Get started

Authentication

A call that takes a body needs a key. A call you could open as a link does not.

Sandboxcc_test_…Anybody’s, from one call. 30 days.

Livecc_live_…Issued to a lender by Creditcrest, for the products it uses.

Get a sandbox key

No account, no card.

Request

curl -s -X POST https://app.creditcresttechnologies.com.au/v1/keys/sandbox

Response · 201trimmed

{
  "key": "cc_test_eyJ2Ijox…",
  "id": "solvlolg",
  "mode": "test",
  "expires": "2026-10-26"
}

Send it

In the Authorization header, on every call.

Request

curl -s -X POST https://app.creditcresttechnologies.com.au/v1/statement \
  -H "authorization: Bearer $CREDITCREST_KEY" \
  -H 'content-type: text/csv' \
  --data-binary @statement.csv

When a key is refused

Status	Error
`401`	`key_required`	The call takes a body and no key was sent.
`401`	`invalid_key`	The key was not issued by Creditcrest, or was changed.
`401`	`expired_key`	The key is past its date.
`401`	`revoked_key`	The key was withdrawn.
`403`	`out_of_scope`	The key is not for that product.
`429`	`rate_limited`	Too many calls this minute on this key.

What is recorded

Each call made with a key is counted — the key’s id, the endpoint, the status and the time — so it can be billed. Nothing you send is kept or logged.

GET`/v1/keys`Open ↗

Describes this API: what it takes and what it returns.

POST`/v1/keys/sandbox`

A sandbox key, straight away, for 30 days. No account.

GET`/v1/keys/me`Key

What the key you sent is: its id, lender, mode, scopes and expiry. Never the key itself.