API Reference

MCA Disclosure API

Two endpoints: authenticate once to get a bearer token, then post a deal's figures to receive the state-specific MCA disclosure.

Base URLhttps://mcadisclosure-live.iocod.com/api

Introduction

The MCA Disclosure API generates a compliant merchant cash advance disclosure for a funding deal. Every request and response is JSON. The flow is two calls:

1POST /login - exchange your credentials for a bearer token.
2POST /calculate - send the deal's figures and receive the disclosure.

A helper endpoint, GET /get-states, lists the states the calculator supports.

Authentication

The API uses bearer tokens. Call /login to obtain a token, then send it on every subsequent request in the Authorization header:

bash

Authorization: Bearer <token>

/get-states is public and needs no token; /calculate returns 401 without one. Responses carry x-ratelimit-limit and x-ratelimit-remaining headers; the advertised limit is 60 requests per minute.

POST

Login

https://mcadisclosure-live.iocod.com/api/login

Authenticates with email and password and returns a bearer token.

Body parameters

Field Type Required Description

Field	Type	Required	Description
`email`	string	Yes	Account email address.
`password`	string	Yes	Account password.
`method`	enum	Yes	Required enum with three values: normal — email + password. This is the supported path for API access. apple — backs the first-party Firebase Apple sign-in; not intended for direct API use. google — backs the first-party Firebase Google sign-in; not intended for direct API use.

email

string

Yes

Account email address.

password

string

Yes

Account password.

method

enum

Yes

Required enum with three values:

normal — email + password. This is the supported path for API access.
apple — backs the first-party Firebase Apple sign-in; not intended for direct API use.
google — backs the first-party Firebase Google sign-in; not intended for direct API use.

Example

curl -X POST "https://mcadisclosure-live.iocod.com/api/login" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"email":"you@example.com","password":"your_password","method":"normal"}'

data.token is the field you pass to /calculate. userData returns the full user record; the fields shown above are an excerpt.

GET

States

https://mcadisclosure-live.iocod.com/api/get-states

Returns the states the calculator supports, each as a display name and abbreviation. No authentication required.

Note: for the state value sent to Calculate, use the name above lowercased with spaces removed (e.g. New York → newyork). The value is case-sensitive and the display name itself is not accepted. The abbreviation (e.g. NY) is also accepted, but always send the lowercased name: for Virginia, Connecticut and New York the state-specific required fields (per-state field rules) are only enforced for the name form.

Example

curl "https://mcadisclosure-live.iocod.com/api/get-states" \
  -H "Accept: application/json"

POST

Calculate

https://mcadisclosure-live.iocod.com/api/calculate

Requires a bearer token. Returns the disclosure figures for the requested state. The exact response keys vary by state - each state's disclosure law mandates different figures and labels.

Core fields

Field	Type	Required	Description
`purchase_price`	number	Yes	Amount funded to the merchant.
`revenue_purchased`	number	Yes	Total receivables purchased (purchase_price × factor_rate).
`factor_rate`	number	Yes	Factor rate, e.g. 1.4.
`state`	enum	Yes	Either the lowercased, space-stripped name (e.g. "New York" → newyork) or the uppercase abbreviation (NY). Both are accepted and behave identically, including the per-state required fields below. The display name with a space ("New York") is rejected — the 422 lists every accepted value.
`frequency`	enum	Yes	Payment frequency: daily or weekly. The response message reflects it ("Daily Calculation Completed" / "Weekly Calculation Completed").
`disbursement_date`	date	Yes	Funding date (YYYY-MM-DD).
`first_payment_date`	date	Yes	First payment date (YYYY-MM-DD).
`number_of_payments_weeks`	number	Yes	Number of payments in weeks, e.g. 21.
`number_of_payments_days`	number	Yes	Number of payments in days, e.g. 105.
`origination_fee`	number	Yes	Origination fee amount.
`month1`	number	Yes	Revenue, month 1.
`month2`	number	Yes	Revenue, month 2.
`month3`	number	Yes	Revenue, month 3.
`month4`	number	No	Revenue, month 4 (optional).
`funder_name`	string	Yes	Name of the funder.
`business_name`	string	Yes	Merchant business name.

Conditional fields

Required only for certain states - see per-state field rules.

Field	Type	Required	Description
`funder_email`	string	Virginia, Connecticut	Required when state is virginia or connecticut. Must be a valid email address.
`funder_address`	string	Virginia, Connecticut	Required when state is virginia or connecticut.
`funder_phone_number`	string	Virginia, Connecticut	Required when state is virginia or connecticut. US phone format, max 20 characters.
`merchant_address`	string	Connecticut	Required when state is connecticut. Not required for virginia, despite the other three funder fields being so.
`is_refinance_funding`	enum	New York, Connecticut	yes or no. Required when state is newyork or connecticut.

Optional fields

Field	Type	Required	Description
`previous_funding_charge`	number	No	Prior funding charge, for a refinance. Accepted but not enforced — the API does not require it even when is_refinance_funding is yes, and it does not change the returned figures.
`percent_previous_funding`	number	No	Percent of the prior funding, for a refinance. Same as above: accepted, never required, and does not change the returned figures.
`amount_paid_mca_funding`	number	No	Amount paid to a prior MCA funding.
`third_party_payoff`	number	No	Third-party payoff amount.
`name_of_third_party_payoff`	string	No	Name of the third-party payoff.
`broker_fee`	number	No	Broker fee amount.
`crm_lead_id`	number	No	External CRM lead id, e.g. 123.
`one_mail_id`	string	No	Owner 1 email address.
`one_name`	string	No	Owner 1 name.
`two_mail_id`	string	No	Owner 2 email address.
`two_name`	string	No	Owner 2 name.
`iso_mail_id`	string	No	ISO or broker email address.
`send_email`	number	No	1 to email the disclosure, 0 to skip.

Example

Each state returns a different set of disclosure figures - the example below is a real request and response for the selected state.

curl -X POST "https://mcadisclosure-live.iocod.com/api/calculate" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <token>" \
  -d '{
  "purchase_price": 100000,
  "revenue_purchased": 140000,
  "factor_rate": 1.4,
  "frequency": "daily",
  "disbursement_date": "2026-09-01",
  "first_payment_date": "2026-09-08",
  "month1": 90000,
  "month2": 85000,
  "month3": 88000,
  "number_of_payments_weeks": 21,
  "number_of_payments_days": 105,
  "origination_fee": 2500,
  "funder_name": "Example Funder",
  "business_name": "Example Merchant LLC",
  "send_email": 0,
  "state": "california"
}'

Per-state field rules

The state value determines which conditional fields are required, on top of the core fields.

State	Additional required fields
Virginia	`funder_email` `funder_address` `funder_phone_number`
Connecticut	`funder_email` `funder_address` `funder_phone_number` `merchant_address`Connecticut only - Virginia does not require this. `is_refinance_funding`yes or no.
New York	`is_refinance_funding`yes or no.
California, Florida, Georgia, Kansas, Louisiana, Missouri, Texas, Utah	None — core fields only

Errors

Errors return a JSON body with a message, and validation errors include a per-field errors object.

401Unauthenticated- Missing or invalid bearer token on a protected endpoint.

json

{ "message": "Unauthenticated." }

422Validation error- A required field is missing or has an invalid value. Every failing field is listed under errors.

json

{
  "message": "The email field is required. (and 2 more errors)",
  "errors": {
    "email": ["The email field is required."],
    "password": ["The password field is required."],
    "method": ["The method field is required."]
  }
}

422Invalid credentials- POST /login with an email/password that don't match. Note the different shape - no errors object.

json

{
  "success": false,
  "message": "Invalid credentials"
}