Developer Docs
WebsiteDashboard
GuidesAPI ReferenceHelp
PaymentProvider KYC

Submit KYB

POST
/openapi/v1/customers/provider-kyc

Submits or resubmits the customer's entity KYC to the provider. The first submission creates the customer at the provider.

The request is multipart/form-data. The data part is the JSON data. Each other part is one file, and its part name equals a documents[].clientFileId. File parts and clientFileId values must match one to one.

  • If the provider already accepted a submission (SUBMITTED or APPROVED), the current status is returned. No data is written and there is no submittedAt.
  • Idempotency-Key is required. It links the request for audit. After a timeout, retry with the same data and the original key.
  • Depending on the number of files, the request can take more than 30 seconds. Set the client timeout to at least 60 seconds.
  • Stabo runs only the minimum checks to build the provider request and keep it safe: required fields are not empty, data has no unknown fields, personId and clientFileId do not repeat, file parts match, one file is at most 2 MB, and the file header is PDF, PNG, or JPEG.
  • The provider decides field formats, values, the number of persons per role, required files, and other rules. A failure returns openapi.channel.rejected.

Lengths and values in the field descriptions are provider rules, checked by the provider. For a full example, see Provider KYC and account opening.

Authorization

bearerAuth
headerAuthorizationBearer <token>

The access_token obtained from POST /oauth2/token. Header format: Authorization: Bearer {accessToken}.

Header Parameters

X-Channel-Provider*string

Provider identifier. Provider KYC supports only LEGEND now.

Idempotency-Key*string

Unique request identifier, at most 128 characters. Reuse the original key when you retry the same submission. If it is missing, error.idempotent.key.missing is returned.

Request Body

multipart/form-data
  1. body

The data part plus file parts. The part name of each file part equals one documents[].clientFileId.

data*

KYB data, sent as the multipart data part. Unknown fields are rejected.

[key: string]?unknown

File content. The part name is the clientFileId. One file is at most 2 MB. Only PDF, PNG, and JPEG.

Response Body

The submit result. Get the review result from the query endpoint or the provider.kyc.* Webhooks.

application/json
  1. response
code?integer

Business status code

message?string
traceId?string

Request trace ID. Provide it when you contact technical support

data?

Submit result.

Example Request
curl -X POST 'https://api.test.stabofx.com/openapi/v1/customers/provider-kyc' \  -H 'X-Channel-Provider: LEGEND' \  -H 'Idempotency-Key: 5f0c7b2e-1d3a-4c8e-9b6f-2a4d6e8f0a1c' \  -F 'data={  "customerUid": "cust_example_001",  "company": {    "phone": {},    "registeredAddress": {},    "businessAddress": {}  },  "business": {},  "questionnaire": {},  "persons": [    {      "personId": "p1",      "roles": [        "REPRESENTATIVE"      ],      "phone": {},      "residentialAddress": {}    }  ],  "documents": [    {      "clientFileId": "business-address",      "type": "INCORPORATION"    }  ]}' \  -F 'property1=null' \  -F 'property2=null'
Example Response
{  "code": 200,  "message": "OK",  "traceId": "trace-uuid-string",  "data": {    "customerUid": "cust_example_001",    "status": "SUBMITTED",    "submittedAt": "2026-11-09T17:36:21.687+08:00"  }}

Get KYC status GET

Gets the customer's KYC status at the provider. It is not the Stabo platform KYC status. - `providerCustomerId` can be empty while `SUBMITTED`. It is returned after `APPROVED`. You need it to open an account. - `failureReason` is returned only when `REJECTED`.

List RFIs GET

Lists the requests for information (RFIs) the provider raised for the customer. The list does not include questions. Get an RFI to see them.