ROVER, inside your product.

Every lender's overlays, before you submit

DU and LPA approve to the agency rule. A wholesale lender can add a stricter rule of its own, an overlay, and decline the file late. One call tests a file against the agency books and every lender in the brain. Every rule comes back with its section, its page and its date. This page runs on the public sandbox key, which sees a sample of three lenders; your live key sees every lender in the brain.

POST /v1/overlays/test

What you can build with it

Nine things partners ship first. Every one runs through the same guard a borrower meets on royalai.app.

1. An answer bar in your appAny question about a home loan, answered in ROVER's voice, with a rail under it that says what it is.
2. Payment and amortization estimatesYour rate, our arithmetic. Every estimate carries its disclosure.
3. A consented hand-offWhen someone says "have Royal call me," one call files the lead with the exact words they agreed to.
4. Status, pushed to your CRMSigned webhooks the moment a lead moves: contacted, application started, with the lender, closed.
5. ROVER Agent for your agent portalThe partner persona for real-estate professionals: contract mechanics, customary costs, where to go next.
6. Meet people where they areSixteen worlds, from "just dreaming" to "retiring at home." Tell ROVER the world and the voice follows.
7. Streaming, token by tokenAsk for Server-Sent Events and paint the answer as it arrives, exactly as Royal's own sites do.
8. A free sandboxBuild the whole integration on a test key. Same envelope, same validation, no model, no bill.
9. Compliance by constructionNo rates from us, no approvals in a status, sensitive data refused on sight, every request audited.

Quickstart

curl https://api.royalai.ai/v1/ask \
  -H "Authorization: Bearer $ROYAL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"question":"How does a HELOC work?","context":{"world":"equity","surface":"borrower"}}'

const res = await fetch('https://api.royalai.ai/v1/ask', {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.ROYAL_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ question: 'How does a HELOC work?', context: { world: 'equity', surface: 'borrower' } }),
});
const { text, done } = await res.json();
console.log(text);
console.log(done.followup); // the rail to show under the answer

import os, requests

r = requests.post(
    "https://api.royalai.ai/v1/ask",
    headers={"Authorization": f"Bearer {os.environ['ROYAL_KEY']}"},
    json={"question": "How does a HELOC work?", "context": {"world": "equity", "surface": "borrower"}},
    timeout=60,
)
answer = r.json()
print(answer["text"])
print(answer["done"]["followup"])  # the rail to show under the answer

Try it

A real request to this API from your browser. The public sandbox key is filled in; paste your own to see your data, and every lender in the brain rather than the sandbox's sample of three. Sandbox answers are placeholders in the real envelope.

{ }

Reference

Generated from the live OpenAPI 3.1 specification, so it cannot drift from the server. Base URL https://api.royalai.ai. Every error is {"error":{"code","message","requestId"}}.

Webhooks

Register an https endpoint and ROYAL Ai posts a signed event when a lead is created or its status changes. Delivery is at least once, from this address, within ten seconds of the event.

{
  "id": "evt_1c0b7d2e4a513f9a",
  "object": "event",
  "type": "lead.status_changed",
  "livemode": true,
  "createdAt": "2026-11-03T15:04:05.000Z",
  "data": {
    "lead": { "id": "lead_3f9a1c0b7d2e4a51", "status": "contacted", "…": "…" },
    "previousStatus": "received"
  }
}

import crypto from 'node:crypto';

export function verify(secret, header, rawBody, toleranceSec = 300) {
  const parts = header.split(',').map((p) => p.trim());
  const t = Number((parts.find((p) => p.startsWith('t=')) || '').slice(2));
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  return parts.filter((p) => p.startsWith('v1=')).some((p) => {
    const sig = Buffer.from(p.slice(3), 'hex');
    return sig.length === expected.length && crypto.timingSafeEqual(sig, expected);
  });
}
// rawBody must be the exact bytes received, before any JSON parsing.

import hmac, hashlib, time

def verify(secret: str, header: str, raw_body: bytes, tolerance: int = 300) -> bool:
    parts = [p.strip() for p in header.split(",")]
    t = next((int(p[2:]) for p in parts if p.startswith("t=")), None)
    if t is None or abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(p[3:], expected) for p in parts if p.startswith("v1="))
# raw_body is request.get_data() in Flask, await request.body() in FastAPI.

function verify(string $secret, string $header, string $rawBody, int $tolerance = 300): bool {
  $t = null; $sigs = [];
  foreach (array_map('trim', explode(',', $header)) as $p) {
    if (str_starts_with($p, 't=')) $t = (int) substr($p, 2);
    elseif (str_starts_with($p, 'v1=')) $sigs[] = substr($p, 3);
  }
  if ($t === null || abs(time() - $t) > $tolerance) return false;
  $expected = hash_hmac('sha256', "$t.$rawBody", $secret);
  foreach ($sigs as $s) if (hash_equals($expected, $s)) return true;
  return false;
}
// $rawBody = file_get_contents('php://input');

Errors and limits

Security and compliance

ROVER is an AI. Answers are information, not advice or an offer to lend. A licensed lender makes every credit decision. Partners agree not to pay or be paid for referrals in any way the law forbids, and to show the consent words exactly as the person saw them.

Status