Get the caller’s current KYC application
Returns the authenticated user’s most recent KYC application. For members of self-onboarding partner organizations (greenwheels), a first retrieval with no application provisions the merchant prospect and an INDIVIDUAL application instead of returning 404. Only partner-exchanged member sessions qualify: the token must carry token_source=PARTNER_EXCHANGE and the partner-side member id (organization_user_id), with no role claim (or CUSTOMER). Admin/backoffice and organization-switch sessions are never provisioned.
Authorization
Cowdi_Sales_KYC_backendBearerAuth Cowdi backend-compatible RS256 JWT. sub may be the global user id or a Firebase auth id; Firebase auth-id subjects and missing organization claims are resolved through the backend user/access endpoints. Validated against the configured JWKS (lib/backend-auth.ts).
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/kyc/applications/current"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "organization_id": "string", "user_type": "INDIVIDUAL", "merchant_type": "SOLE_PROPRIETOR", "status": "DRAFT", "source": "string", "documents": [ { "id": "string", "document_type": "string", "document_sub_type": "string", "document_number": "string", "expiry_date": "string", "presigned_url": "string", "uploaded_at": "2026-06-04T10:20:00.000Z" } ], "verification": { "provider": "string", "provider_job_id": "string", "result": "string", "confidence_score": 0, "completed_at": "2026-06-04T10:20:00.000Z" }, "verification_reason_code": "string", "verification_reason": "string", "resubmission_count": 0, "force_new_enroll": true, "reapply_blocked_until": "2026-06-04T10:20:00.000Z", "rejection_reason": "string", "submitted_at": "2026-06-04T10:20:00.000Z", "created_at": "2026-06-04T10:20:00.000Z", "updated_at": "2026-06-04T10:20:00.000Z"}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Look up a user’s KYC subject details (service-to-service) GET
Internal endpoint for backend services. The /v1/internal/kyc form is available on the shared API host; the /api/internal/kyc form remains available for cluster-local service calls. Authenticated with either a backend user bearer token or an org-scoped Cowdi API key; returns the full identity and document payload for a KYC subject (ID and selfie images inlined as base64), used to submit a Choice Bank onboarding during current-account self-activation. A platform (cowdi) API key with PLATFORM-scoped access may pass organization_id to scope the lookup to another tenant. Returns 404 when the user has no provisioned subject yet.
Get what the client must capture (deprecated) GET
Deprecated — use GET /applications/{id}/verification, which returns the same payload. Returns what to capture for the active provider — whether a selfie, liveness frames (`requires_liveness`), and/or a document are required, and the backend-owned catalogue of supported documents (country + id types, each with `has_back`). Side-effect-free: the application stays in its current status, so the client fetches this before capturing and renders its document picker from it (no hard-coded document types).