Look up a user’s KYC subject details (service-to-service)
Internal endpoint for backend services. The /v1/internal/kyc form is available on the shared API host; the /api/internal/kyc form remains available for cluster-local service calls. Authenticated with either a backend user bearer token or an org-scoped Cowdi API key; returns the full identity and document payload for a KYC subject (ID and selfie images inlined as base64), used to submit a Choice Bank onboarding during current-account self-activation. A platform (cowdi) API key with PLATFORM-scoped access may pass organization_id to scope the lookup to another tenant. Returns 404 when the user has no provisioned subject yet.
Cowdi backend-compatible RS256 JWT. sub may be the global user id or a Firebase auth id; Firebase auth-id subjects and missing organization claims are resolved through the backend user/access endpoints. Validated against the configured JWKS (lib/backend-auth.ts).
In: header
Query Parameters
Global user id (JWT sub) to look up.
uuidTarget organization to scope the lookup to. Honored only for a platform (cowdi) API key holding PLATFORM-scoped access; every other caller resolves the organization from its bearer token and must omit this parameter (otherwise 400/403).
1 <= lengthResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/internal/kyc/subject?user_id=497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "subject_id": "string", "first_name": "string", "last_name": "string", "birthday": "1990-05-21", "gender": "MALE", "country_code": "KE", "mobile": "string", "id_type": "NATIONAL_ID", "id_number": "string", "front_side_photo": "string", "back_side_photo": "string", "selfie_photo": "string", "email": "string", "kra_pin": "string", "address": "string"}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Look up a user’s KYC status (admin) GET
Internal KYC status endpoint for backend, backoffice, and onboarding orchestration. The /v1/internal/kyc form is exposed on the shared API host; the /api/internal/kyc form remains available for cluster-local service calls. Authenticated with either a backend user bearer token or an org-scoped Cowdi API key; returns the backend-compatible status DTO for a user. A platform (cowdi) API key with PLATFORM-scoped access may pass organization_id to scope the lookup to another tenant.
Get the caller’s current KYC application GET
Returns the authenticated user’s most recent KYC application. For members of self-onboarding partner organizations (greenwheels), a first retrieval with no application provisions the merchant prospect and an INDIVIDUAL application instead of returning 404. Only partner-exchanged member sessions qualify: the token must carry token_source=PARTNER_EXCHANGE and the partner-side member id (organization_user_id), with no role claim (or CUSTOMER). Admin/backoffice and organization-switch sessions are never provisioned.