curl --request POST \
--url https://platform.spritz.finance/v1/ach-debit/eligibility \
--header 'Content-Type: application/json' \
--header 'X-Integrator-Key: <api-key>' \
--header 'X-Signature: <api-key>' \
--header 'X-Timestamp: <api-key>' \
--data '
{
"email": "user@example.com"
}
'import requests
url = "https://platform.spritz.finance/v1/ach-debit/eligibility"
payload = { "email": "user@example.com" }
headers = {
"X-Signature": "<api-key>",
"X-Integrator-Key": "<api-key>",
"X-Timestamp": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Signature': '<api-key>',
'X-Integrator-Key': '<api-key>',
'X-Timestamp': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({email: 'user@example.com'})
};
fetch('https://platform.spritz.finance/v1/ach-debit/eligibility', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://platform.spritz.finance/v1/ach-debit/eligibility",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'user@example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Integrator-Key: <api-key>",
"X-Signature: <api-key>",
"X-Timestamp: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.spritz.finance/v1/ach-debit/eligibility"
payload := strings.NewReader("{\n \"email\": \"user@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Signature", "<api-key>")
req.Header.Add("X-Integrator-Key", "<api-key>")
req.Header.Add("X-Timestamp", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/ach-debit/eligibility")
.header("X-Signature", "<api-key>")
.header("X-Integrator-Key", "<api-key>")
.header("X-Timestamp", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"user@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://platform.spritz.finance/v1/ach-debit/eligibility")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"user@example.com\"\n}"
response = http.request(request)
puts response.read_body{
"eligible": true
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}{
"title": "Unauthorized",
"status": 401,
"type": "urn:problem-type:auth:unauthorized",
"detail": "Bearer token required",
"instance": "<string>",
"realm": "API",
"scope": "read:users"
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}Check ACH debit eligibility
Once an email is eligible, it remains eligible. While ACH debit is temporarily halted or paused for new users, the answer is false, even for an email that was eligible before, and nothing is recorded. A false response may be transient, so re-check rather than caching it. Call this endpoint before showing a bank deposit option. Once the user exists, the capabilities returned by GET /v1/users/me remain the source of truth.
curl --request POST \
--url https://platform.spritz.finance/v1/ach-debit/eligibility \
--header 'Content-Type: application/json' \
--header 'X-Integrator-Key: <api-key>' \
--header 'X-Signature: <api-key>' \
--header 'X-Timestamp: <api-key>' \
--data '
{
"email": "user@example.com"
}
'import requests
url = "https://platform.spritz.finance/v1/ach-debit/eligibility"
payload = { "email": "user@example.com" }
headers = {
"X-Signature": "<api-key>",
"X-Integrator-Key": "<api-key>",
"X-Timestamp": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Signature': '<api-key>',
'X-Integrator-Key': '<api-key>',
'X-Timestamp': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({email: 'user@example.com'})
};
fetch('https://platform.spritz.finance/v1/ach-debit/eligibility', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://platform.spritz.finance/v1/ach-debit/eligibility",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'email' => 'user@example.com'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Integrator-Key: <api-key>",
"X-Signature: <api-key>",
"X-Timestamp: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.spritz.finance/v1/ach-debit/eligibility"
payload := strings.NewReader("{\n \"email\": \"user@example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Signature", "<api-key>")
req.Header.Add("X-Integrator-Key", "<api-key>")
req.Header.Add("X-Timestamp", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/ach-debit/eligibility")
.header("X-Signature", "<api-key>")
.header("X-Integrator-Key", "<api-key>")
.header("X-Timestamp", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"email\": \"user@example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://platform.spritz.finance/v1/ach-debit/eligibility")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"email\": \"user@example.com\"\n}"
response = http.request(request)
puts response.read_body{
"eligible": true
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}{
"title": "Unauthorized",
"status": 401,
"type": "urn:problem-type:auth:unauthorized",
"detail": "Bearer token required",
"instance": "<string>",
"realm": "API",
"scope": "read:users"
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}Authorizations
HMAC signature authentication for backend integrators.
Required Headers:
- X-Integrator-Key: Integrator API key (format: ik_...)
- X-Signature: HMAC signature (format: sha256={hex})
- X-Timestamp: Unix timestamp in milliseconds
- Authorization: Bearer {user-api-key}
Signature Algorithm: HMAC-SHA256
Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}
- timestamp: Unix timestamp in milliseconds
- METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
- path: Request path (e.g., /v1/transactions)
- bodyHash: SHA256 hex digest of request body (empty string if no body)
Timestamp Tolerance: ±5 minutes (300 seconds)
Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...
Integrator API key (format: ik_...) used with HMAC authentication
Unix timestamp in milliseconds for request freshness. Must be within 5 minutes of server time. The timestamp alone bounds but does not prevent an exact replay within that window. Use Idempotency-Key on supported mutations.
Body
Email address of the prospective Spritz user
"user@example.com"
Response
Response for status 200
Whether the bank deposit option is available for this email address