// These variables should be populated from a remote & secure source
var applicationNumber = '510000343',
	partnerReferenceId = '',
	username = '********',
	password = '********',
	xApiKey = '********-********-********-********-********',
	requri = 'https://testdevportal.marlincapitalsolutions.com:8077/ws/rest/efappstatus/v1/getEFApplicationStatusApi';

var xhr = new XMLHttpRequest();
xhr.open('POST', requri);

xhr.setRequestHeader('Accept', 'application/json' );
xhr.setRequestHeader('Authorization', 'Basic ' + btoa( username + ':' + password ) );
xhr.setRequestHeader('x-api-key', xApiKey );
xhr.setRequestHeader('Content-Type', 'application/json' );

xhr.onreadystatechange = function() {
	if ( xhr.readyState === 4 ) {

		var jsonArr = JSON.parse( respData ),
				respStatus = jsonArr[ 'Status' ],
				respMessage = jsonArr['Application Status'];

		if ( 200 === respCode ) {
			// Good response, now to do something with it.
			var respStatus = respData['Status'],
				respMessage = respData['Message'];

			if ( true === respStatus ) {

				// Good response, now to do something with it.
				console.log( 'success' );
				console.log( respMessage );

			} else if ( false === respStatus ) {

				console.log( 'successful connection but no data in the response' );
				console.log( respMessage );

			} else {

				console.log( 'successful connection but we have an unexpected response' );
				console.log( respData )

			}


		} else {
			// We did not get a good response status
			console.log('bad response code');
			console.log( responseCode );
			console.log( respData );
		}
	}
};

xhr.send( JSON.stringify( data ) );

<?php

// These variables should be populated from a remote & secure source
$url                  = "https://testdevportal.marlincapitalsolutions.com:8077/ws/rest/efappstatus/v1/getEFApplicationStatusApi";
$application_number   = '510000343';
$partner_reference_id = '';
$username             = '********';
$password             = '********';
$x_api_key            = '********-********-********-********-********';

$data = [
'Application Number'   => $application_number,
'Partner Reference Id' => $partner_reference_id,
];

$curl = curl_init( $url );
curl_setopt( $curl, CURLOPT_URL, $url );
curl_setopt( $curl, CURLOPT_POST, true );
curl_setopt( $curl, CURLOPT_RETURNTRANSFER, true );

$headers = array(
'Accept: application/json',
'Content-Type: application/json',
'Authorization: Basic ' . base64_encode( $username . ':' . $password ),
'x-api-key: ' . $x_api_key,
);
curl_setopt( $curl, CURLOPT_HTTPHEADER, $headers );

$json_data = json_encode( $data );

curl_setopt( $curl, CURLOPT_POSTFIELDS, $json_data );

// FOR DEBUGGNIG ONLY!! DO NOT USE IN PRODUCTION
curl_setopt( $curl, CURLOPT_SSL_VERIFYHOST, false );
curl_setopt( $curl, CURLOPT_SSL_VERIFYPEER, false );
// END DEBUGGING

$resp = json_decode( curl_exec( $curl ) );
curl_close( $curl );

if ( isset( $resp->Status ) ) {
	// We have a response lets confirm what it is and go from there.
	if ( true == $resp->Status ) {
		// Good response, now to do something with it.
		var_dump( 'successful connection' );
		var_dump( $resp );
	} elseif ( false == $resp->Status ) {
		var_dump( 'successful connection but no data in the response' );
		var_dump( $resp );
	} else {
		var_dump( 'successful connection but we have an unexpected response' );
		var_dump( $resp );
	}
} else {
	var_dump( 'Bad response, no status detected' );
	var_dump( $resp );
}

Sample Request JSON

{
"Application Number":"510000348",
"Partner Reference Id":""
}

Sample Response JSON

{ 
    "Status": true,
    "Message": "success",
    "Application Status": "Automatically Approved",
    "ApplicationNumber": "510000348",
    "BusinessName": "Precision Contracting Services Inc",
    "ExternalStips": [
        {
            "StipName": "Corporate Officer or Owner to Sign",
            "StipStatus": "Open"
        },
        {
            "StipName": "Proof of equipment location",
            "StipStatus": "Open"
        }
    ]
}