Who can create an API key?

Anyone with settings access in the app, which admins have. Keys are created under Settings → Developers → API keys, shown once, stored only as a hash, and can be revoked from the same page at any time.

How do we stop an integration from doing too much?

Give its key the manager role, or user for less, and pick only the scopes it needs, such as businesses:write and deals:write for a website intake form. A key with no scopes can do everything its role allows, and a scope never grants more than the role.

Do webhooks carry merchants' personal data?

Only a summary. Each delivery carries the ids you need and a compact summary of the event: names, amounts, statuses and dates, and for statement analysis, totals such as revenue, balances and NSF counts. It never carries the merchant's application form, Social Security numbers, dates of birth or CRM ids. Treat payloads as sensitive financial data, and fetch the record from the API when you need the full picture.

What happens if our webhook endpoint goes down?

Failed deliveries are retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours. If every delivery has failed for three days, the subscription is switched off and your admins get an email. Deliveries that gave up can be replayed from Settings once the endpoint is fixed.

Can we submit deals to lenders through the API?

Yes. A submission sends the same email package the app sends, from your connected mailbox, or goes into the lender's system for supported, configured lender API connections. Send an Idempotency-Key with it so a retry can't submit twice.

How are Social Security numbers and dates of birth handled?

Social Security numbers can be saved through the API but are never returned: reads show only the last four digits. Dates of birth are returned only to the admin and manager roles.

Developers

Build on the MCA system behind your workflow.

Connect internal tools and services to NextLevel MCA through a REST API, webhooks, supported lender APIs and MCP.

Read the developer docs Book a demo

REST APIapi.nextlevelmca.com/v1

Read and write every object with an API key or OAuth token

WebhooksYour HTTPS endpoint

Signed deliveries for 15 deal, document, offer and advance events

MCP servermcp.nextlevelmca.com

Tools for AI assistants, signed in as a team member

One object model

Business
People
Deal
Submission
Offer
Advance

A renewal starts a new deal on the same business.

curl "https://api.nextlevelmca.com/v1/pipeline" \
  -H "Authorization: Bearer $NEXTLEVEL_API_KEY"

Illustrative example

The objects

The records your team works in, over HTTPS.

A business is the merchant, and its people are owners and contacts. A deal is one funding request; each submission sends it to a lender, offers come back, and funding the primary offer creates an advance.

Base URL https://api.nextlevelmca.com/v1. HTTPS only, JSON in and out, and a bearer token on every request. Every credential belongs to one workspace and can only see and change that workspace's data.

Businesses

The merchant, with its notes, tasks, activity and deals

/v1/businesses

People

Owners and contacts linked to businesses, with lookup by phone or email

/v1/people

Deals

Funding requests, with notes, tasks, activity, stage moves, funding and renewals

/v1/deals

Pipeline

Stages and phases, and how many deals sit in each

/v1/pipeline

Documents

Signed-URL uploads, statement analysis and document requests

/v1/deals/{dealId}/documents

Lender matches

A 0 to 100 score for every lender with criteria, with each check explained

/v1/deals/{dealId}/lender-matches

Lenders

Lenders and their criteria

/v1/lenders

Submissions

Send to lenders, check status, retry, withdraw, or find one by document reference

/v1/deals/{dealId}/submissions

Offers

Lender terms on a deal, with one marked primary

/v1/deals/{dealId}/offers

Advances

Funded offers being repaid, with paid-in percentage and renewal flags

/v1/advances

Merchant portal

Create a portal link, or send it by email or text

/v1/deals/{dealId}/portal-link

Webhooks and users

Webhook subscriptions with health and test sends; your team, read-only

/v1/webhooks/v1/users

Quickstart

Create a key, then make your first request.

Create a key in the app, keep it in an environment variable, and send it as a bearer token.

1
Open Settings → Developers → API keys
You need settings access in the app; admins have it.
2
Name it, then choose a role, scopes and an expiry
The name shows in the activity log on anything the key changes. Expiry is optional.
3
Copy the key once
It's shown once and stored only as a hash. Keep it in an environment variable such as NEXTLEVEL_API_KEY, out of browser code and logs.
4
Make a request
Every success returns data and meta, and lists page with a cursor. The quickstart in the docs goes on to match lenders, submit and read offers.

Your first integration

Request

curl "https://api.nextlevelmca.com/v1/deals?phase=offer&limit=1" \
  -H "Authorization: Bearer $NEXTLEVEL_API_KEY"

Response 200

{
  "data": [
    {
      "id": "3c9d1f70-8e5a-4d26-b1f4-2a7e6c5d4b39",
      "business": {
        "id": "0f6b0d2e-1c3a-4b8e-9d2f-7a1e5c4b3d21",
        "legal_name": "Rivera Plumbing LLC",
        "dba": "Rivera Plumbing"
      },
      "requested_amount": 60000,
      "paper_grade": "B",
      "status": "approved",
      "stage": { "label": "Offer received", "phase": "offer" },
      "days_in_stage": 1,
      "offers_count": 2,
      "created_at": "2026-10-06T14:03:40.000Z"
    }
  ],
  "meta": { "next_cursor": "eyJvIjoxfQ", "has_more": true }
}

Illustrative example. Response trimmed; every field is in the API reference.

Access and permissions

A role for how much, scopes for what.

Every API key carries a role and, optionally, scopes. Both are checked on every request, so a scope never grants more than the role allows.

Roles

admin
Everything an admin can do in the app, including managing the team and settings.
manager
The default. Everything except managing the team and changing settings; right for almost every integration.
user
A standard user's defaults: only the deals it created, can submit and log offers, no advances or reports, lenders read-only.

Scopes

Pick scopes to narrow a key, for example read-only scopes for reporting. A key with no scopes can do everything its role allows. Submissions are read with deals:read.

Businesses

businesses:readbusinesses:write

People

people:readpeople:write

Deals

deals:readdeals:write

Documents

documents:readdocuments:write

Lenders

lenders:readlenders:write

Submissions

submissions:write

Offers

offers:readoffers:write

Advances

advances:readadvances:write

Merchant portal

portal:send

Webhooks

webhooks:manage

Keys start with nlmca_live_ and are stored only as a hash
Optional expiry; an expired key simply stops working
Revoking a key is immediate: the next request is refused
OAuth tokens from assistant connections act as the user who approved them
Deactivating a user stops their tokens immediately
Keys work only on /v1 and the MCP server, never the app's internal routes

Conventions

One set of rules for every endpoint.

Handle these once and they're handled for every request.

Rate limits

300 requests a minute per credential per workspace, with bursts up to 50 a second. Over the limit you get 429 with a Retry-After header.

Idempotency keys

Send an Idempotency-Key on any POST. A retry with the same key within 24 hours replays the first answer instead of sending twice.

Cursor pagination

Lists return up to 100 records a page, 25 by default, with meta.next_cursor and meta.has_more for the next page.

Stable error codes

Errors carry a type, a machine-readable code, the param concerned and a request id that matches the X-Request-Id header.

Additive versioning

Within v1, new fields, endpoints and events can appear; existing ones aren't removed or renamed. Breaking changes ship only in a new major version.

Sensitive data

Social Security numbers can be saved but are never returned; reads show the last four digits. Dates of birth go only to admin and manager roles.

Webhooks

Get told the moment something happens.

Subscribe an HTTPS endpoint under Settings → Developers → Webhooks, or with POST /v1/webhooks, and pick the events you want.

Fifteen event types

Deals

deal.createddeal.stage_changeddeal.fundeddeal.dead

Submissions and offers

submission.sentsubmission.respondedoffer.receivedoffer.primary_changed

Documents

document.uploadeddocument.processedstatement.analyzed

Advances

advance.renewal_readyadvance.status_changed

Records

business.createdperson.created

Delivery rules

Signed with HMAC-SHA256 in the X-NLMCA-Signature header; reject timestamps more than five minutes off
Each delivery times out after 10 seconds; any 2xx answer is a success
Failures retry after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours
After three days of failures the subscription is switched off and admins are emailed
Replay any delivery from Settings, which is how you catch up after an outage
At-least-once and not in order: dedupe on the event id
Payloads carry an event summary, never the application form, Social Security numbers, dates of birth or CRM ids

Headers

POST /hooks/nextlevel HTTP/1.1
Content-Type: application/json
User-Agent: NextLevelMCA-Webhooks/1.0
X-NLMCA-Event: statement.analyzed
X-NLMCA-Delivery: <delivery id, same on every retry>
X-NLMCA-Signature: t=1791469205,v1=<hex HMAC-SHA256>

Body

{
  "id": "evt_…",
  "type": "statement.analyzed",
  "created_at": "2026-10-08T14:20:05.000Z",
  "location_id": "…",
  "data": {
    "deal_id": "3c9d1f70-8e5a-4d26-b1f4-2a7e6c5d4b39",
    "document_ids": ["…", "…", "…"],
    "statements_parsed": 3,
    "summary": {
      "true_revenue": 252600,
      "average_balance": 12450,
      "negative_days": 2,
      "nsf_count": 1,
      "mca_count": 1,
      "mca_withhold_percent": 8.4,
      "has_recovery_activity": false
    }
  }
}

Verify with HMAC-SHA256 over ${t}.${rawBody} using your signing secret, and reject timestamps more than five minutes off.

Illustrative example

Integration patterns

What brokerages connect first.

Common jobs, and the documented calls behind them.

Website to deal

Create the deal from your own intake form with POST /v1/deals, sending the business and owner inline. Existing businesses are matched instead of duplicated, and deal.created fires. A key with businesses:write and deals:write is enough.

Dialer phone lookup

When a call comes in, GET /v1/people?phone= matches the number in any format against every stored phone, and GET /v1/people/{id} returns that person's businesses and deals for the rep's screen.

Data warehouse from webhooks

Mirror every event into your warehouse for dashboards that update through the day. Dedupe on the event id, order by created_at, and fetch the record from the API when you need the full picture.

Internal tools

Build a renewal call list from GET /v1/advances?renewal_ready=true, a stale-deal sweep from GET /v1/deals?stale_days=5, and lender shortlists from GET /v1/deals/{dealId}/lender-matches.

Lender APIs

Submissions go to supported, configured lender API connections as well as by email. NextLevel sets each connection up on request; check a deal is ready with GET /v1/deals/{dealId}/api-readiness, and status and offers flow back to the deal.

Lender integrations

MCP for AI assistants

The MCP server at https://mcp.nextlevelmca.com gives Claude, ChatGPT and other assistants the same records and rules over Streamable HTTP. People sign in with OAuth; CRM workflow agents use an API key as the bearer token.

AI and MCP

Everything else is in the developer docs.

Guides for each surface, plus an API reference generated from the OpenAPI spec. Questions go to support@nextlevelmca.com.

Developer overview Your first integration Access and permissions How the API behaves Webhooks Documents and statements Lender API integrations AI assistants (MCP)

Frequently asked questions

What developers ask about the NextLevel MCA API

Still have questions? We're here to help.

Contact Support See All Features

Start with the docs, or plan it with us.

Read the developer docs to make your first request, or book a demo and we'll walk through the API, webhooks and MCP with your team.

Read the developer docs Book a demo

{ "data": [ { "id": "3c9d1f70-8e5a-4d26-b1f4-2a7e6c5d4b39", "business": { "id": "0f6b0d2e-1c3a-4b8e-9d2f-7a1e5c4b3d21", "legal_name": "Rivera Plumbing LLC", "dba": "Rivera Plumbing" }, "requested_amount": 60000, "paper_grade": "B", "status": "approved", "stage": { "label": "Offer received", "phase": "offer" }, "days_in_stage": 1, "offers_count": 2, "created_at": "2026-10-06T14:03:40.000Z" } ], "meta": { "next_cursor": "eyJvIjoxfQ", "has_more": true } }

POST /hooks/nextlevel HTTP/1.1 Content-Type: application/json User-Agent: NextLevelMCA-Webhooks/1.0 X-NLMCA-Event: statement.analyzed X-NLMCA-Delivery: <delivery id, same on every retry> X-NLMCA-Signature: t=1791469205,v1=<hex HMAC-SHA256>

{ "id": "evt_…", "type": "statement.analyzed", "created_at": "2026-10-08T14:20:05.000Z", "location_id": "…", "data": { "deal_id": "3c9d1f70-8e5a-4d26-b1f4-2a7e6c5d4b39", "document_ids": ["…", "…", "…"], "statements_parsed": 3, "summary": { "true_revenue": 252600, "average_balance": 12450, "negative_days": 2, "nsf_count": 1, "mca_count": 1, "mca_withhold_percent": 8.4, "has_recovery_activity": false } } }

Build on the MCA system behind your workflow.

The records your team works in, over HTTPS.

Businesses

People

Deals

Pipeline

Documents

Lender matches

Lenders

Submissions

Offers

Advances

Merchant portal

Webhooks and users

Create a key, then make your first request.

Open Settings → Developers → API keys

Name it, then choose a role, scopes and an expiry

Copy the key once

Make a request

A role for how much, scopes for what.

Roles

Scopes

One set of rules for every endpoint.

Rate limits

Idempotency keys

Cursor pagination

Stable error codes

Additive versioning

Sensitive data

Get told the moment something happens.

Fifteen event types

Delivery rules

What brokerages connect first.

Website to deal

Dialer phone lookup

Data warehouse from webhooks

Internal tools

Lender APIs

MCP for AI assistants

Everything else is in the developer docs.

Frequently asked questions

Who can create an API key?

How do we stop an integration from doing too much?

Do webhooks carry merchants' personal data?

What happens if our webhook endpoint goes down?

Can we submit deals to lenders through the API?

How are Social Security numbers and dates of birth handled?

Start with the docs, or plan it with us.

Build on the MCA system behind your workflow.

The records your team works in, over HTTPS.

Businesses

People

Deals

Pipeline

Documents

Lender matches

Lenders

Submissions

Offers

Advances

Merchant portal

Webhooks and users

Create a key, then make your first request.

Open Settings → Developers → API keys

Name it, then choose a role, scopes and an expiry

Copy the key once

Make a request

A role for how much, scopes for what.

Roles

Scopes

One set of rules for every endpoint.

Rate limits

Idempotency keys

Cursor pagination

Stable error codes

Additive versioning

Sensitive data

Get told the moment something happens.

Fifteen event types

Delivery rules