Support

Questions about the API or the program

Email business@secondappraisal.com. To help us find the call you mean, include:

• the request_id of the call, which every response the API itself produces carries, in the body of a refusal and as the X-Request-Id header;
• the operation you called, when you called it, and the code it answered with;
• which key you used, by the characters the portal shows for it (its prefix and the few after it), and never the whole key or a private signing key;
• a referral's id, rather than the borrower's name, contact details or VIN.

Before you write, GET /api/gap/v1/me tells you what a key is, what it may do and when it expires, and each code's page under Error codes says what to do about it.

Security

If you think a key, a signing key or a webhook signing secret has been exposed, revoke or roll it in the portal; if a seat is being used by someone who shouldn't have it, remove the seat. Then tell us at once at security@secondappraisal.com. Report a security weakness you find in the API the same way.

At launchYour institution can also place its own account on security hold in the portal. A hold revokes its keys, switches off its webhook endpoints and signs out its seats, all at once.

Your responsibilities lists the controls your institution runs on its side.