Funding Applications

GET /api/v2/funding_applications

List funding applications.

The Organisation's live funding applications in ascending id order, at most 50 a page, narrowed by the filter flags and q. bank_account_number is null unless the credential may read bank account numbers.

• Operation ID: listFundingApplications
• Authentication: A Bearer token from a credential holding the read scope.
• Also served at /funding_system/api/v2/funding_applications, the documented product’s alias path.

curl "https://your-org.backed.giving/api/v2/funding_applications" \
  -H "Authorization: Bearer $BACKED_TOKEN"

Parameters

200 response

A JSON array of funding applications.

[
  {
    "id": 1287,
    "created_at": "2026-03-02T21:15:04.000Z",
    "updated_at": "2026-06-18T03:40:11.000Z",
    "funding_round_id": 42,
    "state": "submitted",
    "title": "Te Awa river restoration",
    "submitted_at": "2026-05-20T04:12:55.000Z",
    "funding_category": {
      "id": 7,
      "name": "Community"
    },
    "registration_entity": {
      "id": 311,
      "name": "Te Awa Restoration Trust"
    },
    "lock_version": 3,
    "requested_amount": "24500.0"
  }
]

400 response

A query parameter is invalid, or a write’s body is not a JSON object.

{
  "error": "invalid_request",
  "error_description": "limit is invalid"
}

401 response

The token is missing, invalid, expired or revoked, of another Organisation, or API access is not Full. Ask for a new token.

Headers: WWW-Authenticate.

{
  "error": "invalid_token",
  "error_description": "The access token is invalid or has expired"
}

403 response

The request was sent over plain HTTP and was not processed.

{
  "error": "https_required"
}

404 response

An unknown host or path, or an id that is unknown, deleted or of another Organisation.

{
  "error": "not_found"
}

429 response

A rate limit was exceeded: 120 requests a minute per credential, 30 token requests a minute per client_id.

Headers: Retry-After.

{
  "error": "rate_limited",
  "error_description": "Too many requests"
}

500 response

An unexpected server error.

{
  "error": "server_error"
}

503 response

The Organisation’s API access cannot be determined, or a dependency is unavailable. Retry after the given seconds.

Headers: Retry-After.

{
  "error": "temporarily_unavailable"
}

GET /api/v2/funding_applications/{id}

Get one funding application with its form entry.

Every list property (and the named extra methods), then entry with every input. Answers hidden by form logic are included and not marked.

• Operation ID: getFundingApplication
• Authentication: A Bearer token from a credential holding the read scope.
• Also served at /funding_system/api/v2/funding_applications/{id}, the documented product’s alias path.

curl "https://your-org.backed.giving/api/v2/funding_applications/42" \
  -H "Authorization: Bearer $BACKED_TOKEN"

Parameters

200 response

The funding application with its form entry.

{
  "id": 1287,
  "created_at": "2026-03-02T21:15:04.000Z",
  "updated_at": "2026-06-18T03:40:11.000Z",
  "funding_round_id": 42,
  "state": "submitted",
  "title": "Te Awa river restoration",
  "submitted_at": "2026-05-20T04:12:55.000Z",
  "funding_category": {
    "id": 7,
    "name": "Community"
  },
  "registration_entity": {
    "id": 311,
    "name": "Te Awa Restoration Trust"
  },
  "lock_version": 3,
  "requested_amount": "24500.0",
  "entry": {
    "id": 9001,
    "created_at": "2026-03-02T21:15:04.000Z",
    "updated_at": "2026-05-20T04:12:55.000Z",
    "inputs": [
      {
        "id": 55120,
        "value": "Te Awa river restoration",
        "input_group_id": null,
        "input_group_order": null,
        "field": {
          "id": 801,
          "internal_identifier": "project_title",
          "name": "Project title",
          "order": 1
        },
        "file": null,
        "tahua_file_url": null
      },
      {
        "id": 55121,
        "value": "budget.pdf",
        "input_group_id": null,
        "input_group_order": null,
        "field": {
          "id": 802,
          "internal_identifier": "budget",
          "name": "Budget",
          "order": 2
        },
        "file": {
          "filename": "budget.pdf",
          "content_type": "application/pdf",
          "byte_size": 182044
        },
        "tahua_file_url": "https://your-org.backed.giving/api/v2/file_inputs/55121"
      }
    ]
  }
}

400 response

A query parameter is invalid, or a write’s body is not a JSON object.

{
  "error": "invalid_request",
  "error_description": "limit is invalid"
}

401 response

The token is missing, invalid, expired or revoked, of another Organisation, or API access is not Full. Ask for a new token.

Headers: WWW-Authenticate.

{
  "error": "invalid_token",
  "error_description": "The access token is invalid or has expired"
}

403 response

The request was sent over plain HTTP and was not processed.

{
  "error": "https_required"
}

404 response

An unknown host or path, or an id that is unknown, deleted or of another Organisation.

{
  "error": "not_found"
}

429 response

A rate limit was exceeded: 120 requests a minute per credential, 30 token requests a minute per client_id.

Headers: Retry-After.

{
  "error": "rate_limited",
  "error_description": "Too many requests"
}

500 response

An unexpected server error.

{
  "error": "server_error"
}

503 response

The Organisation’s API access cannot be determined, or a dependency is unavailable. Retry after the given seconds.

Headers: Retry-After.

{
  "error": "temporarily_unavailable"
}

POST /api/v2/funding_applications/{id}/notes

Add a note to a funding application.

Kept as an Internal Comment (internal_comments.create), labelled with the credential and the run-as Administrator.

• Operation ID: createApplicationNote
• Authentication: A Bearer token from a credential holding the write:applications scope. Runs as the credential’s Administrator, and needs an Idempotency-Key header.

curl -X POST "https://your-org.backed.giving/api/v2/funding_applications/42/notes" \
  -H "Authorization: Bearer $BACKED_TOKEN" \
  -H "Idempotency-Key: 7d1f0c2e-5b8a-4f3e-9c61-2a4b8e9d0f13" \
  -H "Content-Type: application/json" \
  -d '{"body":"Budget checked against the supplier quote."}'

Parameters

Request body

application/json, the ApplicationNoteCreate schema. The note’s text, kept on the application as an Internal Comment.

{
  "body": "Budget checked against the supplier quote."
}

201 response

The note.

Headers: Idempotent-Replayed.

{
  "id": 7781,
  "body": "Budget checked against the supplier quote.",
  "author_label": "API: Finance sync as Mere Tane",
  "created_at": "2026-05-20T04:12:55.000Z"
}

400 response

idempotency_key_required: The write has no Idempotency-Key header of 1 to 255 characters. invalid_request: A query parameter is invalid, or a write’s body is not a JSON object.

{
  "error": "idempotency_key_required",
  "error_description": "A write needs an Idempotency-Key header of 1 to 255 characters"
}

{
  "error": "invalid_request",
  "error_description": "limit is invalid"
}

401 response

The token is missing, invalid, expired or revoked, of another Organisation, or API access is not Full. Ask for a new token.

Headers: WWW-Authenticate.

{
  "error": "invalid_token",
  "error_description": "The access token is invalid or has expired"
}

403 response

https_required: The request was sent over plain HTTP and was not processed. insufficient_scope: The credential does not hold the scope the route needs. run_as_disabled: The credential has no run-as Administrator, or that person is no longer one. forbidden: The run-as Administrator lacks the permission, or the record is outside their Data Access Rules.

Headers: WWW-Authenticate.

{
  "error": "https_required"
}

{
  "error": "insufficient_scope",
  "error_description": "This credential lacks the write:applications scope"
}

{
  "error": "run_as_disabled",
  "error_description": "This credential has no enabled run-as Administrator"
}

{
  "error": "forbidden",
  "error_description": "The run-as Administrator may not do this to this record"
}

404 response

An unknown host or path, or an id that is unknown, deleted or of another Organisation.

{
  "error": "not_found"
}

409 response

The first request with this Idempotency-Key has not finished. Nothing was written; retry after the given seconds.

Headers: Retry-After.

{
  "error": "idempotency_in_progress",
  "error_description": "The first request with this Idempotency-Key has not finished. If this persists it stopped part-way: check whether the record exists before writing again with a new key"
}

413 response

The body, or the declared file, is larger than the limit that applies.

{
  "error": "payload_too_large",
  "error_description": "The request body is too large"
}

415 response

The body is not application/json, or the target does not accept the file’s content type.

{
  "error": "unsupported_media_type",
  "error_description": "The request body must be application/json"
}

422 response

idempotency_key_reused: The Idempotency-Key was used in the last 24 hours for a different method, path or body. unknown_field: The body has a property the route does not document; the first is named. validation_failed: Body values the product’s own form would refuse; fields names each.

{
  "error": "idempotency_key_reused",
  "error_description": "This Idempotency-Key was used for a different request"
}

{
  "error": "unknown_field",
  "error_description": "bank_account_number is not a writable field"
}

{
  "error": "validation_failed",
  "error_description": "Invalid fields: due_date",
  "fields": [
    "due_date"
  ]
}

429 response

A rate limit was exceeded: 120 requests a minute per credential, 30 token requests a minute per client_id.

Headers: Retry-After.

{
  "error": "rate_limited",
  "error_description": "Too many requests"
}

500 response

An unexpected server error.

{
  "error": "server_error"
}

503 response

The Organisation’s API access cannot be determined, or a dependency is unavailable. Retry after the given seconds.

Headers: Retry-After.

{
  "error": "temporarily_unavailable"
}

PUT /api/v2/funding_applications/{id}/tags

Replace a funding application’s tags.

The hand-set tags become exactly these existing tags of the Organisation (applications.tags). A tag not in the Organisation’s vocabulary is 422 unknown_tag; none is created. Needs the Assessments module.

• Operation ID: replaceApplicationTags
• Authentication: A Bearer token from a credential holding the write:applications scope. Runs as the credential’s Administrator, and needs an Idempotency-Key header.

curl -X PUT "https://your-org.backed.giving/api/v2/funding_applications/42/tags" \
  -H "Authorization: Bearer $BACKED_TOKEN" \
  -H "Idempotency-Key: 7d1f0c2e-5b8a-4f3e-9c61-2a4b8e9d0f13" \
  -H "Content-Type: application/json" \
  -d '{"tags":["priority","rural"]}'

Parameters

Request body

application/json, the ApplicationTags schema. The application’s hand-set tags, each an existing tag of the Organisation. Answered lower-cased and sorted.

{
  "tags": [
    "priority",
    "rural"
  ]
}

200 response

The tags now set.

Headers: Idempotent-Replayed.

{
  "tags": [
    "priority",
    "rural"
  ]
}

400 response

idempotency_key_required: The write has no Idempotency-Key header of 1 to 255 characters. invalid_request: A query parameter is invalid, or a write’s body is not a JSON object.

{
  "error": "idempotency_key_required",
  "error_description": "A write needs an Idempotency-Key header of 1 to 255 characters"
}

{
  "error": "invalid_request",
  "error_description": "limit is invalid"
}

401 response

The token is missing, invalid, expired or revoked, of another Organisation, or API access is not Full. Ask for a new token.

Headers: WWW-Authenticate.

{
  "error": "invalid_token",
  "error_description": "The access token is invalid or has expired"
}

403 response

https_required: The request was sent over plain HTTP and was not processed. insufficient_scope: The credential does not hold the scope the route needs. run_as_disabled: The credential has no run-as Administrator, or that person is no longer one. forbidden: The run-as Administrator lacks the permission, or the record is outside their Data Access Rules.

Headers: WWW-Authenticate.

{
  "error": "https_required"
}

{
  "error": "insufficient_scope",
  "error_description": "This credential lacks the write:applications scope"
}

{
  "error": "run_as_disabled",
  "error_description": "This credential has no enabled run-as Administrator"
}

{
  "error": "forbidden",
  "error_description": "The run-as Administrator may not do this to this record"
}

404 response

not_found: An unknown host or path, or an id that is unknown, deleted or of another Organisation. module_disabled: The Organisation has the module this route belongs to turned off.

{
  "error": "not_found"
}

{
  "error": "module_disabled",
  "error_description": "This module is not enabled for the Organisation"
}

409 response

The first request with this Idempotency-Key has not finished. Nothing was written; retry after the given seconds.

Headers: Retry-After.

{
  "error": "idempotency_in_progress",
  "error_description": "The first request with this Idempotency-Key has not finished. If this persists it stopped part-way: check whether the record exists before writing again with a new key"
}

413 response

The body, or the declared file, is larger than the limit that applies.

{
  "error": "payload_too_large",
  "error_description": "The request body is too large"
}

415 response

The body is not application/json, or the target does not accept the file’s content type.

{
  "error": "unsupported_media_type",
  "error_description": "The request body must be application/json"
}

422 response

idempotency_key_reused: The Idempotency-Key was used in the last 24 hours for a different method, path or body. unknown_field: The body has a property the route does not document; the first is named. validation_failed: Body values the product’s own form would refuse; fields names each. unknown_tag: A tag is not one of the Organisation’s tags. None is created.

{
  "error": "idempotency_key_reused",
  "error_description": "This Idempotency-Key was used for a different request"
}

{
  "error": "unknown_field",
  "error_description": "bank_account_number is not a writable field"
}

{
  "error": "validation_failed",
  "error_description": "Invalid fields: due_date",
  "fields": [
    "due_date"
  ]
}

{
  "error": "unknown_tag",
  "error_description": "urgent is not a tag of this Organisation"
}

429 response

A rate limit was exceeded: 120 requests a minute per credential, 30 token requests a minute per client_id.

Headers: Retry-After.

{
  "error": "rate_limited",
  "error_description": "Too many requests"
}

500 response

An unexpected server error.

{
  "error": "server_error"
}

503 response

The Organisation’s API access cannot be determined, or a dependency is unavailable. Retry after the given seconds.

Headers: Retry-After.

{
  "error": "temporarily_unavailable"
}

POST /api/v2/funding_applications/{id}/transitions

Move a funding application.

One of the Administrator’s record moves through the application’s own rules, with the messages and audit entries the screen makes. A move not open from the current status is 409 invalid_transition naming it. An unlock needs a deadline that is a future UTC timestamp with milliseconds, such as 2027-06-07T11:59:00.000Z.

• Operation ID: transitionFundingApplication
• Authentication: A Bearer token from a credential holding the write:applications scope. Runs as the credential’s Administrator, and needs an Idempotency-Key header.

curl -X POST "https://your-org.backed.giving/api/v2/funding_applications/42/transitions" \
  -H "Authorization: Bearer $BACKED_TOKEN" \
  -H "Idempotency-Key: 7d1f0c2e-5b8a-4f3e-9c61-2a4b8e9d0f13" \
  -H "Content-Type: application/json" \
  -d '{"transition":"unlock","message":"Please attach the updated budget.","deadline":"2027-06-07T11:59:00.000Z"}'

Parameters

Request body

application/json, the ApplicationTransition schema. One of the Administrator’s record moves, with its parameters: unlock takes message and deadline, request_more_information form_template_id, the edit-request decisions edit_request_id. An unlock’s deadline is a future UTC timestamp with milliseconds (2027-06-07T11:59:00.000Z), the moment the editing window closes by itself; a date alone, or a moment already past, is 422 validation_failed.

{
  "transition": "unlock",
  "message": "Please attach the updated budget.",
  "deadline": "2027-06-07T11:59:00.000Z"
}

200 response

The funding application as the list answers it.

Headers: Idempotent-Replayed.

{
  "id": 1287,
  "created_at": "2026-03-02T21:15:04.000Z",
  "updated_at": "2026-06-18T03:40:11.000Z",
  "funding_round_id": 42,
  "state": "submitted",
  "title": "Te Awa river restoration",
  "submitted_at": "2026-05-20T04:12:55.000Z",
  "funding_category": {
    "id": 7,
    "name": "Community"
  },
  "registration_entity": {
    "id": 311,
    "name": "Te Awa Restoration Trust"
  },
  "lock_version": 3,
  "requested_amount": "24500.0"
}

400 response

idempotency_key_required: The write has no Idempotency-Key header of 1 to 255 characters. invalid_request: A query parameter is invalid, or a write’s body is not a JSON object.

{
  "error": "idempotency_key_required",
  "error_description": "A write needs an Idempotency-Key header of 1 to 255 characters"
}

{
  "error": "invalid_request",
  "error_description": "limit is invalid"
}

401 response

The token is missing, invalid, expired or revoked, of another Organisation, or API access is not Full. Ask for a new token.

Headers: WWW-Authenticate.

{
  "error": "invalid_token",
  "error_description": "The access token is invalid or has expired"
}

403 response

https_required: The request was sent over plain HTTP and was not processed. insufficient_scope: The credential does not hold the scope the route needs. run_as_disabled: The credential has no run-as Administrator, or that person is no longer one. forbidden: The run-as Administrator lacks the permission, or the record is outside their Data Access Rules.

Headers: WWW-Authenticate.

{
  "error": "https_required"
}

{
  "error": "insufficient_scope",
  "error_description": "This credential lacks the write:applications scope"
}

{
  "error": "run_as_disabled",
  "error_description": "This credential has no enabled run-as Administrator"
}

{
  "error": "forbidden",
  "error_description": "The run-as Administrator may not do this to this record"
}

404 response

An unknown host or path, or an id that is unknown, deleted or of another Organisation.

{
  "error": "not_found"
}

409 response

idempotency_in_progress: The first request with this Idempotency-Key has not finished. Nothing was written; retry after the given seconds. invalid_transition: The move is not open from where the record stands; current_status says where that is. invalid_state: The record is not in a state that admits this write.

Headers: Retry-After.

{
  "error": "idempotency_in_progress",
  "error_description": "The first request with this Idempotency-Key has not finished. If this persists it stopped part-way: check whether the record exists before writing again with a new key"
}

{
  "error": "invalid_transition",
  "error_description": "The record cannot make this move from approved",
  "current_status": "approved"
}

{
  "error": "invalid_state",
  "error_description": "The target does not take files in its current state"
}

412 response

If-Match is missing, malformed or not the record’s current lock_version, or the record changed under the write. Nothing was written.

{
  "error": "precondition_failed",
  "error_description": "If-Match must carry the record’s current lock_version"
}

413 response

The body, or the declared file, is larger than the limit that applies.

{
  "error": "payload_too_large",
  "error_description": "The request body is too large"
}

415 response

The body is not application/json, or the target does not accept the file’s content type.

{
  "error": "unsupported_media_type",
  "error_description": "The request body must be application/json"
}

422 response

idempotency_key_reused: The Idempotency-Key was used in the last 24 hours for a different method, path or body. unknown_field: The body has a property the route does not document; the first is named. validation_failed: Body values the product’s own form would refuse; fields names each.

{
  "error": "idempotency_key_reused",
  "error_description": "This Idempotency-Key was used for a different request"
}

{
  "error": "unknown_field",
  "error_description": "bank_account_number is not a writable field"
}

{
  "error": "validation_failed",
  "error_description": "Invalid fields: due_date",
  "fields": [
    "due_date"
  ]
}

429 response

A rate limit was exceeded: 120 requests a minute per credential, 30 token requests a minute per client_id.

Headers: Retry-After.

{
  "error": "rate_limited",
  "error_description": "Too many requests"
}

500 response

An unexpected server error.

{
  "error": "server_error"
}

503 response

The Organisation’s API access cannot be determined, or a dependency is unavailable. Retry after the given seconds.

Headers: Retry-After.

{
  "error": "temporarily_unavailable"
}