curl --request POST \
--url https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"documentSetVersion": "1.0.0",
"acceptedDocuments": [
{
"id": "privacy_policy",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1"
}
]
}
'import requests
url = "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept"
payload = {
"documentSetVersion": "1.0.0",
"acceptedDocuments": [
{
"id": "privacy_policy",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1"
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
documentSetVersion: '1.0.0',
acceptedDocuments: [{id: 'privacy_policy', hash: 'sha256:e5f6a7b8c9d0', version: '1'}]
})
};
fetch('https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'documentSetVersion' => '1.0.0',
'acceptedDocuments' => [
[
'id' => 'privacy_policy',
'hash' => 'sha256:e5f6a7b8c9d0',
'version' => '1'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept"
payload := strings.NewReader("{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.next.orenda.finance/v1/applications/{applicationId}/documents/legal/accept")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"documentSetVersion\": \"1.0.0\",\n \"acceptedDocuments\": [\n {\n \"id\": \"privacy_policy\",\n \"hash\": \"sha256:e5f6a7b8c9d0\",\n \"version\": \"1\"\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"success": true,
"message": "Legal documents accepted successfully",
"acceptance": {
"documentSetVersion": "1.0.0",
"acceptedAt": "2026-02-05T10:30:00.000Z",
"acceptedDocuments": [
{
"id": "privacy_policy",
"name": "Privacy Policy",
"location": "https://assets.orenda.finance/term-docs/Privacy_Policy.pdf",
"hash": "sha256:e5f6a7b8c9d0",
"version": "1",
"required": true,
"applicableTo": [
"consumer",
"business"
],
"effectiveDate": "2026-02-05"
}
]
}
}
}{
"success": false,
"code": "VALIDATION_ERROR",
"message": "documentSetVersion: Required"
}{
"message": "Unauthorized"
}{
"success": false,
"code": "RESOURCE_NOT_FOUND",
"message": "Application not found"
}{
"success": false,
"code": "INTERNAL_SERVER_ERROR",
"message": "Internal Server Error"
}When
currentStep is LEGAL_AGREEMENTS, first fetch the application’s current legal
documents with GET /v1/applications/{applicationId}/documents/legal. Display the
required documents, then submit their id, hash, and version together with the
documentSetVersion returned by that request.
The acceptance is validated against the current document set before the request returns; a
200 means it was accepted, and the platform then records it in the background.
Keep polling GET /v2/applications. For a few seconds after the
acceptance, currentStep is PROCESSING with no requiredActions while the platform records
it: show a loader, don’t ask the user to accept again. The application then
moves to its next step. If recording fails, LEGAL_AGREEMENTS comes back (within about two
minutes) so the user can accept again.
On GET /v1/applications the step stays LEGAL_AGREEMENTS for those few seconds, so after a
successful accept keep a loader up until currentStep changes.Authorizations
The user's access_token from authentication. The program and environment (sandbox/prod) are read from the token.
Path Parameters
The application id from create / get.
Query Parameters
Required on the Management API, where the token carries no program — omitting it returns 400. Customer API callers resolve the program from their token and should omit it; a value sent there is ignored.
Body
application/json
Unrecognised fields are ignored rather than rejected.
Must match the current program document set version returned by the legal-document GET endpoint.
Example:
"1.0.0"
Accepted documents copied from the legal-document GET response. Must include every required document for the account type.
Minimum array length:
1Show child attributes
Show child attributes