Start a provider verification session
Deprecated
Deprecated — use POST /applications/{id}/verification with channel: "provider_sdk". Kept as a thin alias over the same engine. Creates an identity-verification session with the active provider and moves the application to ID_VERIFICATION_PENDING. When Smile ID reports the merchant is already enrolled, the session is a SmartSelfie Authentication (config.mode = "authentication") that re-verifies the person against their enrolled face. Answers with a Deprecation header and a Link to the Versions page.
Authorization
oauth2 Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.
In: header
Path Parameters
KYC application id.
uuidHeader Parameters
Comma-separated Smile ID API versions this client’s bundled SDK can run, newest last or in any order (e.g. v2, v3). The job is started on the newest version listed that the server also speaks, and that version is pinned for the life of the job. Omitted, empty or unrecognised means v2 — so a client only upgrades when it says it can. Send the same value to the requirements GET and the verification POST: they resolve the version independently, and disagreeing between the two gets the capture rejected.
Request Body
application/json
Optional body for starting a provider_sdk verification session.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/kyc/applications/550e8400-e29b-41d4-a716-446655440000/session" \ -H "Content-Type: application/json" \ -d '{}'{ "application_id": "48ac72d0-a829-4896-a067-dcb1c2b0f30c", "provider": "SMILE_ID", "config": { "property1": null, "property2": null }}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Review an application awaiting manual review POST
Privileged reviewer action on an application in PENDING_MANUAL_REVIEW. `approve` moves it to APPROVED; `reject` moves it to REJECTED; `request_resubmission` returns it to DRAFT so the applicant can re-run verification. `approve` is accepted only when the merchant subject carries every identity field backend onboarding requires (name, date_of_birth, gender, id_number, phone) — a failed document read extracts none of them, so the reviewer fills the gaps via the internal subject editor first; otherwise the approve is rejected with 409 listing the missing fields. Org-scoped (not owner-scoped) and gated on the WorkOS `org:kyc.override:write` permission, checked on the caller organization (override with KYC_REVIEWER_PERMISSION).
Get an application’s status GET
Returns the application status plus derived flags. Recovers stale provider state before responding.