# Sunbit

> Sunbit is a US point-of-sale buy now, pay-over-time lender for everyday needs — auto service
> and dealerships, dental, eyewear, veterinary, med spa, home services and general retail.
> Merchants and SaaS platforms integrate through a partner REST API and a hosted JavaScript
> SDK covering four products: Pre-Qualification, Sunbit Estimate ("As Low As"), Checkout, and
> Text to Pay-Over-Time. The platform also exposes merchant onboarding, transaction lookup,
> void and partial refund, reporting, and HMAC-SHA256 signed webhooks.

Generated by the API Evangelist enrichment pipeline on 2026-07-31. Sunbit does not publish an
llms.txt of its own (probed https://sunbit.com/llms.txt -> 404; docs.sunbit.com serves an SPA
shell for every path). This file is generated from Sunbit's own public documentation and from
the artifacts in this repository.

## Key facts

- Production API host: https://api.sunbit.com
- Sandbox API host: https://api-sandbox.sunbit.com
- Authentication: `sunbit-key` header, paired with `sunbit-secret` on higher-trust operations.
  No OAuth, no OpenID Connect, no scopes. Some endpoints are additionally IP-allowlisted.
- Machine-readable contract: **none published.** No OpenAPI, Swagger, GraphQL, AsyncAPI,
  gRPC/proto, MCP server, or A2A agent card was found on any Sunbit host.
- Client libraries: one hosted browser SDK at https://static.sunbit.com/sdk/sunbit-sdk.js.
  Nothing on npm, PyPI, Maven, NuGet, Go, RubyGems, Packagist or crates.io; no public GitHub
  organization.
- Geography: United States only. Unavailable in U.S. territories, and in WV for Home Services.
  USD only.
- Credentials are not self-serve — Sunbit grants access to the Developers Portal, and
  production keys are gated behind a "Request Production Access" review.

## Documentation

- [Overview / How Sunbit Works](https://docs.sunbit.com/docs/overview/overview)
- [Integration Types](https://docs.sunbit.com/docs/overview/integrations-types)
- [Getting Started](https://docs.sunbit.com/docs/overview/getting-started)
- [Production Access](https://docs.sunbit.com/docs/overview/production-access)
- [Developers Portal](https://developers.sunbit.com/)
- [Integration Partners](https://sunbit.com/integration-partners/)
- [Become a Partner](https://sunbit.com/im-a-merchant/become-a-partner/)
- [Status page](https://status.sunbit.com/)

## APIs

Every operation below is documented in prose at docs.sunbit.com; there is no specification
document. Paths are relative to https://api.sunbit.com (or https://api-sandbox.sunbit.com).

### Pre-qualification and estimation
- `PUT /purchase/api/v1/online-link` — mint a pre-qualification URL for a customer, optionally
  SMS it. [docs](https://docs.sunbit.com/docs/api-integrations/sunbit-pre-qualification)
- `PUT /purchase/api/v1/payment-estimation` — batch "As Low As" monthly payment estimation;
  returns `-1` in every numeric field when an amount is not financeable.
  [docs](https://docs.sunbit.com/docs/api-integrations/sunbit-estimate)

### Checkout and payment links
- `POST /epay/api/v1/epay` — initialize a checkout transaction, returns a JWT for the modal.
  [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-checkout-sdk)
- `GET /epay/api/v1/epay` — transaction lookup / validation; status `COMPLETED` |
  `INCOMPLETE` | `VOIDED`.
  [docs](https://docs.sunbit.com/docs/transactions-management/transaction-lookup)
- `POST /epay/api/v1/epay/send-link` — Text to Pay-Over-Time; SMS a checkout link.
  [docs](https://docs.sunbit.com/docs/api-integrations/text-to-Pay-Over-Time-overtime)

### Transaction management
- `PUT /epay/api/v1/epay/cancel/{purchaseId}` — void a purchase in full.
  [docs](https://docs.sunbit.com/docs/transactions-management/void-transactions)
- `PUT /epay/api/v1/epay/changeAmount/{purchaseId}` — partial refund; `reason` is
  `PARTIAL_REFUND` or `ERROR_CORRECTION`.
  [docs](https://docs.sunbit.com/docs/transactions-management/issue-refunds)

### Merchant onboarding
- `POST /onboarding/api/v1/location` — create a merchant location; `vertical` is a 14-value
  closed enum. [docs](https://docs.sunbit.com/docs/onboarding/adding-new-location)
- `GET /onboarding/api/v1/location/{location}` — onboarding application status.

### Reporting
- `GET /reports/api/v1/summary` — aggregated purchases, approvals, declines, approval and
  conversion rates. [docs](https://docs.sunbit.com/docs/reporting/transactions-summary-report)
- `GET /reports/api/v1/detailed` — per-transaction rows.
  [docs](https://docs.sunbit.com/docs/reporting/transactions-detailed-report)
- `GET /reports/api/v1/customer-offer-history` — paginated offer history; IP-allowlisted; the
  only paginated endpoint. Customer email and phone are always returned empty.
  [docs](https://docs.sunbit.com/docs/reporting/customer-offer-history-report)

### Platform
- `POST /alliance/api/v1/merchant-authentication` — exchange key+secret for a Payment Path
  bearer token with an `expiresAt`.
  [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-payment-path)
- `POST /developers-portal-service/api/v2/auth/login-link` — mint a no-login embedded URL into
  the Sunbit Partner Dashboard.
  [docs](https://docs.sunbit.com/docs/api-integrations/embedded-portal)

## SDK

Loaded from `https://static.sunbit.com/sdk/sunbit-sdk.js`, attaches the `SUNBIT` global,
initialized via `window.sunbitAsyncInit`. Modes: `SANDBOX` (local simulation, no server
calls), `DEMO` (full flow, real purchaseId), `PROD`.

- `SUNBIT.UI.asLowAs` / `SUNBIT.UI.asLowAsWithLink` — estimate text element (+ mandatory
  disclaimer element). [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-sdk-estimate)
- `SUNBIT.UI.checkFinancingLink` — pre-qualification link element.
  [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-sdk-prequal)
- `SUNBIT.UI.checkoutElement` + `SUNBIT.epay.init` / `SUNBIT.epay.checkout` — checkout button
  and hosted modal. [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-checkout-sdk)
- `SUNBIT.PaymentPathModule` — guided in-store payment path.
  [docs](https://docs.sunbit.com/docs/sdk-integrations/sunbit-payment-path)

## Webhooks

One partner-configured URL per environment. Envelope is `{eventType, payload}`. Signed with
HMAC-SHA256 over `<timestamp>.<raw body>` in a `Sunbit-Signature: t=...,v1=...` header;
recommended replay tolerance ~5 minutes.

- [Setup](https://docs.sunbit.com/docs/webhooks/webhooks-setup)
- [Verify Webhook Signature](https://docs.sunbit.com/docs/webhooks/webhooks-verify-signature)
- [Onboarding Status](https://docs.sunbit.com/docs/webhooks/webhooks-onboarding-status) —
  `MERCHANT_CREATED`, `MERCHANT_LOCATION_DETAILS_ADDED`, `MERCHANT_CONTACT_DETAILS_ADDED`,
  `MERCHANT_BANK_INFORMATION_ADDED`, `MERCHANT_LEGAL_INFORMATION_ADDED`, `MERCHANT_SUBMITTED`,
  `MERCHANT_ACTIVATED`, `MERCHANT_DECLINED`
- [Prequal](https://docs.sunbit.com/docs/webhooks/webhooks-prequal) — `PREQUAL_COMPLETED`,
  `PREQUAL_APPROVED`, `PREQUAL_FAILED`, `PREQUAL_ABORTED`
- [Text to Pay-Over-Time](https://docs.sunbit.com/docs/webhooks/webhooks-text-to-pay-over-time)
  — `TEXT_TO_PAY_COMPLETED`, `TEXT_TO_PAY_FAILED`, `TEXT_TO_PAY_ABORTED`
- [Checkout SDK](https://docs.sunbit.com/docs/webhooks/checkout-sdk) —
  `CHECKOUT_SDK_COMPLETED`, `CHECKOUT_SDK_FAILED`, `CHECKOUT_SDK_ABORTED`
- [Voided and Refunded](https://docs.sunbit.com/docs/webhooks/webhooks-transactions-voided-and-refunded)
  — `TRANSACTION_VOIDED`, `TRANSACTION_REFUNDED`

## Repository artifacts

- `authentication/sunbit-authentication.yml` — every credential and control, including IP
  allowlisting and the two bearer-token variants
- `conventions/sunbit-conventions.yml` — pagination, versioning, error envelopes, sentinel
  values, rate limiting, and the absence of idempotency
- `errors/sunbit-problem-types.yml` — 44 documented errors across 12 operations
- `asyncapi/sunbit-webhooks.yml` — the full 20-event webhook catalog and signature scheme
- `sandbox/sunbit-sandbox.yml` — sandbox hosts, SDK modes, transactionId simulation prefixes,
  demo test values
- `data-model/sunbit-data-model.yml` — entities and relationships derived from the docs
- `components/sunbit-components.yml` — the browser SDK surface
- `packages/sunbit-packages.yml` — client library inventory
- `lifecycle/sunbit-lifecycle.yml` — versioning, deprecations, status page, availability
- `conformance/sunbit-conformance.yml` — standards posture, 34 assertions with evidence
- `security/` — domain security probe, vulnerability disclosure
- `well-known/` — /.well-known probe results across all eight Sunbit hosts
- `skills/` — five packaged agent skills for the marquee flows

## Notable gaps for agents

- No machine-readable contract of any kind — an agent must read prose to call this API.
- No idempotency key on any write, including checkout initialization, void and partial refund.
- No rate-limit headers, though an unpublished per-key daily cap exists.
- No self-serve credentials or sandbox; onboarding requires a Sunbit sales conversation.
- Credential failure is 401 on two services and 403 on four others.
- Error identity is a free-text message string on the legacy services.

## Company

- [Sunbit](https://sunbit.com/)
- [About](https://sunbit.com/about-sunbit/)
- [Leadership](https://sunbit.com/leadership/)
- [Knowledge Center / blog](https://sunbit.com/knowledge-center/)
- [Rates and Terms](https://sunbit.com/rates_and_terms/)
- [Terms of Use](https://sunbit.com/terms-of-use/)
- [Consumer Privacy](https://sunbit.com/consumer_privacy/)
- [Accessibility](https://sunbit.com/accessibility/)
- [Contact](https://sunbit.com/contact-us/) — partner support: partnersupport@sunbit.com
- [security.txt](https://sunbit.com/.well-known/security.txt) — security@sunbit.com (expired
  2022-12-31)