Pioneer Loan Platform API (1.0.0)

URL Structure

API requests use environment-specific domains (following existing portal pattern):

• Production: https://api.pioneerft.com/api/public/v1/... (use pk_live_* keys)
• Staging: https://api.staging.pioneerft.com/api/public/v1/... (use pk_test_* keys)

Versioning

The current version is v1, served under the /api/public/v1 path prefix. The legacy unversioned path /api/public/... still works but is deprecated: responses include Deprecation: true and a Sunset header. Migrate to /api/public/v1.

Authentication

All API requests require authentication using an API key. Include your API key in the Authorization header:

Key Types:

• pk_test_* - Test keys (only work on staging URLs)
• pk_live_* - Live keys (only work on production URLs - no env prefix)

API keys can be generated in the Pioneer dashboard under Organization Settings. Note: Production keys require explicit approval from Pioneer.

Rate Limiting

Rate limits are applied per API key, with separate budgets for reads and writes:

• Reads (GET): 100 requests per minute per API key.
• Writes (POST/PATCH/DELETE): 30 requests per minute per API key.

Rate limit information is included in response headers:

• X-RateLimit-Limit: Maximum requests per window
• X-RateLimit-Remaining: Requests remaining in current window
• X-RateLimit-Reset: Unix timestamp when window resets

When rate limited, you'll receive a 429 Too Many Requests response with a Retry-After header indicating seconds to wait.

⚠️ Important: Production API keys (pk_live_*) that exceed rate limits 3 or more times within 24 hours will be automatically revoked, and your organization's production API access will be disabled. Contact Pioneer support to re-enable access.

Idempotency

Write requests (POST/PATCH/DELETE) accept an optional Idempotency-Key header (any opaque string up to 255 chars; a UUID is recommended). Replaying a request with the same key returns the original response instead of repeating the side effect.

Pagination

List endpoints support pagination via query parameters:

• limit: Number of items to return (default: 50, max: 100)
• offset: Number of items to skip

Response includes pagination metadata. Offset-mode responses look like:

Cursor-mode responses (returned when a cursor query param is supplied) instead contain { "mode": "cursor", "limit": 50, "hasMore": true, "nextCursor": "<token>" }, where nextCursor is an opaque token (null when there are no more results). Pass it back as the cursor query param to fetch the next page. Offset and cursor are mutually exclusive, and cursor mode always orders by creation time.

Errors

Errors are returned with appropriate HTTP status codes and JSON body:

Common error codes:

• auth.invalid_key: API key is invalid or expired
• auth.org_mismatch: API key does not belong to the organization in the URL
• auth.env_mismatch: API key type does not match URL environment
• auth.env_not_available: Environment not available for this organization
• auth.insufficient_permissions: API key lacks required permission
• auth.country_restricted: Request IP not allowed for this API key
• api_key.production_not_allowed: Organization not approved for production API keys
• input.invalid: Request validation failed
• rate_limit.exceeded: Too many requests

OpenAPI document

The spec is published in two OpenAPI versions, both under Download OpenAPI description and each in YAML and JSON. They are generated from the same routes in the same run, describe the identical API, and differ only in schema dialect.

OpenAPI 3.1.0 is the current one. It uses JSON Schema 2020-12: type: [..., "null"] for nullables and numeric exclusiveMinimum/exclusiveMaximum.

OpenAPI 3.0.3 is for tooling that does not read 3.1 — the same document with nullable: true and boolean exclusive* instead. It is also what the Postman collection is generated from. 3.0.3 is the last patch of the 3.0 line; a consumer pinned to 3.0.0, 3.0.1 or 3.0.2 reads it without changes, since those patches clarify the specification rather than alter the document format.

If your generator supports both, take 3.1.0.

API clients

Ready-to-import clients are generated from these same routes in the same run, so they never drift from the live API. Both are listed under Download OpenAPI description above, next to the spec itself.

Postman. Import the collection plus the environment for your target (Staging or Production), then set apiKey to your key — every request inherits collection-level bearer auth. Path parameters such as :id appear as editable fields under the URL bar, and optional query parameters are pre-filled but disabled, so tick only the ones you need.

Insomnia. Imports OpenAPI directly: Import -> File -> choose the OpenAPI 3.0.3 YAML. Set the base environment's base_url to the environment you are targeting and add your key as a bearer token.

Need access or a key? Contact us.