Developer Docs
WebsiteDashboard
GuidesAPI ReferenceHelp
PaymentProvider KYC

Create an IDV session

POST
/openapi/v1/customers/provider-kyc/rfis/{rfiId}/questions/{questionId}/idv-session

Creates an identity verification session for an IDV question of an RFI waiting for answers.

  • If the RFI is not ACTION_REQUIRED, provider_kyc.rfi.not_actionable is returned. If the question is not an IDV question of this RFI, provider_kyc.rfi.question_not_idv is returned.
  • url is a one-time session link. Give it only to the person who completes the verification. Do not log or forward it.
  • After the verification, still submit this question with the full RFI.

Authorization

bearerAuth
headerAuthorizationBearer <token>

The access_token obtained from POST /oauth2/token. Header format: Authorization: Bearer {accessToken}.

Path Parameters

rfiId*string

RFI ID assigned by the provider.

questionId*string

ID of the IDV question.

Query Parameters

customerUid*string

UID that the caller defines for the customer. Submitting KYB creates it at the provider.

Header Parameters

X-Channel-Provider*string

Provider identifier. Provider KYC supports only LEGEND now.

Response Body

The IDV session.

application/json
  1. response
code?integer

Business status code

message?string
traceId?string

Request trace ID. Provide it when you contact technical support

data?
Example Request
curl -X POST 'https://api.test.stabofx.com/openapi/v1/customers/provider-kyc/rfis/rfc_xxx/questions/rfq_idv/idv-session?customerUid=cust_example_001' \  -H 'X-Channel-Provider: LEGEND'
Example Response
{  "code": 200,  "message": "OK",  "traceId": "trace-uuid-string",  "data": {    "url": "https://idv.example.com/session/xxx"  }}

Get an RFI GET

Gets one RFI with its questions.

Submit RFI answers POST

Submits the answers to all questions of an RFI waiting for answers. The request is `multipart/form-data`. The `data` part is the JSON answers. Each other part is one file, and its part name equals a value in `answers[].clientFileIds`. - If the RFI is already under review (`UNDER_REVIEW`), the current status is returned. Nothing is written and there is no `submittedAt`. - `Idempotency-Key` is required. Reuse the original key when you retry the same submission. The provider does not accept it twice. - Acceptance is not approval and does not lift `restrictions`. - Stabo checks only that required fields are not empty, the safe characters of `clientFileId`, the file part match, and file size and type. The provider decides question ownership, required questions, length, file count, and selected values. A failure returns `openapi.channel.rejected`. For the answer format of each question type, see [Provider KYC and account opening](/en/docs/guide/provider-kyc#submit-rfi-answers).