Submit KYC Documents
curl --request POST \
--url https://api.fyatu.com/api/v3/cardholders/{id}/kyc \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"documentType": "PASSPORT",
"documentNumber": "AB123456",
"idFrontUrl": "https://storage.example.com/documents/id_front.jpg",
"idBackUrl": "https://storage.example.com/documents/id_back.jpg",
"selfieUrl": "https://storage.example.com/documents/selfie.jpg"
}
'import requests
url = "https://api.fyatu.com/api/v3/cardholders/{id}/kyc"
payload = {
"documentType": "PASSPORT",
"documentNumber": "AB123456",
"idFrontUrl": "https://storage.example.com/documents/id_front.jpg",
"idBackUrl": "https://storage.example.com/documents/id_back.jpg",
"selfieUrl": "https://storage.example.com/documents/selfie.jpg"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
documentType: 'PASSPORT',
documentNumber: 'AB123456',
idFrontUrl: 'https://storage.example.com/documents/id_front.jpg',
idBackUrl: 'https://storage.example.com/documents/id_back.jpg',
selfieUrl: 'https://storage.example.com/documents/selfie.jpg'
})
};
fetch('https://api.fyatu.com/api/v3/cardholders/{id}/kyc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/cardholders/{id}/kyc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'documentType' => 'PASSPORT',
'documentNumber' => 'AB123456',
'idFrontUrl' => 'https://storage.example.com/documents/id_front.jpg',
'idBackUrl' => 'https://storage.example.com/documents/id_back.jpg',
'selfieUrl' => 'https://storage.example.com/documents/selfie.jpg'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/cardholders/{id}/kyc"
payload := strings.NewReader("{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/cardholders/{id}/kyc")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/cardholders/{id}/kyc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "KYC documents submitted successfully",
"data": {
"id": "ch_1a2b3c4d5e6f7890abcdef1234567890",
"kycStatus": "SUBMITTED",
"message": "KYC documents submitted successfully. Verification is pending."
}
}{
"success": false,
"status": 400,
"message": "Validation failed",
"error": {
"code": "VALIDATION_ERROR",
"details": [
{
"field": "currency",
"message": "Currency is required"
}
]
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 401,
"message": "Unable to identify business",
"error": {
"code": "AUTH_TOKEN_INVALID"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 404,
"message": "Wallet not found",
"error": {
"code": "RESOURCE_NOT_FOUND"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 409,
"message": "KYC is already accepted for this cardholder",
"error": {
"code": "KYC_ALREADY_ACCEPTED"
}
}Cardholders
Submit KYC Documents
Submit pre-verified KYC documents for a cardholder via Shared KYC. Available only for businesses with Shared KYC enabled. POST /cardholders//kyc.
POST
/
cardholders
/
{id}
/
kyc
Submit KYC Documents
curl --request POST \
--url https://api.fyatu.com/api/v3/cardholders/{id}/kyc \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"documentType": "PASSPORT",
"documentNumber": "AB123456",
"idFrontUrl": "https://storage.example.com/documents/id_front.jpg",
"idBackUrl": "https://storage.example.com/documents/id_back.jpg",
"selfieUrl": "https://storage.example.com/documents/selfie.jpg"
}
'import requests
url = "https://api.fyatu.com/api/v3/cardholders/{id}/kyc"
payload = {
"documentType": "PASSPORT",
"documentNumber": "AB123456",
"idFrontUrl": "https://storage.example.com/documents/id_front.jpg",
"idBackUrl": "https://storage.example.com/documents/id_back.jpg",
"selfieUrl": "https://storage.example.com/documents/selfie.jpg"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
documentType: 'PASSPORT',
documentNumber: 'AB123456',
idFrontUrl: 'https://storage.example.com/documents/id_front.jpg',
idBackUrl: 'https://storage.example.com/documents/id_back.jpg',
selfieUrl: 'https://storage.example.com/documents/selfie.jpg'
})
};
fetch('https://api.fyatu.com/api/v3/cardholders/{id}/kyc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/cardholders/{id}/kyc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'documentType' => 'PASSPORT',
'documentNumber' => 'AB123456',
'idFrontUrl' => 'https://storage.example.com/documents/id_front.jpg',
'idBackUrl' => 'https://storage.example.com/documents/id_back.jpg',
'selfieUrl' => 'https://storage.example.com/documents/selfie.jpg'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/cardholders/{id}/kyc"
payload := strings.NewReader("{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/cardholders/{id}/kyc")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/cardholders/{id}/kyc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"documentType\": \"PASSPORT\",\n \"documentNumber\": \"AB123456\",\n \"idFrontUrl\": \"https://storage.example.com/documents/id_front.jpg\",\n \"idBackUrl\": \"https://storage.example.com/documents/id_back.jpg\",\n \"selfieUrl\": \"https://storage.example.com/documents/selfie.jpg\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "KYC documents submitted successfully",
"data": {
"id": "ch_1a2b3c4d5e6f7890abcdef1234567890",
"kycStatus": "SUBMITTED",
"message": "KYC documents submitted successfully. Verification is pending."
}
}{
"success": false,
"status": 400,
"message": "Validation failed",
"error": {
"code": "VALIDATION_ERROR",
"details": [
{
"field": "currency",
"message": "Currency is required"
}
]
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 401,
"message": "Unable to identify business",
"error": {
"code": "AUTH_TOKEN_INVALID"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 404,
"message": "Wallet not found",
"error": {
"code": "RESOURCE_NOT_FOUND"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}{
"success": false,
"status": 409,
"message": "KYC is already accepted for this cardholder",
"error": {
"code": "KYC_ALREADY_ACCEPTED"
}
}Overview
Submit identity documents for a cardholder on their behalf using Shared KYC. This endpoint is only available to businesses that have completed FYATU’s Shared KYC onboarding process. The endpoint responds immediately withkycStatus: PENDING. Documents are processed in the background and a cardholder.kyc_approved webhook is dispatched when complete.
This endpoint returns
403 SHARED_KYC_NOT_ENABLED if your business does not have Shared KYC enabled. To apply, reach out to FYATU through your dedicated Slack channel. Enabling Shared KYC requires a due diligence review and the use of a recognised KYC provider (e.g. Sumsub, Persona, Onfido).Endpoint
POST /api/v3/cardholders/{cardholderId}/kyc
cardholders:write
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
cardholderId | string | Yes | Unique cardholder identifier |
Request Fields
| Field | Type | Required | Description |
|---|---|---|---|
idFrontUrl | string | Yes | URL to the front image of the ID document |
selfieUrl | string | Yes | URL to a selfie photo of the cardholder |
idBackUrl | string | No | URL to the back image of the ID document |
documentType | string | No | PASSPORT, NATIONAL_ID, or DRIVER_LICENSE |
Image Requirements
- Format: JPEG, PNG, GIF, or WebP
- Maximum size: 5MB per image
- Accessibility: URLs must be publicly accessible
How It Works
- Your app sends document URLs to this endpoint
- FYATU responds immediately with
PENDINGstatus - FYATU processes the documents in the background
- On success,
kycStatusis set toACCEPTEDand acardholder.kyc_approvedwebhook is dispatched with the final document URLs - On failure,
kycStatusis set toREJECTED— you can re-submit
Prerequisites
- Business must have Shared KYC enabled (contact FYATU via your dedicated Slack channel)
- Cardholder
kycStatusmust beUNSUBMITTEDorREJECTED - All image URLs must be publicly accessible
Example Usage
<?php
$cardholderId = 'CH1a2b3c4d5e6f';
$data = [
'idFrontUrl' => 'https://storage.example.com/docs/id-front.jpg',
'idBackUrl' => 'https://storage.example.com/docs/id-back.jpg',
'selfieUrl' => 'https://storage.example.com/docs/selfie.jpg',
'documentType' => 'NATIONAL_ID',
];
$response = file_get_contents(
"https://api.fyatu.com/api/v3/cardholders/{$cardholderId}/kyc",
false,
stream_context_create([
'http' => [
'method' => 'POST',
'header' => [
'Authorization: Bearer ' . $accessToken,
'Content-Type: application/json'
],
'content' => json_encode($data)
]
])
);
$result = json_decode($response, true);
echo "KYC status: " . $result['data']['kycStatus'] . "\n";
// Output: KYC status: PENDING
const cardholderId = 'CH1a2b3c4d5e6f';
const data = {
idFrontUrl: 'https://storage.example.com/docs/id-front.jpg',
idBackUrl: 'https://storage.example.com/docs/id-back.jpg',
selfieUrl: 'https://storage.example.com/docs/selfie.jpg',
documentType: 'NATIONAL_ID',
};
const response = await fetch(
`https://api.fyatu.com/api/v3/cardholders/${cardholderId}/kyc`,
{
method: 'POST',
headers: {
'Authorization': `Bearer ${accessToken}`,
'Content-Type': 'application/json'
},
body: JSON.stringify(data)
}
);
const result = await response.json();
console.log('KYC status:', result.data.kycStatus);
// Output: KYC status: PENDING
Example Response
Success (200)
{
"success": true,
"status": 200,
"message": "KYC documents received and are being processed",
"data": {
"id": "CH1a2b3c4d5e6f",
"kycStatus": "PENDING"
},
"meta": {
"requestId": "req_kyc123abc",
"timestamp": "2026-01-08T17:00:00+00:00"
}
}
{
"event": "cardholder.kyc_approved",
"data": {
"id": "CH1a2b3c4d5e6f",
"kycStatus": "ACCEPTED",
"document": {
"type": "NATIONAL_ID"
},
"kyc": {
"idFrontUrl": "https://cdn.fyatu.com/kyc/CH1a2b3c4d5e6f/front_1234567890.jpg",
"idBackUrl": "https://cdn.fyatu.com/kyc/CH1a2b3c4d5e6f/back_1234567890.jpg",
"selfieUrl": "https://cdn.fyatu.com/kyc/CH1a2b3c4d5e6f/selfie_1234567890.jpg"
}
}
}
Error Responses
Shared KYC Not Enabled (403)
{
"success": false,
"status": 403,
"message": "Shared KYC is not enabled for this business",
"error": { "code": "SHARED_KYC_NOT_ENABLED" }
}
Already Accepted (409)
{
"success": false,
"status": 409,
"message": "KYC has already been accepted for this cardholder",
"error": { "code": "CONFLICT" }
}
Already Processing (409)
{
"success": false,
"status": 409,
"message": "KYC documents are already being processed",
"error": { "code": "KYC_PENDING" }
}
Validation Error (400)
{
"success": false,
"status": 400,
"message": "Validation failed",
"error": {
"code": "VALIDATION_ERROR",
"details": [
{ "field": "selfieUrl", "message": "The selfieUrl field is required." }
]
}
}
You can also submit KYC documents at cardholder creation time by including a
kyc object in the POST /cardholders request body. See the Create Cardholder endpoint for details.Authorizations
JWT access token obtained from /auth/token
Path Parameters
Unique cardholder identifier
Body
application/json
Type of identification document
Available options:
PASSPORT, NATIONAL_ID, DRIVER_LICENSE Document identification number
Required string length:
3 - 50URL to the front image of the ID document
Maximum string length:
500URL to the back image of the ID document (optional for passports)
Maximum string length:
500URL to a selfie photo holding the ID document
Maximum string length:
500⌘I

