Read an application's sensitive values
The full Social Security, passport and alien registration numbers of every person on the application,
and the institution and account number of every bank account GET /assets returns, for document
validation that needs the whole value. Other routes return the last 4 characters at most, except
GET /applications/{applicationId}/full with sensitive: read, which returns the same values
encrypted the same way.
Every value is encrypted for the calling partner with the partner’s own secret: AES-256-GCM, key =
SHA-256 of the secret, Base64 of [IV 16 bytes][AuthTag 16 bytes][ciphertext]. Decrypt each value as
shown in Sensitive values. A value is null when Fortress has no usable value
for it. The response carries Cache-Control: no-store.
Join people[] to /customers by customerId and to /applications/{applicationId}/minors by
applicantId; join assets[] to /assets by assetId.
The API key must be enabled for sensitive values and Fortress must have given you your secret (403
otherwise).
Authenticate with the x-api-key header.
Authentication
Path parameters
Response headers
Always no-store.
Response
The bank accounts of the application’s asset checklists that have an institution or an account number on file, at the positions GET /assets returns.