---
title: "Inspect documented access paths for exact deposit products"
method: POST
path: "/v1/eligibility/access-envelopes"
tags: ["Reference Data"]
---

# Inspect documented access paths for exact deposit products

`POST /v1/eligibility/access-envelopes`

## Request

- Base URL: `https://api.rateapi.dev`
- URL: `https://api.rateapi.dev/v1/eligibility/access-envelopes`
- Auth: API key in header `X-API-Key`

Returns non-personal membership-access metadata and current rate evidence for up to 50 exact product references. Only source-proven open paths and associations explicitly documented as joinable by anyone become actions; missing evidence stays unavailable. This is not a personal eligibility verdict or an account-opening guarantee.

**Authentication required**: Pass your API key in the `X-API-Key` header.

## Request body

- object
  - `products` object[], required: Exact deposit product references; this surface performs no fuzzy product matching.
    - `credit_union_id` string, required: Stable credit-union identifier from a RateAPI product result.
    - `product_type` 'savings' | 'cd' | 'share_certificate' | 'money_market' | 'ira_cd' | 'ira' | 'share_savings', required: Exact deposit product family.
    - `product_name` string, required: Verbatim product identity from the published rate result.
    - `term_months` integer: Exact requested term when the product is term-bearing.
    - `balance` number: Optional requested balance used to report fit with published bounds.
    - `audience` 'consumer' | 'business': Optional requested audience used to report fit with the published product.

## Response `200`

Evidence-bound, non-personal access and product-rate envelopes.

- object
  - `envelopes` object[], required: Order-preserving evidence envelopes for the exact requested products.
  - `counts` object, required: Deduplicated counts of requested products, current rates, access-path kinds, and documented joinable actions.
  - `semantics` string, required: Non-personal evidence-envelope semantics; no personal eligibility decision is made.
  - `disclosure` string, required: Required limits on interpreting product access, fit, and availability.

## Other responses

- `400`: The request was malformed — a missing required field, an unparseable body, or a parameter outside its allowed range. The `error` field names what was wrong; retrying the identical request will fail identically.
- `401`: No API key, or a key that is unknown or disabled. Send it in the `X-API-Key` header. Free keys are issued instantly by POST /keys with an email address. The response carries `WWW-Authenticate` pointing at this host's protected-resource metadata, and the `RateLimit-*` headers describing the Free-tier budget a key issued now would carry (scope `anonymous`) — a rejected request spends none of it, so `Remaining` equals `Limit`.
- `402`: The key is valid, but RateAPI Routes is available only on Enterprise. The response includes `required_plan`, `upgrade_url`, and a `Link` header with `rel="upgrade"`; the rejected request does not consume quota.
- `429`: Quota exhausted for the current window. `Retry-After` gives the seconds to wait; `upgradeInfo` explains how to lift the cap. Retrying before the reset will fail again and still counts as a request.

---

[API](https://skmtc.dev/rateapi/apis/rate-api.md) · [All operations](https://skmtc.dev/rateapi/apis/rate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rateapi/apis/rate-api/revisions/06a6db76995f?raw)