Report the provider job id for an in-flight SDK verification
Records the provider’s own job identifier for a `provider_sdk` verification — the value the SDK received in its submission response. Call once, immediately after the SDK reports a successful submission. On this channel the SDK submits directly to the provider, so that response never reaches the server, and Smile ID’s V3 recovery endpoints (status lookup and webhook replay) accept only *their* job id — there is no way to resolve it from our own reference. Reporting it is what makes an SDK-submitted job recoverable when its result webhook is lost; without it the only outcome is expiry. Write-once: re-reporting the same id succeeds unchanged, a different id is a 409. Only valid while the verification is still ID_VERIFICATION_PENDING.
Authorization
Cowdi_Sales_KYC_backendBearerAuth Cowdi backend-compatible RS256 JWT. sub may be the global user id or a Firebase auth id; Firebase auth-id subjects and missing organization claims are resolved through the backend user/access endpoints. Validated against the configured JWKS (lib/backend-auth.ts).
In: header
Path Parameters
KYC application id.
uuidRequest Body
application/json
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X PATCH "https://example.com/v1/kyc/applications/497f6eca-6276-4993-bfeb-53cbbbba6f08/verification" \ -H "Content-Type: application/json" \ -d '{ "provider_job_id": "job_01h8x9y2z3a4b5c6d7e8f9g0h1" }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "status": "DRAFT", "can_submit": true, "needs_review": true, "message": "string"}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Stream KYC application updates (Server-Sent Events) GET
Opens an SSE stream for the caller’s current application (or the one named by `application_id`). Emits `application` events on every change, periodic `ping` keepalives, and a terminal `done` event once the application reaches a closed status.
Run the KYC stale-session expiry sweep for an organization POST
Runs the stale-session expiry sweep for the caller’s organization. The service also runs this job on its own schedule across every organization; this endpoint is the operator-triggered form, narrowed to one tenant. The sweep reconciles applications that have sat in ID_VERIFICATION_PENDING past the provider submission window: a job the provider reports as final is completed, and one the provider no longer knows about is moved to EXPIRED — nothing is expired without asking the provider first. Authenticated with an internal user’s backend bearer token and authorized against backend RBAC (accounts.write at ORG scope for the caller’s own organization, or PLATFORM). The organization is resolved from the token; passing organization_id is rejected. The run is held to the same interval as the scheduled one — there is no force bypass — and each organization has its own lease and due-window, so a manual run neither blocks nor is blocked by the global schedule.