DOCSEARCHbyAlgolia
Submit Docs

Agility Credit API Documentation

website·Indexed 31 days ago

https://apidocs.agilitycredit.com

API reference for Agility Credit's identity verification and credit reporting services. Includes endpoints for DL Verify, Plate To Vin, Precheck, and credit report inquiries, as well as Precise ID identity verification via OTP and Out of Wallet questions. Documentation also covers SCIM 2.0 API for user and group management, federated sign-on (SSO) configurations, and data sanitization rules.

Tokens
31.5K
Snippets
115
Records
247
Agent score
51%

What's inside Agility Credit

  1. Overview of Agility Credit SSO and SCIM capabilities

    Agility Credit supports federated sign-on allowing users to authenticate via an existing Identity Provider (IdP) such as Okta, Entra ID (Azure AD), or any SAML 2.0 / OIDC compliant provider. Key features include:

    • Single Sign-On (SSO): Users authenticate using IdP credentials.
    • Automatic Role Assignment: IdP groups or attributes are mapped to Agility roles during sign-in.
    • SCIM Provisioning (Optional): Automates user and group provisioning from the IdP and can disable Just-In-Time (JIT) user creation.
    • Activity Log: Records all SSO and SCIM events for auditing in the portal.

  2. Overview of Agility Credit SCIM 2.0 API

    The Agility Credit SCIM 2.0 API provides endpoints for provisioning users and groups. It implements the SCIM 2.0 protocol (RFC 7644) and is designed for use with Identity Providers (IdPs) such as Okta and Microsoft Entra ID, as well as custom provisioning clients.

  3. Understand Precise ID automatic data sanitization behavior

    Before a Precise ID payload is sent to a credit bureau, all fields are automatically sanitized to meet bureau formatting rules. This process includes:

    • Removing disallowed characters.
    • Upper-casing or reformatting values where required.
    • Truncating values that exceed the field's maximum length.
    • Dropping values that cannot be made valid (e.g., a phone number not exactly 10 digits or an unrecognized enum value).

    Note: Original, unaltered values are always preserved on the applicant record; only the copy sent to the bureau is sanitized.

  4. Understand Agility Credit webhook delivery model

    Agility Credit uses an at-least-once delivery model. This means every event is guaranteed to be delivered one or more times, and duplicate deliveries are expected. Consequently, consumers must implement idempotent processing to avoid duplicate side effects. Delivery ordering is not guaranteed at the time of delivery.

  5. Understand automatic data sanitization for Credit Reports

    Before a Credit Report payload is transmitted to a credit bureau, the system automatically sanitizes specific fields to ensure compliance with bureau formatting rules. This process includes removing disallowed characters, converting values to uppercase, and truncating strings that exceed the maximum allowed length. Note that original, unaltered values are preserved on the applicant record; only the data forwarded to the bureau is modified.

  6. Perform trust scoring and identity verification using IDV+

    The Identity Verify Plus (IDV+) API provides a single-call mechanism to run both trust scoring and identity verification. This process does not require prior possession or a session; the developer submits the phone number and identity data directly in the request body, and the engine returns a combined result in one round trip.
    POST /verify-id

  7. Implement idempotency for webhook processing

    Because of the at-least-once delivery guarantee, consumers must use the event_id as an idempotency key to ensure an event is not processed multiple times.
    if event_id already processed:
    return success
else:
    process event
    store event_id

  8. Configure webhook endpoint for Agility Credit deliveries

    Webhook endpoints must meet the following technical requirements:

    • Protocol: HTTPS only
    • HTTP Method: POST
    • Content-Type: application/json
    • Encoding: UTF-8
    • Performance: Endpoints should respond within a few seconds. Heavy processing should be offloaded to background jobs or queues to avoid timeouts and unnecessary retries.

  9. Map Entra ID roles to Agility roles using Group Display Names

    Alternatively, you can use directory group membership for role assignment:

    1. In Entra's 'Attributes & Claims', click Add a group claim.
    2. Select Groups assigned to the application (recommended) or Security groups.
    3. Set the Source attribute to Cloud-only group display names (for cloud groups) or sAMAccountName (for on-prem AD-synced groups).
    4. Set the claim Name to groups.
    5. In Agility, use the From IdP groups role mapping. Note: If a group is renamed in Entra, the mapping will break.

  10. Secure Agility Credit webhook deliveries

    To ensure the security and authenticity of webhook events:

    1. Use HTTPS for all endpoints.
    2. Validate the HMAC signature provided in the X-Agc-Signature header (present if a secret is configured).
    3. Validate the X-Agc-Timestamp header to prevent replay attacks.
    4. Reject any malformed payloads.

  11. Recommended workflow for implementing custom SCIM integrations

    When building a custom SCIM client for Agility Credit, follow these implementation and testing steps to ensure correct configuration and attribute mapping:

    1. Enable Debugging: Enable SCIM on a test tenant and toggle Log successful events (debug). This ensures all GET requests and mutations are recorded for auditing.
    2. Verify Connectivity: Start by implementing a call to GET /ServiceProviderConfig. This single endpoint validates the authentication, Base URL, and Tenant ID.
    3. Test End-to-End Lifecycle: Execute a full user lifecycle flow: Create a user $\rightarrow$ PATCH a field $\rightarrow$ Deactivate $\rightarrow$ Reactivate (via a new POST) $\rightarrow$ Delete.
    4. Monitor Activity Logs: Use the Activity tab on the Identity page to inspect the method, path, status code, and full request/response bodies to diagnose attribute-mapping errors.
    5. Production Readiness: Disable the debug logging setting before moving to a live environment to maintain log readability.

  12. Configure Okta SSO using SAML 2.0

    To set up SAML 2.0 SSO between Okta and Agility Credit, follow these steps:

    1. Agility Setup: Navigate to Settings > Account > Identity and select SAML 2.0 on the SSO tab. Note the values in the SP Metadata panel.
    2. Okta App Creation: In Okta, go to Applications > Applications > Create App Integration, select SAML 2.0, and name the app Agility Credit.
    3. Okta SAML Configuration: Map the following fields using values from Agility's SP Metadata:
      • Single sign-on URL: Use the Agility ACS URL.
      • Recipient URL and Destination URL: Check the box to use the SSO URL for these.
      • Audience URI (SP Entity ID): Use the Agility SP Entity ID.
      • Name ID format: EmailAddress.
      • Application username: Email.
    4. Attribute Statements: Add the following claims in Okta to populate user records in Agility:
      • given_name $ ightarrow$ user.profile.firstName
      • family_name $ ightarrow$ user.profile.lastName
      • phone_number $ ightarrow$ user.profile.mobilePhone (Optional)
    5. Group Mapping (Optional): For 'From IdP groups' role mapping, add a Group Attribute Statement with Name groups, Name format Unspecified, and Filter Matches regex .*.
    6. Finalize Agility Config: In the Agility Identity page, paste the Okta Metadata URL and click Import (or manually enter the SSO URL, Issuer, and X.509 Certificate).
    7. Activation: Assign users/groups in Okta, click Test Connection in Agility, configure role mapping, toggle Enable SSO, and Save.