> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Read a worker's consignable FGTS balance > Proxies consultar-saldo-fgts (Manual 002 §3.4): the worker's consignable FGTS balance and rescission-penalty portion, the SOURCE of the collateral values an averbação or an auction bid carries. POST, not GET, because the read is consent-gated: the worker's grupo-1 authorization evidence is a nested object and the CPF must never appear in a path or query string. The consent token the gateway mints or reuses is never returned. Money is a decimal string, never a float. CONSENT WINDOW (Manual 002 v1.15 §5.6). dataHoraAutorizacaoDigital starts two clocks, measured in calendar days from the worker's signature: the authorization may be CONSULTED for 30 days, and a request may be MADE against it for 45. Both boundaries are INCLUSIVE — the instant exactly 30 or 45 days after the signature is still inside its window, and only the next nanosecond is outside. Outside either window the gateway refuses LOCALLY, before a byte reaches the rail: 422 with code MYS-0006 and a detail telling you to obtain a fresh worker authorization. THAT REFUSAL IS NOT RETRYABLE. Repeating the request performs the very read the lapsed authorization withdrew; only new authorization evidence makes it succeed. A dataHoraAutorizacaoDigital carrying a non-UTC offset, or dated ahead of the gateway's clock, is the same 422 with a different detail — correct the timestamp; the worker's consent is not in question. Contrast the rail's OWN consent rejection (Dataprev EX/IV on a stale tokenAutorizacao): that is 503 and IS retryable, because the gateway drops the cached token and the next attempt opens a fresh consent from the same evidence. ## OpenAPI ````yaml en/openapi/v3-current/consignado.yaml post /v1/consignado/fgts/saldo openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian Consignado — Dataprev. The API covers tenant credentials and rail configuration, worker margin, loan auctions and bids, contract registration and lifecycle, disbursement confirmation, portability, refinancing, renegotiation, FGTS guarantees, reconciliation, funds, assignments, usage, throughput, and event subscriptions. Secret material is written to the tenant secret store and is never returned by any operation. license: name: Lerian Studio General License title: Lerian Consignado API version: v1.0.0 servers: - url: https://consignado.sandbox.lerian.net security: - BearerAuth: [] tags: - description: >- Per-tenant Dataprev credential custody and public rail configuration (upload, status, rotation, revoke, requester code, and worker portal base URL) name: Credentials - description: >- Tenant-scoped consignado gateway usage: priced billable-unit aggregation per competência name: Consignado Usage - description: >- Per-tenant streaming-hub subscription control-plane (list, create, get, rotate, revoke, and test delivery) name: Subscriptions - description: >- Dataprev payroll-rail surface: FGTS balance and authorization reads, the FGTS guarantee execution, contract suspension, reactivation and term changes, the rail's own contract documents, and the on-demand reads of leilão solicitações, escriturações, repasses and employment terminations name: Consignado Rail - description: >- Synchronous rail command surface: the operations a bancarizador without the lender drives over HTTP. Each shares its command implementation with the equivalent lender event trigger. name: Consignado Rail Commands - description: >- Gateway-owned disbursement confirmation: a client bank recording money it has ALREADY paid to a worker. It crosses no government boundary and proxies no Dataprev operation. name: Consignado Disbursement - description: >- Per-tenant self-service outbound Dataprev rail throughput: read and set this tenant's own requests-per-second, including a deliberate pause at zero name: Consignado Throughput paths: /v1/consignado/fgts/saldo: post: tags: - Consignado Rail summary: Read a worker's consignable FGTS balance description: >- Proxies consultar-saldo-fgts (Manual 002 §3.4): the worker's consignable FGTS balance and rescission-penalty portion, the SOURCE of the collateral values an averbação or an auction bid carries. POST, not GET, because the read is consent-gated: the worker's grupo-1 authorization evidence is a nested object and the CPF must never appear in a path or query string. The consent token the gateway mints or reuses is never returned. Money is a decimal string, never a float. CONSENT WINDOW (Manual 002 v1.15 §5.6). dataHoraAutorizacaoDigital starts two clocks, measured in calendar days from the worker's signature: the authorization may be CONSULTED for 30 days, and a request may be MADE against it for 45. Both boundaries are INCLUSIVE — the instant exactly 30 or 45 days after the signature is still inside its window, and only the next nanosecond is outside. Outside either window the gateway refuses LOCALLY, before a byte reaches the rail: 422 with code MYS-0006 and a detail telling you to obtain a fresh worker authorization. THAT REFUSAL IS NOT RETRYABLE. Repeating the request performs the very read the lapsed authorization withdrew; only new authorization evidence makes it succeed. A dataHoraAutorizacaoDigital carrying a non-UTC offset, or dated ahead of the gateway's clock, is the same 422 with a different detail — correct the timestamp; the worker's consent is not in question. Contrast the rail's OWN consent rejection (Dataprev EX/IV on a stale tokenAutorizacao): that is 503 and IS retryable, because the gateway drops the cached token and the next attempt opens a fresh consent from the same evidence. operationId: readConsignadoFgtsSaldo requestBody: content: application/json: schema: $ref: '#/components/schemas/FgtsSaldoRequestBody' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/FgtsSaldoResponse' description: OK default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: FgtsSaldoRequestBody: additionalProperties: false properties: authorization: $ref: '#/components/schemas/ConsentAuthorizationBody' description: >- Worker grupo-1 digital-authorization evidence used to open or reuse the data-consult consent. codigoInscricaoEmpregador: description: >- Employer inscription type. Manual 003 §3.1.1 p.10 and Manual 002 §3.3.1 p.14 publish exactly two codes: 1 = CNPJ, 2 = CPF. enum: - '1' - '2' examples: - '1' type: string cpf: description: >- Worker CPF, exactly 11 digits (Manual 002 §3.2.2 p.12: Número, 11 algarismos). In the BODY, never a path or query parameter. examples: - '99999999999' pattern: ^[0-9]{11}$ type: string matricula: description: Employment registration at the employer. examples: - 99999999999-A minLength: 1 type: string numeroInscricaoEmpregador: description: Employer inscription number matching codigoInscricaoEmpregador. examples: - '42422253000101' minLength: 1 type: string required: - cpf - matricula - codigoInscricaoEmpregador - numeroInscricaoEmpregador - authorization type: object FgtsSaldoResponse: additionalProperties: false properties: dataHoraConsulta: description: >- Instant the rail computed the balance, RFC 3339 UTC. It is the balance's as-of moment, not the moment you called. examples: - '2026-07-30T12:00:00Z' format: date-time type: string valorMultaRescisoriaConsignado: description: Rescission-penalty portion (decimal string, BRL). examples: - '400.25' type: string valorSaldoDisponivelConsignado: description: Consignable FGTS balance (decimal string, BRL). examples: - '1000.50' type: string required: - dataHoraConsulta - valorSaldoDisponivelConsignado - valorMultaRescisoriaConsignado type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). examples: - ERR-0001 type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ConsentAuthorizationBody: additionalProperties: false properties: canalAutorizacaoDigital: description: >- Digital authorization channel. Published enumeration (Manual 002 §3.1.1 p.9): 1 = ATM, 2 = Agência, 3 = Web Cliente, 4 = Web Correspondente, 5 = Mobile. enum: - '1' - '2' - '3' - '4' - '5' examples: - '2' type: string dataHoraAutorizacaoDigital: description: >- Instant the worker authorized, RFC 3339. Rendered to the rail's ddMMyyyyHHmmss by the adapter. examples: - '2025-05-14T10:00:00Z' format: date-time type: string nsuAutorizacaoDigital: description: >- Unique sequential number of the authorization (Número, up to 19 digits). Kept as digits end to end — 19 digits overflow a signed 64-bit integer at the top of the range. examples: - '1234567890123456789' pattern: ^[0-9]{1,19}$ type: string required: - canalAutorizacaoDigital - dataHoraAutorizacaoDigital - nsuAutorizacaoDigital type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ````