Cambria Mortgage app API integration (SimpleNexus / nCino)

Loan application (1003 / URLA) API

Read the borrower-completed Uniform Residential Loan Application: applicant and co-applicant identity, employment history, monthly income, assets and liabilities, declarations and property address. Concrete use: pre-fill a CRM contact and trigger an underwriting pre-check the moment a borrower starts an application in the Cambria app.

Document checklist & upload events

Mirror the in-app "needs list": each conditioned document with status (requested / received / under review / cleared) plus the file metadata for paystubs, W-2s, bank statements and IDs scanned with the phone camera. Concrete use: fire a webhook on every upload so an OCR/classification job can run verification of income and employment without manual hand-off.

Loan milestone & status sync

Subscribe to milestone changes — application submitted, processing, appraisal ordered, conditional approval, clear to close, funded. Concrete use: keep a lender's loan-origination system (or a non-integrated LOS such as Finastra MortgagebotLOS) in step without nightly batch jobs, and surface a live status bar in a borrower portal.

Pre-approval letters & scenario comparison

Retrieve generated pre-approval letter PDFs and the structured "compare lending scenarios" output: program (Conventional, FHA, VA, USDA), rate, APR, term, points and principal-and-interest payment. Concrete use: push a fresh pre-approval to a Realtor's transaction system and store every quoted scenario for fair-lending evidence.

Contacts & co-marketing data

Pull the loan officer and Realtor contact cards the app exposes — name, NMLS ID, phone, email, branch — and the "share with family & friends" referral payload. Concrete use: attribute referral leads in a marketing automation tool and keep partner directories in sync.

Notifications, news & refi calculator

Capture push-notification task events ("a document is needed", "your loan moved to processing"), the in-app rate/industry-news feed items, and refinance-savings calculator inputs and results. Concrete use: feed an engagement dashboard and score warm refinance leads when rates move.

1. Instant CRM lead sync

Context: a marketing team wants every started application to land in its CRM for nurture campaigns. Data/API: a loan.created / loan.updated webhook plus a read of 1003 contact and property fields via the SimpleNexus API (SNAPI) or the newer nCino Mortgage API. OpenData mapping: consented, event-driven portability of a borrower's own application data from one system to another.

2. LOS round-trip for non-integrated systems

Context: a lender on an LOS that lacks a native SimpleNexus connector — for example Finastra's MortgagebotLOS, which got a dedicated integration in 2023 — needs loan activity and org changes kept in sync. Data/API: milestone-status push from the app side, loan-officer/branch updates pushed back. OpenData mapping: a neutral data-exchange layer instead of a closed point-to-point silo.

3. Pipeline business intelligence

Context: leadership wants pull-through, stuck-loan and cycle-time dashboards alongside what Nexus Vision exposes. Data/API: a statement-style export endpoint returning loans with their milestone history, document-condition counts and scenario data, paged by date range, into a warehouse / Power BI model. OpenData mapping: structured bulk export with stable schemas for analytics.

4. Document automation & verification

Context: processing wants borrower scans triaged automatically. Data/API: a document.uploaded webhook carrying file metadata and the conditioned-document reference, followed by a secure fetch of the file for OCR and VOI/VOE. OpenData mapping: event-triggered handoff of user-submitted documents to an authorized downstream processor.

5. Compliance & e-close archive

Context: a lender must retain disclosures, eClosing packages (Nexus Closing supports hybrid, eNote and RON) and an audit trail for the RESPA window. Data/API: scheduled export of disclosure and closing documents plus event logs into a WORM records system. OpenData mapping: regulator-friendly, immutable export of the records a loan file is legally required to keep.

1) OAuth 2.0 token (client credentials)

POST /oauth/token HTTP/1.1
Host: api.ncinomortgage.example
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&scope=loans.read documents.read webhooks.manage

200 OK
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600
}

2) Loan + milestone export (paged)

GET /v1/loans?updated_since=2026-04-01&page=1&page_size=50
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "data": [{
    "loan_id": "LN-90231",
    "status": "conditional_approval",
    "borrower": { "first_name": "...", "last_name": "..." },
    "property": { "state": "MN", "zip": "55101" },
    "milestones": [
      {"name":"application_submitted","at":"2026-04-03T14:11Z"},
      {"name":"appraisal_ordered","at":"2026-04-09T18:02Z"}
    ],
    "open_conditions": 3
  }],
  "next_page": 2
}

3) Webhook: document uploaded

POST https://your-app.example/hooks/sn   (from platform)
X-Signature: sha256=...
Content-Type: application/json

{
  "event": "document.uploaded",
  "loan_id": "LN-90231",
  "condition_id": "C-7781",
  "document": {
    "type": "paystub",
    "pages": 2,
    "uploaded_at": "2026-05-12T09:40Z",
    "download_url": "/v1/loans/LN-90231/documents/D-5521"
  }
}
// verify X-Signature, then GET download_url with Bearer token

4) Error handling & retries

401  -> refresh token, retry once
403  -> scope/authorization missing, surface to operator
404  -> loan or document not in this tenant
409  -> condition already cleared, treat as no-op
429  -> honor Retry-After header, exponential backoff
5xx  -> backoff + dead-letter queue, alert on N failures

// webhooks: respond 2xx fast, process async,
// dedupe on (event, loan_id, document.uploaded_at)

Deliverables checklist

• API specification (OpenAPI / Swagger) for the connector surface
• Protocol & auth flow report (OAuth scopes, token lifecycle, webhook signing)
• Runnable connector source — login, loan/milestone pull, document fetch, webhook receiver (Python / Node.js)
• Automated tests, sample payloads and a Postman collection
• Compliance guidance — GLBA / FTC Safeguards, TRID/ECOA artifact handling, RESPA retention, data minimization
• Optional hosted, pay-per-call endpoint with usage metering

Engagement workflow

1. Scope confirmation — which data, which screens, what authorization you hold (1–2 days).
2. Protocol analysis & API design — map app/platform endpoints to your connector (2–5 business days).
3. Build & internal validation against a sandbox tenant (3–8 business days).
4. Docs, samples, test cases and a walkthrough (1–2 business days).
5. First delivery typically 5–15 business days; third-party approvals (e.g. API credential provisioning) may extend timelines.

Two engagement models

• Source-code delivery from $300 — you receive runnable API source and full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — use our hosted endpoints and pay only for the calls you make, no upfront fee; suited to teams that prefer usage-based pricing.

Regulatory alignment

Residential mortgage data is tightly regulated. Connectors we build assume the lender's obligations under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule for nonpublic personal information, preserve the integrity of TILA-RESPA Integrated Disclosure (TRID) documents and Equal Credit Opportunity Act (ECOA) records, and support RESPA / Regulation X record-retention windows. State mortgage-licensing rules (NMLS) and the lender's own privacy notice govern what may be shared with which third party.

How we work safely

• Authorized access only — your API credentials, sandbox, or written lender authorization; documented public APIs where they exist.
• Data minimization — pull only the fields a scenario needs; redact what you do not.
• Consent & access logging — every export is attributable; retention configurable to your policy.
• Encryption in transit and at rest; short-lived signed URLs for document blobs; webhook signature verification.
• No authentication bypass, no scraping without authorization, NDAs on request.

What do you need from me to start a Cambria Mortgage app integration?

The target app name (provided), the concrete data you need (loan application fields, document checklist, milestone status, pre-approval letters, contact cards), and any authorized access you already hold — for example nCino/SimpleNexus API credentials, a sandbox tenant, or written lender authorization. We work only with authorized access or documented public APIs.

Is this an official Cambria Mortgage or SimpleNexus product?

No. We are an independent integration studio. The Cambria Mortgage Mobile App is built on the SimpleNexus / nCino Mortgage Suite platform and is owned by its respective owners. We deliver protocol analysis and connector source code so your authorized systems can exchange data with that platform.

How long does delivery take and what does it cost?

A first API drop with documentation is usually 5–15 business days depending on scope; e-close archives, webhook pipelines and multi-tenant setups take longer. Source-code delivery starts at $300 and is paid after delivery upon satisfaction; a pay-per-call hosted API option is also available with no upfront fee.

How do you handle borrower data privacy and mortgage compliance?

Mortgage data is regulated. We design to GLBA and the FTC Safeguards Rule, keep TILA-RESPA Integrated Disclosure (TRID) and ECOA artifacts intact, support RESPA record-retention windows, and apply data minimization, consent logging and encryption in transit and at rest. We do not bypass authentication or scrape data without authorization.