Accredit, screen, and onboard every investor in one branded link.

Two ways to connect

• Results → your CRM. When a CPA signs a letter, our webhook pushes a signed verification.completed event; Zapier or Make catches it and creates or updates the record in your CRM.
• Your CRM → a verification. When you add an investor in your CRM, Zapier or Make calls our REST API to start their verification and hands back the branded link to send them.

What you'll need

• An API key (sk_live_...) from your sponsor dashboard — used to start verifications.
• Your webhook signing secret (whsec_...) from the same dashboard — used to receive results. Paste your Zapier or Make catch-hook URL into the dashboard's webhook field, then send yourself a test event.
• Your firm verified (a one-time step in your dashboard) before the "start a verification" direction will work — an unverified firm gets 403 firm_not_verified. Receiving results works either way.

Zapier · get verifications into your CRM

1. Create a Zap with the trigger Webhooks by Zapier → Catch Hook, and copy the custom webhook URL it gives you.
2. In your AccreditedNow dashboard, paste that URL into the webhook field and click Send test event — the sample payload lands in Zapier so you can map the fields.
3. Add an action for your CRM — for example HubSpot → Create/Update Contact, Salesforce → Update Record, Google Sheets → Create Row, or Slack → Send Channel Message.
4. Map the event fields: data.investor.email, data.status, data.certificate_id, data.certificate_url, data.verification_date, data.expiration_date. Turn the Zap on.

Zapier · start a verification from your CRM

1. Trigger on your CRM — for example HubSpot → New contact in a "To verify" list.
2. Add the action Webhooks by Zapier → Custom Request with these settings:

Method:   POST
URL:      https://accreditednow.org/v1/verifications
Headers:  Authorization : Bearer sk_live_...
          Content-Type  : application/json
Data:     {
            "investor": {
              "email": "{{email}}",
              "first_name": "{{first name}}",
              "last_name": "{{last name}}"
            },
            "billing": "partner"
          }

The response includes a hosted_url — add a follow-up step (an email, or a CRM task) to send that link to the investor. billing: "partner" covers it from your seat balance; "investor" lets the investor pay at checkout.

Make (Integromat)

• Receive results: add a Custom webhook module, copy its URL into your AccreditedNow dashboard, send a test event, then add your CRM module (HubSpot, Salesforce, Pipedrive, Notion, Airtable, Slack…) and map the same data.* fields.
• Start a verification: add an HTTP → Make a request module — POST https://accreditednow.org/v1/verifications, header Authorization: Bearer sk_live_..., body type JSON with the same fields shown above.

Verify the signature (recommended)

Every webhook carries an X-AccreditedNow-Signature header so you can confirm it really came from us. Simple setups often skip this because the catch-hook URL is unguessable, but for a hardened flow, verify the HMAC as described in the webhook docs — a small "Code by Zapier" or Make custom-function step.

Native one-click apps

Published AccreditedNow apps for Zapier and Make — with a ready-made "New verification completed" trigger and a "Create verification" action — are in the works, so this becomes a few clicks with no webhook URLs to copy. Want early access? Tell us which CRM you use.

Base URL & authentication

Base URL:  https://accreditednow.org/v1
Auth:      Authorization: Bearer sk_live_...

Because a CPA signs every letter, verification is asynchronous: you create a verification, the investor completes the flow, and a CPA signs (typically within 24 hours). Learn the outcome from the webhook or by polling the status endpoint below.

Create a verification

POST /v1/verifications
{
  "investor": {
    "email": "jordan@example.com",
    "first_name": "Jordan",
    "last_name": "Rivera",
    "date_of_birth": "1984-03-22",
    "nationality": "US"
  },
  "type": "individual",
  "deal": { "name": "Cedar Point Multifamily Fund II" },
  "billing": "partner"
}

-> 201
{
  "id": "rec0xX...",
  "object": "verification",
  "status": "created",
  "billing": "partner",
  "hosted_url": "https://accreditednow.org/verify?sponsor=cedarpoint"
}

billing is "partner" (a seat from your account covers it) or "investor" (the investor pays at checkout). Send the investor to the returned hosted_url to complete verification. Creating a verification never consumes a seat — a seat is drawn only when the investor completes the flow.

investor.date_of_birth (format YYYY-MM-DD) and investor.nationality (ISO 3166-1 alpha-2, e.g. US) are optional. If you run your own identity verification and keep ours off, pass them and we use them to sharpen the sanctions/AML screen — a date of birth lets the screen drop unrelated same-name matches, which sharply cuts false positives. They are used only for screening, never printed on the letter, and are deleted with the rest of the case data at 90 days. Omit them and the screen simply runs on name alone.

Retrieve a verification

GET /v1/verifications/{id}

-> 200
{
  "id": "rec0xX...",
  "object": "verification",
  "status": "verified",
  "type": "individual",
  "investor": { "name": "Jordan A. Rivera", "email": "jordan@example.com", "city": "Austin", "state": "Texas" },
  "basis": "Net Worth",
  "verification_date": "2026-08-17",
  "expiration_date": "2026-11-15",
  "certificate_id": "ANV-4K2P-9QX7-M3TD",
  "certificate_url": "https://accreditednow.org/verify-certificate?id=ANV-4K2P-9QX7-M3TD",
  "checks": { "identity_verified": true, "sanctions_screened": true, "business_verified": false },
  "deal": "Cedar Point Multifamily Fund II",
  "letter_available": true,
  "created": "2026-08-16"
}

status is one of created, in_review, verified, expired, declined, or refunded. The response is privacy-safe — it never contains the investor's documents, financial figures, or resume token.

List verifications

GET /v1/verifications?limit=25&offset=0&status=verified

-> 200
{ "object": "list", "data": [ ... ], "total": 42, "limit": 25, "offset": 0, "has_more": true }

Download the signed letter

GET /v1/verifications/{id}/letter          -> 302 redirect to the signed PDF
GET /v1/verifications/{id}/letter?format=json -> { "id": "...", "letter_url": "https://..." }

Returns the letter only when it has been issued and the investor consented to share it with you; otherwise 404 letter_unavailable.

Errors

{ "error": { "type": "unauthorized", "message": "Missing or invalid API key." } }

401 invalid/missing key · 403 firm not verified (create) · 404 unknown verification · 400 invalid request · 429 rate limited (120 requests/min per key — honor the Retry-After header).

Terms

Use of the API is governed by our API Terms of Service, which supplement our main Terms of Service. Generating an API key constitutes acceptance.

Event payload

{
  "id": "evt_ANV-4K2P-9QX7-M3TD.completed",
  "event": "verification.completed",
  "version": "2026-08-18",
  "livemode": true,
  "created": "2026-08-17T15:04:22.000Z",
  "data": {
    "certificate_id": "ANV-4K2P-9QX7-M3TD",
    "status": "verified",
    "investor": {
      "name": "Jordan A. Rivera",
      "email": "jordan@example.com",
      "city": "Austin",
      "state": "Texas",
      "type": "individual"
    },
    "basis": "Net Worth",
    "verification_date": "2026-08-17",
    "expiration_date": "2026-11-15",
    "checks": {
      "identity_verified": true,
      "sanctions_screened": true,
      "business_verified": false
    },
    "deal": "Cedar Point Multifamily Fund II",
    "sponsor_slug": "cedarpoint",
    "certificate_url": "https://accreditednow.org/verify-certificate?id=ANV-4K2P-9QX7-M3TD"
  }
}

The payload is certificate-level and privacy-safe — it never contains the investor's documents, financials, or resume token. Events for a given case are sent only to the sponsor that owns it.

Request headers

• X-AccreditedNow-Event — the event type, e.g. verification.completed.
• X-AccreditedNow-Delivery — a stable idempotency key, unique per certificate + event. Dedupe on this; the same event may arrive more than once.
• X-AccreditedNow-Signature — t=<unix-seconds>,v1=<hex-hmac>.

Verify the signature

Compute an HMAC-SHA256 over `${t}.${rawBody}` using your signing secret, and compare it to v1 with a constant-time check. Verify against the raw request body, before JSON parsing, and reject a timestamp older than five minutes.

const crypto = require('crypto');

function verify(rawBody, header, secret) {
  const p = Object.fromEntries(header.split(',').map(kv => kv.split('=')));
  const fresh = Math.abs(Date.now() / 1000 - Number(p.t)) < 300;
  const expected = crypto.createHmac('sha256', secret)
    .update(p.t + '.' + rawBody).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(p.v1 || '');
  return fresh && a.length === b.length && crypto.timingSafeEqual(a, b);
}

Delivery, retries & idempotency

• Acknowledge with any 2xx within a few seconds. A non-2xx or a timeout triggers a bounded retry (short backoff); persistent failure is surfaced in your dashboard.
• Retries reuse the same X-AccreditedNow-Delivery id — dedupe on it so a retry never double-writes.
• livemode is false for dashboard test events and true for real verifications.
• Rotating your signing secret in the dashboard takes effect immediately — update your endpoint at the same time.

How it works

• Use your sk_test_ key exactly like a live key — same base URL, same endpoints, same response shapes.
• POST /v1/verifications returns a simulated verification (its id is prefixed ver_test_) plus a test_complete_url. The returned hosted_url opens your co-branded flow in safe preview — nothing is submitted or charged.
• There is no CPA review in the sandbox, so you decide when a verification completes (below).

Simulate completion (sandbox only)

POST /v1/verifications/{id}/complete
Auth: Authorization: Bearer sk_test_...

-> 200
{
  "id": "ver_test_9f2c...",
  "object": "verification",
  "status": "verified",
  "livemode": false,
  "certificate_id": "ANV-TEST-...-SBOX",
  "letter_available": true,
  "webhook": "sent"
}

This flips the test verification to verified and fires a real verification.completed webhook (with livemode: false) to your configured endpoint — so you can validate your receiver and signature check end to end. GET /v1/verifications/{id}/letter then returns a sample letter. The /complete action exists only in the sandbox; a real verification is completed by a CPA, never via the API.

Going live

When your integration works end to end, swap your sk_test_ key for an sk_live_ key from the dashboard. Nothing else changes.