What authentication does the Experian Data Quality API use?

The API uses OAuth2 with the client_credentials grant. POST /auth/oauth/v2/token exchanges your client_id and client_secret for a short-lived access token, which is then sent as Authorization: Bearer <token> on the address and credit endpoints. Through Jentic, client credentials sit in the vault and tokens are minted on demand.

Can I use POST /consumerservices/credit-profile/v2 without onboarding?

No. Consumer credit endpoints require Experian onboarding and a documented permissible purpose under FCRA in the US (or equivalent regulation in other regions). The address endpoints can typically be used by any client with credentials, but the credit profile endpoint is gated.

How do I add type-ahead address search?

Call GET /address/search/v1 with the partial input the user has typed and the target country code. The endpoint returns ranked candidate addresses, and once the user selects one you call POST /address/validate/v1 to lock the standardised result.

How do I validate an address through Jentic?

Run pip install jentic, then search 'validate an address with experian', load the POST /address/validate/v1 operation, and execute it with the address payload. Jentic obtains and refreshes the OAuth2 access token automatically using the client credentials in the vault.

What are the rate limits for the Experian Data Quality API?

Rate limits are not published in this spec. They are governed by the contract you sign with Experian and vary by product (address vs credit) and tier. Treat 429 responses with Retry-After as authoritative and back off accordingly.

Can I limit what my agent is allowed to do with the Experian Data Quality API?

Yes. Because you run Jentic One yourself, your own rules decide which Experian operations your agent may call, so you can allow only what a given workflow needs, such as POST /address/validate/v1 and GET /address/search/v1 for address capture. Since Experian carries its targets in the request body, the sensitive POST /consumerservices/credit-profile/v2 operation stays outside the allowed set unless you explicitly add it. The OAuth2 token exchange at POST /auth/oauth/v2/token runs with credentials your instance holds, and those credentials are injected only for the operations you have permitted.