---
title: "Guardrail checks over a scenario + recommendation"
method: POST
path: "/v1/advice-guardrails"
tags: ["Data & Analytics"]
---

# Guardrail checks over a scenario + recommendation

`POST /v1/advice-guardrails`

## Request

- Base URL: `https://api.rateapi.dev`
- URL: `https://api.rateapi.dev/v1/advice-guardrails`
- Auth: API key in header `X-API-Key`

Pure-computation guardrail checks over a scenario and an optional recommendation. Returns red/yellow flags (DTI strain, long auto term / negative-equity risk, possible balloon structure, stale market data), generic disclaimers, and an overall ok/caution/stop verdict. This route is the single source of truth; the MCP `check_advice_guardrails` tool calls it.

**Authentication required**: Pass your API key in the `X-API-Key` header.

## Request body

- object
  - `scenario` object, required: The borrower’s financial position, which the recommendation is checked against.
    - `product_type` 'auto_loan' | 'mortgage' | 'heloc' | 'personal_loan' | 'student_loan' | 'credit_card', required: Loan or deposit product this applies to.
    - `state` string, required: Two-letter US state code.
    - `intent` string: What the borrower is trying to do — for example purchase or refinance.
    - `amount` number: Loan amount in US dollars.
    - `term_months` integer: Loan term in months.
    - `credit_score` integer: Borrower FICO score used to scope which offers apply.
    - `monthly_income` number: Gross monthly income in US dollars.
    - `monthly_debt` number: Existing monthly debt payments in US dollars, excluding the loan being considered.
  - `recommendation` object: The recommendation to check — typically an action returned by a decision endpoint.
    - `rate` number: Note rate as an annual percentage, excluding fees.
    - `apr` number: Annual percentage rate, which includes fees and is the figure offers are ranked on.
    - `monthly_payment` number: Monthly principal-and-interest payment in US dollars.

## Response `200`

Guardrail flags, disclaimers, and overall verdict.

- object
  - `flags` object[]: Everything about the recommendation that warrants a warning.
    - `level` 'red' | 'yellow': How serious the flag is: `red` should stop the recommendation, `yellow` should qualify it.
    - `code` string: Stable machine-comparable identifier for the flag, so it can be handled without parsing prose.
    - `message` string: Human-readable detail about this result.
  - `disclaimers` string[]: Statements that must accompany this recommendation.
  - `overall` 'ok' | 'caution' | 'stop': The combined verdict: `ok` when nothing flagged, `caution` on yellow flags alone, `stop` when any red flag fired.

## Other responses

- `400`: The request was malformed — a missing required field, an unparseable body, or a parameter outside its allowed range. The `error` field names what was wrong; retrying the identical request will fail identically.
- `401`: No API key, or a key that is unknown or disabled. Send it in the `X-API-Key` header. Free keys are issued instantly by POST /keys with an email address. The response carries `WWW-Authenticate` pointing at this host's protected-resource metadata, and the `RateLimit-*` headers describing the Free-tier budget a key issued now would carry (scope `anonymous`) — a rejected request spends none of it, so `Remaining` equals `Limit`.
- `429`: Quota exhausted for the current window. `Retry-After` gives the seconds to wait; `upgradeInfo` explains how to lift the cap. Retrying before the reset will fail again and still counts as a request.

---

[API](https://skmtc.dev/rateapi/apis/rate-api.md) · [All operations](https://skmtc.dev/rateapi/apis/rate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rateapi/apis/rate-api/revisions/06a6db76995f?raw)