StartCap Partners API Documentation

async function submitLead() {
    const response = await fetch('https://www.startcap.org/app/partners/api/v1/leads/submit', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'X-API-Key': 'your_api_key_here'
        },
        body: JSON.stringify({
            first_name: 'John',
            last_name: 'Doe',
            date_of_birth: '1985-03-15',
            email: 'john@example.com',
            phone: '5551234567',
            company_name: 'Example Corp',
            residential_street: '123 Main St',
            residential_city: 'Los Angeles',
            residential_state: 'CA',
            residential_zip: '90001',
            notes: 'Optional notes'
        })
    });
    
    const data = await response.json();
    
    if (response.ok && data.success) {
        console.log('Lead submitted successfully. Reference ID:', data.reference_id);
        // Use reference_id (e.g. "20240115-123") to fetch the lead later:
        // GET /app/partners/api/v1/leads/20240115-123
    } else {
        console.error('Error:', data.error || 'Unknown error');
    }
}

submitLead();

import requests
import json

url = 'https://www.startcap.org/app/partners/api/v1/leads/submit'
headers = {
    'Content-Type': 'application/json',
    'X-API-Key': 'your_api_key_here'
}
data = {
    'first_name': 'John',
    'last_name': 'Doe',
    'date_of_birth': '1985-03-15',
    'email': 'john@example.com',
    'phone': '5551234567',
    'company_name': 'Example Corp',
    'residential_street': '123 Main St',
    'residential_city': 'Los Angeles',
    'residential_state': 'CA',
    'residential_zip': '90001',
    'notes': 'Optional notes'
}

response = requests.post(url, json=data, headers=headers)

if response.status_code == 200:
    result = response.json()
    if result.get('success'):
        print(f"Lead submitted successfully. Reference ID: {result['reference_id']}")
        # Use reference_id (e.g. "20240115-123") to fetch the lead later:
        # GET /app/partners/api/v1/leads/20240115-123
    else:
        print(f"Error: {result.get('error', 'Unknown error')}")
else:
    print(f"HTTP Error {response.status_code}: {response.text}")

curl -X POST https://www.startcap.org/app/partners/api/v1/leads/submit \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your_api_key_here" \
  -d '{
    "first_name": "John",
    "last_name": "Doe",
    "date_of_birth": "1985-03-15",
    "email": "john@example.com",
    "phone": "5551234567",
    "company_name": "Example Corp",
    "residential_street": "123 Main St",
    "residential_city": "Los Angeles",
    "residential_state": "CA",
    "residential_zip": "90001",
    "notes": "Optional notes"
  }'

from flask import Flask, request, jsonify
import hmac
import hashlib
import json

app = Flask(__name__)

# Your webhook secret from the API Integration dashboard
WEBHOOK_SECRET = 'your_webhook_secret_here'

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    event_type = request.headers.get('X-Webhook-Event')
    
    if not signature:
        return jsonify({'error': 'Missing signature'}), 401
    
    # Get raw body for signature verification
    payload = request.get_data()
    
    # Verify signature
    expected_signature = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()
    
    if not hmac.compare_digest(signature, expected_signature):
        return jsonify({'error': 'Invalid signature'}), 401
    
    # Parse payload
    data = request.get_json()
    event = data.get('event')
    timestamp = data.get('timestamp')
    event_data = data.get('data', {})
    
    print(f"Received {event} at {timestamp}")
    
    # Handle different event types
    if event == 'lead.status_changed':
        print(f"Lead {event_data.get('lead_reference_id')} changed from {event_data.get('old_application_status') or event_data.get('old_status')} to {event_data.get('new_application_status') or event_data.get('new_status')}")
        # Add your business logic here
    elif event == 'commission.earned':
        print(f"Commission earned: ${event_data['amount']}")
        # Add your business logic here
    elif event == 'payout.processed':
        print(f"Payout processed: ${event_data['amount']}")
        # Add your business logic here
    elif event == 'account.status_changed':
        print(f"Account status changed from {event_data['old_status']} to {event_data['new_status']}")
        # Add your business logic here
    else:
        print(f"Unknown event type: {event}")
    
    # Always return 200 OK to acknowledge receipt
    return jsonify({'received': True}), 200

if __name__ == '__main__':
    app.run(port=3000, debug=True)

<?php
// Your webhook secret from the API Integration dashboard
$webhook_secret = 'your_webhook_secret_here';

// Get headers
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$event_type = $_SERVER['HTTP_X_WEBHOOK_EVENT'] ?? '';

if (empty($signature)) {
    http_response_code(401);
    header('Content-Type: application/json');
    echo json_encode(['error' => 'Missing signature']);
    exit;
}

// Get raw body for signature verification
$payload = file_get_contents('php://input');
$data = json_decode($payload, true);

if (json_last_error() !== JSON_ERROR_NONE) {
    http_response_code(400);
    header('Content-Type: application/json');
    echo json_encode(['error' => 'Invalid JSON']);
    exit;
}

// Verify signature
$expected_signature = hash_hmac('sha256', $payload, $webhook_secret);

if (!hash_equals($expected_signature, $signature)) {
    http_response_code(401);
    header('Content-Type: application/json');
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// Process webhook
$event = $data['event'] ?? '';
$timestamp = $data['timestamp'] ?? '';
$event_data = $data['data'] ?? [];

error_log("Received {$event} at {$timestamp}");

// Handle different event types
switch ($event) {
    case 'lead.status_changed':
        error_log("Lead " . $event_data['lead_reference_id'] . " changed from " . ($event_data['old_application_status'] ?? $event_data['old_status']) . " to " . ($event_data['new_application_status'] ?? $event_data['new_status']));
        // Add your business logic here
        break;
    case 'commission.earned':
        error_log("Commission earned: $" . $event_data['amount']);
        // Add your business logic here
        break;
    case 'payout.processed':
        error_log("Payout processed: $" . $event_data['amount']);
        // Add your business logic here
        break;
    case 'account.status_changed':
        error_log("Account status changed from {$event_data['old_status']} to {$event_data['new_status']}");
        // Add your business logic here
        break;
    default:
        error_log("Unknown event type: {$event}");
}

// Always return 200 OK to acknowledge receipt
http_response_code(200);
header('Content-Type: application/json');
echo json_encode(['received' => true]);
?>

require 'sinatra'
require 'json'
require 'openssl'
require 'rack'

# Your webhook secret from the API Integration dashboard
WEBHOOK_SECRET = 'your_webhook_secret_here'

post '/webhook' do
    signature = request.env['HTTP_X_WEBHOOK_SIGNATURE']
    event_type = request.env['HTTP_X_WEBHOOK_EVENT']
    
    if signature.nil? || signature.empty?
        status 401
        return { error: 'Missing signature' }.to_json
    end
    
    # Get raw body for signature verification
    payload = request.body.read
    request.body.rewind
    
    # Verify signature
    expected_signature = OpenSSL::HMAC.hexdigest(
        OpenSSL::Digest.new('sha256'),
        WEBHOOK_SECRET,
        payload
    )
    
    unless Rack::Utils.secure_compare(signature, expected_signature)
        status 401
        return { error: 'Invalid signature' }.to_json
    end
    
    # Parse payload
    data = JSON.parse(payload)
    event = data['event']
    timestamp = data['timestamp']
    event_data = data['data'] || {}
    
    puts "Received #{event} at #{timestamp}"
    
    # Handle different event types
    case event
    when 'lead.status_changed'
        puts "Lead #{event_data['lead_reference_id']} changed from #{event_data['old_application_status'] || event_data['old_status']} to #{event_data['new_application_status'] || event_data['new_status']}"
        # Add your business logic here
    when 'commission.earned'
        puts "Commission earned: $#{event_data['amount']}"
        # Add your business logic here
    when 'payout.processed'
        puts "Payout processed: $#{event_data['amount']}"
        # Add your business logic here
    when 'account.status_changed'
        puts "Account status changed from #{event_data['old_status']} to #{event_data['new_status']}"
        # Add your business logic here
    else
        puts "Unknown event type: #{event}"
    end
    
    # Always return 200 OK to acknowledge receipt
    status 200
    { received: true }.to_json
end

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
)

// Your webhook secret from the API Integration dashboard
const webhookSecret = "your_webhook_secret_here"

type WebhookPayload struct {
    Event     string                 `json:"event"`
    Timestamp string                 `json:"timestamp"`
    Data      map[string]interface{} `json:"data"`
}

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    if r.Method != http.MethodPost {
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
        return
    }
    
    signature := r.Header.Get("X-Webhook-Signature")
    eventType := r.Header.Get("X-Webhook-Event")
    
    if signature == "" {
        http.Error(w, "Missing signature", http.StatusUnauthorized)
        return
    }
    
    // Get raw body for signature verification
    body, err := ioutil.ReadAll(r.Body)
    if err != nil {
        http.Error(w, "Error reading body", http.StatusBadRequest)
        return
    }
    
    // Verify signature
    mac := hmac.New(sha256.New, []byte(webhookSecret))
    mac.Write(body)
    expectedSignature := hex.EncodeToString(mac.Sum(nil))
    
    if !hmac.Equal([]byte(signature), []byte(expectedSignature)) {
        http.Error(w, "Invalid signature", http.StatusUnauthorized)
        return
    }
    
    // Parse payload
    var payload WebhookPayload
    if err := json.Unmarshal(body, &payload); err != nil {
        http.Error(w, "Invalid JSON", http.StatusBadRequest)
        return
    }
    
    log.Printf("Received %s at %s", payload.Event, payload.Timestamp)
    
    // Handle different event types
    switch payload.Event {
    case "lead.status_changed":
        leadRefID := payload.Data["lead_reference_id"]
        oldStatus := payload.Data["old_application_status"]
        if oldStatus == nil {
            oldStatus = payload.Data["old_status"]
        }
        newStatus := payload.Data["new_application_status"]
        if newStatus == nil {
            newStatus = payload.Data["new_status"]
        }
        log.Printf("Lead %v changed from %v to %v", leadRefID, oldStatus, newStatus)
        // Add your business logic here
    case "commission.earned":
        amount := payload.Data["amount"]
        log.Printf("Commission earned: $%v", amount)
        // Add your business logic here
    case "payout.processed":
        amount := payload.Data["amount"]
        log.Printf("Payout processed: $%v", amount)
        // Add your business logic here
    case "account.status_changed":
        oldStatus := payload.Data["old_status"]
        newStatus := payload.Data["new_status"]
        log.Printf("Account status changed from %v to %v", oldStatus, newStatus)
        // Add your business logic here
    default:
        log.Printf("Unknown event type: %s", payload.Event)
    }
    
    // Always return 200 OK to acknowledge receipt
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusOK)
    fmt.Fprintf(w, `{"received":true}`)
}

func main() {
    http.HandleFunc("/webhook", webhookHandler)
    log.Println("Webhook server running on :3000")
    log.Fatal(http.ListenAndServe(":3000", nil))
}

import org.springframework.web.bind.annotation.*;
import org.springframework.http.*;
import com.fasterxml.jackson.databind.ObjectMapper;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Map;

@RestController
@RequestMapping("/webhook")
public class WebhookController {
    
    // Your webhook secret from the API Integration dashboard
    private static final String WEBHOOK_SECRET = "your_webhook_secret_here";
    
    @PostMapping
    public ResponseEntity<?> handleWebhook(
            @RequestHeader(value = "X-Webhook-Signature", required = false) String signature,
            @RequestHeader(value = "X-Webhook-Event", required = false) String eventType,
            @RequestBody String rawBody) {
        
        if (signature == null || signature.isEmpty()) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(Map.of("error", "Missing signature"));
        }
        
        // Verify signature
        try {
            String expectedSignature = calculateSignature(rawBody, WEBHOOK_SECRET);
            if (!signature.equals(expectedSignature)) {
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                        .body(Map.of("error", "Invalid signature"));
            }
        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                    .body(Map.of("error", "Signature verification failed"));
        }
        
        // Parse payload
        ObjectMapper mapper = new ObjectMapper();
        try {
            Map<String, Object> payload = mapper.readValue(rawBody, Map.class);
            String event = (String) payload.get("event");
            String timestamp = (String) payload.get("timestamp");
            Map<String, Object> data = (Map<String, Object>) payload.get("data");
            
            System.out.println("Received " + event + " at " + timestamp);
            
            // Handle different event types
            switch (event) {
                case "lead.status_changed":
                    System.out.println("Lead " + data.get("lead_reference_id") + 
                            " changed from " + (data.get("old_application_status") != null ? data.get("old_application_status") : data.get("old_status")) + 
                            " to " + (data.get("new_application_status") != null ? data.get("new_application_status") : data.get("new_status")));
                    // Add your business logic here
                    break;
                case "commission.earned":
                    System.out.println("Commission earned: $" + data.get("amount"));
                    // Add your business logic here
                    break;
                case "payout.processed":
                    System.out.println("Payout processed: $" + data.get("amount"));
                    // Add your business logic here
                    break;
                case "account.status_changed":
                    System.out.println("Account status changed from " + 
                            data.get("old_status") + " to " + data.get("new_status"));
                    // Add your business logic here
                    break;
                default:
                    System.out.println("Unknown event type: " + event);
            }
            
            // Always return 200 OK to acknowledge receipt
            return ResponseEntity.ok(Map.of("received", true));
            
        } catch (Exception e) {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                    .body(Map.of("error", "Invalid JSON"));
        }
    }
    
    private String calculateSignature(String payload, String secret) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(
                secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        mac.init(secretKey);
        byte[] hash = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
        return bytesToHex(hash);
    }
    
    private String bytesToHex(byte[] bytes) {
        StringBuilder result = new StringBuilder();
        for (byte b : bytes) {
            result.append(String.format("%02x", b));
        }
        return result.toString();
    }
}