REST API · v3 · AI-ready

Build with the Agility Credit API

Credit reports, fraud and identity checks, compliant applications, OFAC and MLA screening, and income verification, through one REST API with JSON requests and Bearer-key authentication.

Start the quickstart →API reference Postman collection

NewConnect your AI assistant to the docs with our MCP server and llms.txt →

api.agilitycredit.net/v3

Credit, identity, compliance and income in one APIBrowse all

New AI-ready docs

Build with your AI assistant

Connect Claude, Cursor or VS Code to the Agility Credit docs, or give any assistant the full reference. It reads the same endpoints, schemas and error codes you do, so the code it writes matches the real API.

MCP server
Claude, Cursor and VS Code look up endpoints, headers, schemas and error codes while you code. Read-only, no API key needed.
llms.txt and Markdown docs
Every page as Markdown at its URL + .md, an llms.txt index, and the whole reference in one file for any assistant.
OpenAPI spec and Postman
Generate a client from the spec, or send your first request from a ready-made Postman collection.

Set up the MCP server →Open llms.txt

Claude Code · one-time setup

$ claude mcp add agility-credit-docs -- npx -y @agilitycredit/docs-mcp

Then just ask

Which headers does POST /credit-reports need?

Write a Python function that runs an OFAC check.

What does a 409 from the Prefill endpoints mean?

Any assistant: apidocs.agilitycredit.com/llms-full.txtOpen

Quickstart

Your first credit inquiry in three steps

Get a key, make a prequal (soft) inquiry in the UAT environment, and read the response.

1
Get an API key
Agility Credit sets up your account and gives you your tenant ID and your first user ID. Then log in to the Agility portal and go to Settings → Account → API Keys. Click Create API key and give it a descriptive name.
UAT and production use separate API keys: create one in each environment's portal.
No account yet? Email setup@agilitycredit.com.
Shell
```
export AGC_API_KEY="<your API key>"
export AGC_TENANT_ID="<your tenant ID>"
export AGC_USER_ID="<your user ID>"
```

Make a credit inquiry

Send POST /credit-reports with the bureau, the pull type and the applicant. A prequal pull doesn't need SSN or date of birth; a hard pull does.

Every POST takes a fresh Idempotency-Key. We recommend a GUID.

The applicant values here are placeholders. For UAT, use the test identities Agility Credit provides with your credentials.

Prefer Postman? Import the collection and set apiKey, tenantId and userId in its variables.

Download Postman collection Make an Inquiry reference →

POST /credit-reports
curl -X POST https://api.agc-dev.com/v3/credit-reports \
  -H "Authorization: Bearer $AGC_API_KEY" \
  -H "Agc-Tenant-Id: $AGC_TENANT_ID" \
  -H "Agc-User-Id: $AGC_USER_ID" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "bureau_id": "experian",
    "pull_type": "prequal",
    "report_format": "json",
    "applicant_main": {
      "first_name": "JANE",
      "last_name": "SAMPLE",
      "address": "123 MAIN ST",
      "city": "ANYTOWN",
      "state": "TX",
      "zip": "75001",
      "income": { "gross_monthly": 5000 }
    }
  }'

Read the response

A 200 returns the report. body_type tells you which shape you got: inquiry, inquiry_joint, inquiry_multiple_formats, inquiry_with_bureau_error or compliance.

Keep the Agc-Applicant-Id header. Pass it on later calls (OFAC, MLA, documents) to attach them to the same applicant, and fetch the report again any time with GET /credit-reports/{id}.

Get a Report reference →

Response (abridged)
HTTP/1.1 200 OK
Agc-Applicant-Id: <applicant id>
Agc-Report-Id: <report id>
Agc-Api-Version: <version>
X-Rate-Limit: <limit>
X-Rate-Limit-Remaining: <remaining>

{
  "body_type": "inquiry",
  "metadata": {
    "report_id": "…",
    "transaction_id": "…",
    "bureau_id": "experian",
    "pull_type": "prequal",
    "report_format": "json"
  },
  "applicant_information": { … },
  "credit_scores": [ … ],
  "credit_summary": { … },
  "tradelines": [ … ],
  "inquiries": [ … ],
  "public_records": [ … ]
}

Explore the API

Pick a service family

Each family matches a service on agilitycredit.com. Open one to see its endpoints, schemas and code samples.

Credit data

Prequal (soft) or hard pulls from Equifax, Experian or TransUnion, returned as JSON, HTML, XML, PDF, raw bureau output or a link.

Fraud & identity

Experian Precise ID (account opening, GLB, one-time passcodes, out-of-wallet questions), Prove prefill and identity verification, IDV+ and driver's license verification.

Compliant applications

Send FastApp and compliance links to applicants, then fetch the applicant, their compliance records and the documents they upload.

OFAC & MLA screening

Check an applicant against OFAC sanctions, and check whether they are covered under the Military Lending Act.

Income & employment

Experian Verify (Plus and Premium) and Alt-Fi income inquiries.

Vehicle data

Look up vehicle information from a license plate with Plate to VIN.

POST/p2v

Administration

Create and manage tenants, and set up single sign-on and SCIM user provisioning.

Webhooks

Get notified when work finishes, for example pid.completed, otp.completed, compliance.cleared and dlv.completed. Deliveries can be signed with HMAC.

Platform basics

How the API works

What every integration needs: authentication, environments, errors, rate limits and versioning.

Authentication

Send your API key as a Bearer token on every request. Most endpoints also identify the tenant and the user making the call.

Header	When	Value
`Authorization`	Every request	`Bearer <api key>`
`Agc-Tenant-Id`	Most endpoints	The tenant ID provided by Agility Credit.
`Agc-User-Id`	Most endpoints	The ID of the user making the request.
`Idempotency-Key`	Every `POST`	A unique key per request. We recommend a GUID.
`Agc-Applicant-Id`	Optional on most calls; required to read compliance records and documents	Attaches the call to an existing applicant. Leave it out and a new applicant is created.

Each endpoint's page lists exactly which headers it requires.

Idempotency keys are kept for 5 minutes. If you resend a request with the same Idempotency-Key within that time, you get the cached response from the first request instead of a second call.

Environments

Build and test against UAT, then switch the base URL and API key to production. The API reference's "try it" panel lets you pick either server.

UAT is a private test environment: Agility Credit provides your UAT credentials. UAT calls are not billed and don't reach live credit bureaus.

UAT · test

API base URL: https://api.agc-dev.com/v3
Portal: app.agc-dev.com

Production · live

API base URL: https://api.agilitycredit.net/v3
Portal: app.agilitycredit.net

Errors

We use standard HTTP status codes. 2xx means success, 4xx means something in the request needs fixing, and 5xx means a problem on our side. Each endpoint's page lists the codes it can return.

Status	Meaning	What to do
400	Bad Request	The request failed validation. The `error` field says which field and why.
401	Unauthorized	The API key is missing, wrong or no longer active.
403	Forbidden	The key is valid but not allowed to do this, for example the product is not enabled for your tenant.
404	Not found	The resource or session doesn't exist (tenants, DL Verify sessions).
409	Conflict	A request with the same `Idempotency-Key` is still in progress, a step was called out of order, or a DL Verify selfie is still processing.
410	Gone	A prefill session expired. Start again with `POST /prefill/auth`.
429	Too Many Requests	You've used up your rate limit for the current 5-minute window.
500	Server error	Something went wrong on our side.
502	Verification error	DL Verify couldn't process the session; retry with the same `session_id`.

400 Bad Request
{
  "status": "Bad Request - Invalid Parameters",
  "error": "Failed schema validation. Error: data.pull_type must be one of ['prequal', 'hard'] …"
}

401 · 429 · 500
{ "message": "Unauthorized" }
{ "error": "Too Many Requests" }
{ "message": "Agility Server Error" }

Rate limits

You set your rate limit in your tenant profile, under the API key settings. It's counted over a 5-minute window, and responses carry two headers so you can pace your calls:

X-Rate-Limit: your current limit for the window.
X-Rate-Limit-Remaining: calls left in the window.

Going over returns 429 Too Many Requests. Wait for the window to reset, then retry.

Versioning

The major version is in the URL (/v3). We release a new major version only for breaking changes; new features and backward-compatible updates ship as minor and patch versions, reported in the Agc-Api-Version response header.

Docs for earlier releases (3.0.1 and 2.0.3) are in the version menu at the top of the page.

Webhooks

Instead of polling, subscribe to events from the portal under Settings → Account → Webhooks. Each delivery carries an event_id that stays the same across retries, so you can use it to skip duplicates. Add a secret to have deliveries signed with HMAC in the X-Agc-Signature header.

Create webhooks Handle deliveries Validate signatures Events & payloads

Need access or help with an integration?

Our team sets up tenants, products and API access.

Email setup@agilitycredit.com Contact us

Build with your AI assistant​

Your first credit inquiry in three steps​

Get an API key

Make a credit inquiry

Read the response

Pick a service family​

Credit data

Fraud & identity

Compliant applications

OFAC & MLA screening

Income & employment

Vehicle data

Administration

Webhooks

How the API works

Authentication​

Environments​

Errors​

Rate limits​

Versioning​

Webhooks​

Need access or help with an integration?

Build with your AI assistant

Your first credit inquiry in three steps

Pick a service family

Authentication

Environments

Errors

Rate limits

Versioning

Webhooks