The active policy versions, with their full text

GET

/policies/current

const url = 'https://api.tovarifinancial.com/policies/current?locale=en';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.tovarifinancial.com/policies/current?locale=en'

UNAUTHENTICATED by design: this is the document a caller must be able to READ in order to accept it, so gating it behind acceptance would deadlock. Returns every currently-active version ordered by policy type. There is no org scoping — policy text is global. LANGUAGE (KAN-3835): while the Spanish rollout flag (SPANISH_LOCALE_ENABLED) is off, the locale query parameter and the X-Client-Locale header are not read and no locale field is returned. While it is on, the language is a valid locale parameter, else X-Client-Locale, else en; an invalid value falls back and is never a 400. The answer is still exactly one row per active policy version: that language’s courtesy translation when one exists, otherwise the governing English row, with effectiveDate always from the English row. The English version governs. The returned id is the one to send to POST /auth/accept-policies, which records the language of the row accepted.

Parameters

Query Parameters

locale

string

Allowed values: en es

The display language to serve: ‘en’ or ‘es’. Read only while the Spanish rollout flag is on; any other value is ignored (never a 400).

Responses

200

Every active policy version

application/json

object

data

required

object

policies

required

Array<object>

object

required

string format: uuid

policyType

required

E.g. terms_of_service, privacy_policy. An OPEN vocabulary — a new policy type ships without a client change.

string

version

required

integer

title

required

string

content

required

The full policy text.

string

effectiveDate

required

Calendar date, ‘YYYY-MM-DD’

string

locale

The language of this row (KAN-3835). Present only while the Spanish rollout flag is on.

string

Allowed values: en es

message

string

requestId

required

string

timestamp

required

string format: date-time

Example

{
  "data": {
    "policies": [
      {
        "locale": "en"
      }
    ]
  }
}

500

Internal error (no internal detail leaked)

application/json

object

errorCode

required

Machine-readable error code (AUTH_ERROR_CODES).

string

Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND

message

required

string

fieldErrors

Optional field-level validation errors, keyed by field name.

object

key

additional properties

Array<string>

requestId

required

string

timestamp

required

string format: date-time

Example

{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

503

Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.

application/json

object

errorCode

required

Machine-readable error code (AUTH_ERROR_CODES).

string

message

required

string

fieldErrors

Optional field-level validation errors, keyed by field name.

object

key

additional properties

Array<string>

requestId

required

string

timestamp

required

string format: date-time

Example

{
  "errorCode": "INVALID_EMAIL_FORMAT"
}