List RFIs
Lists the requests for information (RFIs) the provider raised for the customer. The list does not include questions. Get an RFI to see them.
bearerAuthAuthorizationBearer <token>The access_token obtained from POST /oauth2/token. Header format: Authorization: Bearer {accessToken}.
customerUid*stringUID that the caller defines for the customer. Submitting KYB creates it at the provider.
status?stringACTIVE returns only RFIs waiting for answers. ALL includes finished ones. The default is ALL.
"ALL""ACTIVE""ALL"X-Channel-Provider*stringProvider identifier. Provider KYC supports only LEGEND now.
The RFI list.
application/json- response
code?integerBusiness status code
message?stringtraceId?stringRequest trace ID. Provide it when you contact technical support
data?array<>curl -X GET 'https://api.test.stabofx.com/openapi/v1/customers/provider-kyc/rfis?customerUid=cust_example_001' \ -H 'X-Channel-Provider: LEGEND'{ "code": 200, "message": "OK", "traceId": "trace-uuid-string", "data": [ { "rfiId": "rfc_xxx", "customerUid": "cust_example_001", "status": "ACTION_REQUIRED", "restrictions": [ "swap", "fiat_withdrawal" ], "expiresAt": "2026-11-20T00:00:00+08:00", "updatedAt": "2026-11-10T10:00:00+08:00" } ]}Submit KYB POST
Submits or resubmits the customer's entity KYC to the provider. The first submission creates the customer at the provider. The request is `multipart/form-data`. The `data` part is the JSON data. Each other part is one file, and its part name equals a `documents[].clientFileId`. File parts and `clientFileId` values must match one to one. - If the provider already accepted a submission (`SUBMITTED` or `APPROVED`), the current status is returned. No data is written and there is no `submittedAt`. - `Idempotency-Key` is required. It links the request for audit. After a timeout, retry with the same data and the original key. - Depending on the number of files, the request can take more than 30 seconds. Set the client timeout to at least 60 seconds. - Stabo runs only the minimum checks to build the provider request and keep it safe: required fields are not empty, `data` has no unknown fields, `personId` and `clientFileId` do not repeat, file parts match, one file is at most 2 MB, and the file header is PDF, PNG, or JPEG. - The provider decides field formats, values, the number of persons per role, required files, and other rules. A failure returns `openapi.channel.rejected`. Lengths and values in the field descriptions are provider rules, checked by the provider. For a full example, see [Provider KYC and account opening](/en/docs/guide/provider-kyc#submit-kyb).
Get an RFI GET
Gets one RFI with its questions.