{ "item": [ { "name": "▶ Example flows (run top-to-bottom)", "description": "Curated, chained examples. Select the Demo environment, then run each request top-to-bottom — ids flow via the environment.", "item": [ { "name": "UBO automatic (KYB lookup → bind → mint) — no confirm", "description": "Automatic UBO discovery. The bound structure is AUTO and authoritative, so there is NO structure-confirmation step (confirming an AUTO structure is rejected). Run 1–4 in order; re-send step 2 until COMPLETED (KYB is async).", "item": [ { "name": "1 · Submit KYB lookup (ABN 50649413025)", "request": { "method": "POST", "description": "Optionally pass `scope` to control KYB depth and billing: `FULL` (default — ASIC + multi-level UBO, ~$83.25), `ASIC_ONLY` (ASIC organisation verification only, ~$26.25; the register result can still include directors) or `UBO_ONLY` (multi-level UBO report only, ~$57.00). Use `partyCounts` and each party's `role` rather than treating every returned person as a UBO. Omitting `scope` is equivalent to `FULL`. e.g. body `{ \"abn\": \"50649413025\", \"scope\": \"ASIC_ONLY\" }`.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/business-lookups", "host": [ "{{baseUrl}}" ], "path": [ "v1", "business-lookups" ] }, "body": { "mode": "raw", "raw": "{\n \"abn\": \"50649413025\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "var lid = b.lookupRequestId || b.id;", "if (lid) pm.environment.set('lookupId', lid);", "console.log('lookupId =', lid, '— run step 2 to poll');", "pm.test('accepted', function(){ pm.expect([200,201,202]).to.include(pm.response.code); });" ] } } ] }, { "name": "2 · Poll KYB lookup (re-send until COMPLETED)", "request": { "method": "GET", "header": [ { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/business-lookups/{{lookupId}}", "host": [ "{{baseUrl}}" ], "path": [ "v1", "business-lookups", "{{lookupId}}" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "console.log('KYB status:', b.status);", "if (b.status === 'COMPLETED') {", " console.log('UBOs:', (b.individuals||[]).map(function(i){return (i.firstName||'')+' '+(i.lastName||'')+' ('+i.role+')';}).join(', '));", " pm.test('COMPLETED', function(){ pm.expect(b.status).to.eql('COMPLETED'); });", "} else { console.log('Still', b.status, '— re-send until COMPLETED (async).'); }" ] } } ] }, { "name": "3 · Create verification — bind all UBOs", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/verifications", "host": [ "{{baseUrl}}" ], "path": [ "v1", "verifications" ] }, "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"lookupRequestId\": \"{{lookupId}}\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "if (b.id) pm.environment.set('verificationId', b.id);", "console.log('verificationId =', b.id, 'structureSource =', b.structureSource, 'status =', b.status);", "pm.test('created', function(){ pm.expect([200,201]).to.include(pm.response.code); });" ] } } ] }, { "name": "4 · Mint per-individual verification links", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/verifications/{{verificationId}}/links", "host": [ "{{baseUrl}}" ], "path": [ "v1", "verifications", "{{verificationId}}", "links" ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "(b.individuals||[]).forEach(function(i){ console.log('Open:', i.verificationUrl); });", "pm.test('minted', function(){ pm.expect(pm.response.code).to.eql(200); });" ] } } ] } ] }, { "name": "Individual verification (create → confirm → mint)", "description": "Manual structure: you add the parties, so it starts at UBO_REVIEW and you confirm it to advance to READY_TO_SEND before minting links. Run 1–3 in order.", "item": [ { "name": "1 · Create verification with a director", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/verifications", "host": [ "{{baseUrl}}" ], "path": [ "v1", "verifications" ] }, "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"Example Pty Ltd\",\n \"individuals\": [\n {\n \"role\": \"DIRECTOR\",\n \"externalId\": \"{{runTag}}\"\n }\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "if (b.id) pm.environment.set('verificationId', b.id);", "if (b.individuals && b.individuals[0]) pm.environment.set('individualId', b.individuals[0].id);", "console.log('verificationId =', b.id, 'status =', b.status, '(MANUAL → needs confirm)');", "pm.test('created', function(){ pm.expect([200,201]).to.include(pm.response.code); });" ] } } ] }, { "name": "2 · Confirm structure (→ READY_TO_SEND)", "request": { "method": "PUT", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/verifications/{{verificationId}}/structure-confirmation", "host": [ "{{baseUrl}}" ], "path": [ "v1", "verifications", "{{verificationId}}", "structure-confirmation" ] }, "body": { "mode": "raw", "raw": "{\n \"confirmed\": true\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "console.log('status now:', b.status);", "pm.test('confirmed', function(){ pm.expect(pm.response.code).to.eql(200); pm.expect(b.status).to.eql('READY_TO_SEND'); });" ] } } ] }, { "name": "3 · Mint verification link", "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/verifications/{{verificationId}}/links", "host": [ "{{baseUrl}}" ], "path": [ "v1", "verifications", "{{verificationId}}", "links" ] }, "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "var b={}; try{b=pm.response.json();}catch(e){}", "(b.individuals||[]).forEach(function(i){ console.log('Open:', i.verificationUrl); });", "pm.test('minted', function(){ pm.expect(pm.response.code).to.eql(200); });" ] } } ] } ] } ] }, { "name": "Authentication", "description": "OAuth 2.0 client-credentials token. Optional helper — the collection-level Authorization does this for you via \"Get New Access Token\".", "item": [ { "name": "Get access token (client credentials)", "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "const body = pm.response.json();", "if (body && body.access_token) {", " pm.environment.set('accessToken', body.access_token);", " console.log('Stored accessToken in the current environment.');", "}" ] } } ], "request": { "auth": { "type": "noauth" }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "key": "grant_type", "value": "client_credentials", "type": "text" }, { "key": "client_id", "value": "{{clientId}}", "type": "text" }, { "key": "client_secret", "value": "{{clientSecret}}", "type": "text" }, { "key": "scope", "value": "channel-partner-api/server", "type": "text" } ] }, "url": { "raw": "{{tokenUrl}}", "host": [ "{{tokenUrl}}" ] }, "description": "Fetches an OAuth2 access token from {{tokenUrl}} and stores it as `accessToken` in the active environment." } } ] }, { "name": "Channel Partner", "description": "Partner account details.", "item": [ { "id": "2604c36b-acfc-467e-aeda-37fc514fb935", "name": "Get public channel partner details", "request": { "name": "Get public channel partner details", "description": { "content": "Returns branding and identification details that are available to unauthenticated guest experiences. The response only includes fields safe for public consumption.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-partners", ":id", "public" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{partnerId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "8af7cf5d-e7da-4d1e-8a88-a6bebef0c0d1", "name": "Public channel partner record", "originalRequest": { "url": { "path": [ "v1", "channel-partners", ":id", "public" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"branding\": {\n \"guestPayment\": {\n \"logoLight\": {\n \"key\": \"\",\n \"identityId\": \"\",\n \"level\": \"\",\n \"alt\": \"\",\n \"src\": \"\"\n },\n \"logoDark\": {\n \"key\": \"\",\n \"identityId\": \"\",\n \"level\": \"\",\n \"alt\": \"\",\n \"src\": \"\"\n },\n \"primaryColor\": \"\"\n }\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "7a3ce771-696f-4a96-b3fc-51fb1ed0c77f", "name": "Channel partner not found", "originalRequest": { "url": { "path": [ "v1", "channel-partners", ":id", "public" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "56fd8774-1b0d-4a94-a638-00817fff48ee", "name": "Get current channel partner", "request": { "name": "Get current channel partner", "description": { "content": "Returns the channel partner associated with the authenticated user or server client credentials.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-partners", "me" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "c78d6dae-7577-4217-a2ee-21ba568671e2", "name": "Channel partner", "originalRequest": { "url": { "path": [ "v1", "channel-partners", "me" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"name\": \"\",\n \"owner\": \"\",\n \"ownerEmail\": \"\",\n \"serverClientId\": \"\",\n \"serverClientName\": \"\",\n \"connectedAccount\": \"\",\n \"accountStatus\": \"CREATED\",\n \"webhookDestinations\": [\n {\n \"endpoint\": \"\",\n \"enabledEventCategories\": [\n \"PAYMENTS\",\n \"VERIFICATIONS\"\n ]\n }\n ],\n \"webhookEndpoints\": [\n \"\",\n \"\"\n ],\n \"branding\": {\n \"guestPayment\": {\n \"logoLight\": {\n \"key\": \"\",\n \"identityId\": \"\",\n \"level\": \"\",\n \"alt\": \"\",\n \"src\": \"\"\n },\n \"logoDark\": {\n \"key\": \"\",\n \"identityId\": \"\",\n \"level\": \"\",\n \"alt\": \"\",\n \"src\": \"\"\n },\n \"primaryColor\": \"\"\n },\n \"key_0\": false,\n \"key_1\": true,\n \"key_2\": 7922\n },\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "9f23b91c-1438-4fa9-b323-3f5337914bb8", "name": "Update current channel partner", "request": { "name": "Update current channel partner", "description": { "content": "Updates webhook destinations and event subscriptions for the authenticated partner. Omit enabledEventCategories to enable all categories. webhookEndpoints is deprecated but remains accepted: retained URLs keep their current preferences and newly added URLs default to all events.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-partners", "me" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"webhookDestinations\": [\n {\n \"endpoint\": \"https://partner.example.com/admiin\"\n },\n {\n \"endpoint\": \"https://partner.example.com/payments\",\n \"enabledEventCategories\": [\"PAYMENTS\"]\n }\n ]\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Payments", "description": "Server-to-server hosted payment links.", "item": [ { "id": "b8b805f5-bf22-4fab-b9b0-a0fda17b8f2b", "name": "List payments", "request": { "name": "List payments", "description": { "content": "Returns channel payments visible to the authenticated user. Partner members automatically receive only their organisation's payments.", "type": "text/plain" }, "url": { "path": [ "v1", "payments" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Maximum number of results to return (1-100, default 20).", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "Offset for pagination. Use `from + limit` from previous request to fetch the next page.", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": "Optional filter that limits the response to payments with the provided status. (This can only be one of PENDING,SUCCEEDED,FAILED,PAYOUT_SCHEDULED,PAYOUT_PROCESSING,PAYOUT_SENT,PAID,PAYOUT_FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "e35d9576-c5cd-42db-be54-0cd28fadfc65", "name": "Channel payments", "originalRequest": { "url": { "path": [ "v1", "payments" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Maximum number of results to return (1-100, default 20).", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "Offset for pagination. Use `from + limit` from previous request to fetch the next page.", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": "Optional filter that limits the response to payments with the provided status. (This can only be one of PENDING,SUCCEEDED,FAILED,PAYOUT_SCHEDULED,PAYOUT_PROCESSING,PAYOUT_SENT,PAID,PAYOUT_FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAID\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\"\n }\n },\n {\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAYOUT_PROCESSING\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\",\n \"key_2\": \"\",\n \"key_3\": \"\"\n }\n }\n ],\n \"total\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.items && b.items[0] && b.items[0].id != null) pm.environment.set('paymentId', b.items && b.items[0] && b.items[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "88eda6e7-929b-451f-9c90-198323caa329", "name": "Create a payment", "request": { "name": "Create a payment", "description": { "content": "Creates a hosted payment for the authenticated partner. Only server integrations using the client-credentials flow can call this endpoint.", "type": "text/plain" }, "url": { "path": [ "v1", "payments" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) The partner id that owns the payment. Required for server tokens.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"amount\": 100,\n \"prn\": \"{{validPrn}}\",\n \"payerDisplayName\": \"Postman Test\",\n \"paymentFor\": \"Postman Test\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "7880fc9d-c6b6-4957-a2a9-06bab8c1ddfc", "name": "Payment created", "originalRequest": { "url": { "path": [ "v1", "payments" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) The partner id that owns the payment. Required for server tokens.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"amount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"token\": \"\",\n \"url\": \"\",\n \"metadata\": {\n \"key_0\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('paymentId', b.id);", " if (b.token != null) pm.environment.set('paymentToken', b.token);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "db1c0b91-bbd5-4d04-b9b0-84ea8b524077", "name": "Get payment", "request": { "name": "Get payment", "description": { "content": "Returns a single channel payment visible to the authenticated partner or server integration. The `{id}` path parameter is a **paymentId only** — tokens are NOT accepted on this route. Use `GET /v1/payments/by-token/{token}` for guest token lookups. When authenticating with client credentials, the partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "url": { "path": [ "v1", "payments", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "ebebab30-ca9b-4258-87b6-103413669078", "name": "Payment", "originalRequest": { "url": { "path": [ "v1", "payments", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAYOUT_FAILED\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "e41c9ec4-b271-458a-b5b2-1007e3e7388a", "name": "Payment not found (a guest token in the `{id}` slot resolves here).", "originalRequest": { "url": { "path": [ "v1", "payments", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Payments (guest)", "description": "Public token-based endpoints for the payer flow (no partner auth).", "item": [ { "id": "f64427f9-5e56-42d1-977c-cadec16dd400", "name": "Fetch a guest payment by token (guest)", "request": { "name": "Fetch a guest payment by token (guest)", "description": { "content": "**Guest endpoint** consumed by the hosted Next.js pay page. Returns a\ndeliberately narrow projection of the payment — only the fields the\nguest pay page needs. Webhook delivery state, retry counts, internal\npayment-provider references, audit metadata and timestamps are stripped.\n\nNo `X-Partner-Id` header and no authentication — the token in the path\nis the credential.\n", "type": "text/plain" }, "url": { "path": [ "v1", "payments", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentToken}}", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "b02647d6-0d81-44e8-b96a-d54deab7d005", "name": "Narrow guest payment projection.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"amount\": \"\",\n \"status\": \"PAYOUT_FAILED\",\n \"partnerId\": \"\",\n \"currency\": \"\",\n \"expiresAt\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"prn\": \"\",\n \"cardFeeAmount\": \"\",\n \"redirectUrl\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "7decacd2-44f5-4bd6-b040-54b39d69f72f", "name": "Token not found.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" }, { "id": "0369d3f9-65d0-4096-bbed-2e29cee5b555", "name": "Link expired or the payment is no longer payable (terminal status).", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Gone", "code": 410, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"TOKEN_EXPIRED\",\n \"message\": \"This link has expired.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "4d37c341-03af-479e-92ea-00c16b75f996", "name": "Mint a payment intent (guest)", "request": { "name": "Mint a payment intent (guest)", "description": { "content": "**Guest endpoint.** Mints (or returns the existing) payment\nintent for the payment behind the guest token. No authentication — the\ntoken in the path is the credential.\n", "type": "text/plain" }, "url": { "path": [ "v1", "payments", "by-token", ":token", "intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentToken}}", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "method": "POST", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "94b12630-f2f0-4645-9dab-4c379c3d584a", "name": "Payment intent payload.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "a708b248-2367-4e81-b32e-a3c74d4ae1bf", "name": "Payment link expired or payment not payable.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "3d0fc3be-f10a-4e1c-b705-37ed97a27ace", "name": "Token not found.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "31ba30ff-6b1d-4c3a-b0bf-7475e5ad8fe5", "name": "Regenerate an expired guest payment link (guest)", "request": { "name": "Regenerate an expired guest payment link (guest)", "description": { "content": "**Guest endpoint.** Mints a fresh guest token when the original link\nhas expired. No authentication — the token in the path is the\ncredential.\n", "type": "text/plain" }, "url": { "path": [ "v1", "payments", "by-token", ":token", "regenerate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentToken}}", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "method": "POST", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "c807649a-38fc-49a4-85a6-a4f957ae47c3", "name": "A new payment link was generated.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "regenerate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "c636ce41-8b56-4a15-9f6c-faa3f6936d92", "name": "Link still active or payment cannot be regenerated.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "regenerate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "6ac1a8be-565e-4a5d-b029-64fd03c874c0", "name": "Token not found.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "regenerate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a4f7d75b-9233-4fba-a274-a06fa6b2a154", "name": "Fetch partner branding for a guest payment (guest)", "request": { "name": "Fetch partner branding for a guest payment (guest)", "description": { "content": "**Guest endpoint.** Returns the partner branding for the guest pay\npage. Cacheable (60s) — the cache key is the path token. No\nauthentication — the token in the path is the credential.\n", "type": "text/plain" }, "url": { "path": [ "v1", "payments", "by-token", ":token", "branding" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentToken}}", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "method": "GET", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "3d4db00a-fb78-4187-832c-a2c065eff392", "name": "Partner branding payload.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "branding" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "f71733ba-8eed-473d-8e27-d42446156aea", "name": "Token not found or expired.", "originalRequest": { "url": { "path": [ "v1", "payments", "by-token", ":token", "branding" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Channel Payments (legacy)", "description": "Legacy /v1/channel-payments surface. Prefer Payments.", "item": [ { "id": "29d792b8-03ef-4cad-9934-e83dc59b3a8e", "name": "List channel payments (legacy)", "request": { "name": "List channel payments (legacy)", "description": { "content": "**Legacy. Use [GET /v1/payments](#operation/listPayments) instead.** Both surfaces are live; a sunset date will be announced separately. Resolves to the same handler as `/v1/payments`.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-payments" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,SUCCEEDED,FAILED,PAYOUT_SCHEDULED,PAYOUT_PROCESSING,PAYOUT_SENT,PAID,PAYOUT_FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "c69090cb-c5b5-465b-b3a0-37588576a09f", "name": "Channel payments", "originalRequest": { "url": { "path": [ "v1", "channel-payments" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,SUCCEEDED,FAILED,PAYOUT_SCHEDULED,PAYOUT_PROCESSING,PAYOUT_SENT,PAID,PAYOUT_FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAID\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\"\n }\n },\n {\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAYOUT_PROCESSING\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\",\n \"key_2\": \"\",\n \"key_3\": \"\"\n }\n }\n ],\n \"total\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ed09164b-aae5-49d3-87e0-fa49658d0566", "name": "Create a channel payment (legacy)", "request": { "name": "Create a channel payment (legacy)", "description": { "content": "**Legacy. Use [POST /v1/payments](#operation/createPayment) instead.** Both surfaces are live; a sunset date will be announced separately. Resolves to the same handler as `/v1/payments`.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-payments" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"amount\": 100,\n \"prn\": \"{{validPrn}}\",\n \"payerDisplayName\": \"Postman Test\",\n \"paymentFor\": \"Postman Test\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "7f210d1a-e06e-4724-ae06-75fb9a332131", "name": "Payment created", "originalRequest": { "url": { "path": [ "v1", "channel-payments" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"amount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"token\": \"\",\n \"url\": \"\",\n \"metadata\": {\n \"key_0\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('paymentId', b.id);", " if (b.token != null) pm.environment.set('paymentToken', b.token);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "9cf6d228-5b86-47a5-a6ef-1fd33b29b454", "name": "Get channel payment (legacy)", "request": { "name": "Get channel payment (legacy)", "description": { "content": "**Legacy. Use [GET /v1/payments/{id}](#operation/getPayment) instead.** Both surfaces are live; a sunset date will be announced separately. Resolves to the same handler as `/v1/payments/{id}`.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-payments", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "66ea9f8c-bd49-4e71-a050-b26b79d24a4e", "name": "Payment", "originalRequest": { "url": { "path": [ "v1", "channel-payments", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"partnerId\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"prn\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"status\": \"PAYOUT_FAILED\",\n \"url\": \"\",\n \"token\": \"\",\n \"commission\": \"\",\n \"commissionAmount\": \"\",\n \"declinedReason\": \"\",\n \"payoutFailureReason\": \"\",\n \"failedAt\": \"\",\n \"billerCode\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"expiresAt\": \"\",\n \"paymentIntentId\": \"\",\n \"disbursementId\": \"\",\n \"webhookAttempts\": \"\",\n \"nextAttemptAt\": \"\",\n \"metadata\": {\n \"key_0\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Business Lookups", "description": "KYB ownership (UBO) lookups.", "item": [ { "id": "56f8cf05-729c-40ba-a8d2-a412a0218c2c", "name": "Submit a KYB ownership lookup", "request": { "name": "Submit a KYB ownership lookup", "description": { "content": "Triggers a Know Your Business (KYB) ownership query against the verification provider. Supply an ABN or ACN; the response returns immediately with a `lookupRequestId`.\nThe resolved UBO / director list arrives asynchronously via the `business-lookup.completed` webhook.\nUse the UBO list to curate the individuals you submit to `POST /v1/verifications`.\n\n**Partner ID source.** The `X-Partner-Id` header is required and is validated against the OAuth principal — a mismatch returns `403 Forbidden` (CWE-639 mitigation).\n\n**Contact billing:** `contactId` is optional — when present, Admiin validates the contact belongs to you and runs the contact billing gate (saved card with a verified consent, not blocked by a failed billing run); the lookup's charges settle against the contact's card. Omit it to bill your partner account as today.", "type": "text/plain" }, "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"abn\": \"50649413025\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "0e0681ac-7082-4f04-9333-03785ae01f31", "name": "Lookup accepted; result will arrive via the `business-lookup.completed` webhook.", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Accepted", "code": 202, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"lookupRequestId\": \"\",\n \"status\": \"FAILED\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "be6a9042-d110-46dc-916c-b30aec592a39", "name": "Validation error (missing ABN / ACN or malformed identifier).", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "1b2b275e-a74e-4048-83a8-109897560267", "name": "Unauthorized (invalid or expired token).", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "f67dda8e-15d6-47af-97ba-944e70cabdd5", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('lookupId', b.id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "aa86e9a8-6a9f-4f72-8545-60580870e10e", "name": "List the partner's KYB lookup requests", "request": { "name": "List the partner's KYB lookup requests", "description": { "content": "Lists the channel partner's KYB ownership-lookup history. Partner ID\ncomes from the `X-Partner-Id` header and is cross-checked against the\nauthenticated principal — a mismatch returns `403 Forbidden`.\n", "type": "text/plain" }, "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,COMPLETED,FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "db6a6afc-6057-434b-b681-d690bdd0f4ae", "name": "The partner's KYB lookup requests.", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,COMPLETED,FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"\",\n \"lookupRequestId\": \"\",\n \"channelPartnerId\": \"\",\n \"status\": \"PENDING\",\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\",\n \"uboCount\": \"\",\n \"result\": {\n \"entity\": {\n \"name\": \"\",\n \"type\": \"\",\n \"abn\": \"\",\n \"acn\": \"\"\n },\n \"individuals\": [\n {\n \"idvEntityId\": \"\"\n },\n {\n \"idvEntityId\": \"\"\n }\n ]\n },\n \"createdBy\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"lookupRequestId\": \"\",\n \"channelPartnerId\": \"\",\n \"status\": \"COMPLETED\",\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\",\n \"uboCount\": \"\",\n \"result\": {\n \"entity\": {\n \"name\": \"\",\n \"type\": \"\",\n \"abn\": \"\",\n \"acn\": \"\"\n },\n \"individuals\": [\n {\n \"idvEntityId\": \"\"\n },\n {\n \"idvEntityId\": \"\"\n }\n ]\n },\n \"createdBy\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ],\n \"total\": \"\",\n \"from\": \"\",\n \"limit\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f8d325f7-f94c-4981-9b7b-4dc62e75efd3", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,COMPLETED,FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "4c2d0051-bdec-4776-9b41-d0961767be04", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "business-lookups" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of PENDING,COMPLETED,FAILED)", "type": "text/plain" }, "key": "status", "value": "PENDING" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.items && b.items[0] && b.items[0].id != null) pm.environment.set('lookupId', b.items && b.items[0] && b.items[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "bc6c0a0a-90f3-41b5-bd79-aed9e92f4ede", "name": "Get a KYB lookup request", "request": { "name": "Get a KYB lookup request", "description": { "content": "Polling fallback for the async KYB result. Partners that do not\nsubscribe to the `business-lookup.completed` webhook poll this route.\nPartner ID comes from the `X-Partner-Id` header; the looked-up row\nmust also be owned by the caller.\n", "type": "text/plain" }, "url": { "path": [ "v1", "business-lookups", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{lookupId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "8db9cf2e-c4e9-4893-8661-e3eeb96c49d6", "name": "The KYB lookup request.", "originalRequest": { "url": { "path": [ "v1", "business-lookups", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"lookupRequestId\": \"\",\n \"channelPartnerId\": \"\",\n \"status\": \"FAILED\",\n \"abn\": \"\",\n \"acn\": \"\",\n \"entityName\": \"\",\n \"uboCount\": \"\",\n \"result\": {\n \"entity\": {\n \"name\": \"\",\n \"type\": \"\",\n \"abn\": \"\",\n \"acn\": \"\"\n },\n \"individuals\": [\n {\n \"idvEntityId\": \"\"\n },\n {\n \"idvEntityId\": \"\"\n }\n ]\n },\n \"createdBy\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "053b862b-eec2-4eb4-b90a-9c0729d06057", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "business-lookups", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "c8ea2931-de4b-4c45-a9b8-c60806ee9bb4", "name": "Forbidden (`X-Partner-Id` mismatch or lookup not owned by this partner).", "originalRequest": { "url": { "path": [ "v1", "business-lookups", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" }, { "id": "9ab94906-0727-4a38-a59f-69772290e6d3", "name": "Business lookup not found.", "originalRequest": { "url": { "path": [ "v1", "business-lookups", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b188fce1-d11c-4177-9af3-385a6f342c90", "name": "Retrieve the ownership structure for a KYB lookup", "request": { "name": "Retrieve the ownership structure for a KYB lookup", "description": { "content": "Returns the beneficial-ownership graph for a completed KYB lookup — nodes, edges, unlinked owners and a completeness block — together with each individual's structured name, date of birth, addresses and screening summary when available.\n\n**This is a durable read, not a cache.** Unlike the webhook payload, which you must store when it arrives, this endpoint can be re-fetched for as long as the underlying check is retained. Use it when your receiver missed a delivery, when you need the structure again months later or when you would rather not persist dates of birth yourself.\n\n**Compliance PII is served live, never stored on the lookup by us.** We hold the ownership structure but re-fetch dates of birth, addresses and screening summaries for this response. This is why a node can carry `dateOfBirthAvailability: 'NOT_RETAINED'` even though the person is in the graph.\n\n**`structureAsOf` is the date the structure was DETERMINED, not the date you read it.** This is the most commonly misread field on this surface. A lookup run in March returns a March `structureAsOf` when you read it in September — the answer is genuinely that old and a company can have changed hands since.\n\n**A refusal is still a `200`.** When `ownershipSource` is `UNAVAILABLE` the stored graph is returned if we have one because it remains useful. There is no `409` on this route.\n\n**Provider-neutral boundary.** This route returns the compliance-relevant PII and screening summary supplied by the live read. Verification-provider names, credentials, internal request/check identifiers and unnormalised provider payloads are not returned. Stable partner-facing correlation identifiers remain unchanged for follow-up requests. Identity-document images and biometric evidence remain available through the verification evidence endpoints rather than being duplicated here.\n\n**Rate.** Reads are budgeted per lookup per day. Cache the response on your side rather than re-fetching it per page view.", "type": "text/plain" }, "url": { "path": [ "v1", "business-lookups", ":id", "ownership" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{lookupId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The `lookupRequestId` returned when the lookup was submitted.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "4a52bf14-826b-4f54-9c38-e741d7221514", "name": "Retrieve the company registry record for a KYB lookup", "request": { "name": "Retrieve the company registry record for a KYB lookup", "description": { "content": "Returns the registry record behind a completed KYB lookup — registered name, ABN and ACN, company type and code, registration status, the registered office, the register's extract and last-check dates, and an organisation-level screening summary where one exists.\n\nLike `/ownership`, this is a durable read you can re-fetch rather than a payload you must store.\n\n**A refusal is still a `200`**, with `registryUnavailable: true` and a `reason`. Check that field before treating an absent `registry` as \"this company has no registry record\".\n\nA refusal is not always permanent. `LIVE_FETCH_BUDGET_EXCEEDED` means this lookup has used up its daily live-read budget for this panel and the budget resets at 00:00 UTC, which is a different situation from `LIVE_FETCH_DISABLED`.", "type": "text/plain" }, "url": { "path": [ "v1", "business-lookups", ":id", "registry" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{lookupId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The `lookupRequestId` returned when the lookup was submitted.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the lookup. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "id": "a1d7863d-d59a-4cbb-8b3c-54fbaf61fea6", "name": "Contacts", "description": "Contacts are sub-customers under your partner account (e.g. the firms you serve). Each contact saves its own card via a guest card-management link and the verifications / KYB lookups you attribute to it (via `contactId`) settle against that card once the contact's unpaid balance crosses the $50 threshold; any smaller non-zero balance is collected at the start of each month. Each settlement charges the net batch total plus a 1.9% card processing fee.\n\nLifecycle: create the contact → mint a card link → the contact saves a card + accepts the merchant-initiated billing authorisation (`contact.card.saved` webhook, `billingStatus: ACTIVE`) → pass `contactId` on `POST /v1/verifications` / `POST /v1/business-lookups` → charges accrue and capture automatically (`contact.billing.*` webhooks). Card management is guest-only: the contact saves, replaces and removes its card via the minted card-management link — there are no partner payment-method endpoints.", "item": [ { "id": "68643174-9b21-471a-b0a1-64ddcb61b73e", "name": "Create a contact", "request": { "name": "Create a contact", "description": { "content": "Creates a contact (sub-customer) under the authenticated partner. The partner id comes from the `X-Partner-Id` header. Do NOT supply contact end-user PII — only the contact's own business details. When `externalId` is supplied, it is enforced unique per partner (a duplicate returns `409 CONTACT_EXTERNAL_ID_EXISTS`) and is immutable after create.\n\nThe new contact starts in `billingStatus: NO_PAYMENT_METHOD` — mint a card link with **Mint a contact card-management link** so the contact can save a card before you bill it.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"name\": \"Postman Test Contact\",\n \"contactEmail\": \"dylan.app.test+postman@gmail.com\",\n \"externalId\": \"{{runTag}}\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "eb985904-8a30-4803-b129-125fa9e962cf", "name": "Contact created.", "originalRequest": { "url": { "path": [ "v1", "contacts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"id\": \"ctc_01HZX0000000000000000000\",\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"status\": \"ACTIVE\",\n \"billingStatus\": \"NO_PAYMENT_METHOD\",\n \"unpaidChargeBalanceCents\": 0,\n \"billingThresholdCents\": 5000,\n \"createdAt\": \"2026-06-10T00:00:00.000Z\",\n \"updatedAt\": \"2026-06-10T00:00:00.000Z\"\n}" }, { "id": "9257ec7f-8db9-4e18-aca0-160e3ce5e847", "name": "Duplicate `externalId` for this partner.", "originalRequest": { "url": { "path": [ "v1", "contacts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"CONFLICT\",\n \"message\": \"The request conflicts with the current resource state.\",\n \"fields\": []\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('contactId', b.id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ba19fe16-ccbe-41ce-b3c7-093af6a128ef", "name": "List the partner's contacts", "request": { "name": "List the partner's contacts", "description": { "content": "Lists the authenticated partner's contacts. Supports cursor paging via `nextToken` and an optional `externalId` filter.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "externalId", "value": "", "description": { "content": "Filter to the contact carrying this externalId.", "type": "text/plain" } }, { "disabled": true, "key": "nextToken", "value": "", "description": { "content": "Cursor from the previous page's `nextToken`.", "type": "text/plain" } } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "c57bb065-88e6-4210-85e6-368be16b87c1", "name": "The partner's contacts.", "originalRequest": { "url": { "path": [ "v1", "contacts" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "externalId", "value": "", "description": { "content": "Filter to the contact carrying this externalId.", "type": "text/plain" } }, { "disabled": true, "key": "nextToken", "value": "", "description": { "content": "Cursor from the previous page's `nextToken`.", "type": "text/plain" } } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"items\": [\n {\n \"id\": \"ctc_01HZX0000000000000000000\",\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"status\": \"ACTIVE\",\n \"billingStatus\": \"NO_PAYMENT_METHOD\",\n \"unpaidChargeBalanceCents\": 0,\n \"billingThresholdCents\": null,\n \"createdAt\": \"2026-06-10T00:00:00.000Z\",\n \"updatedAt\": \"2026-06-10T00:00:00.000Z\"\n }\n ],\n \"nextToken\": null\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.items && b.items[0] && b.items[0].id != null) pm.environment.set('contactId', b.items && b.items[0] && b.items[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b01ef188-9fd4-4dc6-8048-d90ff1444c0e", "name": "Get a contact", "request": { "name": "Get a contact", "description": { "content": "Returns a single contact. The contact must be owned by the authenticated partner — an unknown or foreign id returns `404 CONTACT_NOT_FOUND`.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "f103f81c-1384-4bb3-8066-3f295f3c69ef", "name": "The contact.", "originalRequest": { "url": { "path": [ "v1", "contacts", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"id\": \"ctc_01HZX0000000000000000000\",\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"status\": \"ACTIVE\",\n \"billingStatus\": \"NO_PAYMENT_METHOD\",\n \"unpaidChargeBalanceCents\": 0,\n \"billingThresholdCents\": null,\n \"createdAt\": \"2026-06-10T00:00:00.000Z\",\n \"updatedAt\": \"2026-06-10T00:00:00.000Z\"\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "1c0c59ba-528e-4724-8720-2b06070bcce8", "name": "Update a contact", "request": { "name": "Update a contact", "description": { "content": "Updates the mutable subset of a contact: only `name` and `contactEmail`. `legalName`, `abn` and `externalId` are immutable post-create; `billingThresholdCents` is server-owned ($50 default — balance above it bills immediately, any smaller non-zero balance is collected on the 1st of each month) and cannot be set through the API. Unknown keys are ignored.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"name\": \"Postman Test Contact (updated)\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "123522bd-583c-4d92-a19d-e301e3f4bf05", "name": "The updated contact.", "originalRequest": { "url": { "path": [ "v1", "contacts", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"billingThresholdCents\": 20000\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"id\": \"ctc_01HZX0000000000000000000\",\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"status\": \"ACTIVE\",\n \"billingStatus\": \"NO_PAYMENT_METHOD\",\n \"unpaidChargeBalanceCents\": 0,\n \"billingThresholdCents\": 20000,\n \"createdAt\": \"2026-06-10T00:00:00.000Z\",\n \"updatedAt\": \"2026-06-10T00:00:00.000Z\"\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a588f188-fa8f-4237-aafb-7acb5b584891", "name": "Archive a contact", "request": { "name": "Archive a contact", "description": { "content": "Soft-archives a contact (`status: ARCHIVED`). Refused with `409 CONTACT_HAS_UNPAID_BALANCE` when the contact has an unpaid balance, unless `?force=true` is supplied.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "archive" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "force", "value": "true", "description": { "content": "Archive even when the contact has an unpaid balance.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [ { "id": "da373f66-f6c5-4bd3-977f-54ab70cacc6e", "name": "Contact archived.", "originalRequest": { "url": { "path": [ "v1", "contacts", ":id", "archive" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "force", "value": "true", "description": { "content": "Archive even when the contact has an unpaid balance.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"id\": \"ctc_01HZX0000000000000000000\",\n \"name\": \"Acme Accounting\",\n \"legalName\": \"Acme Accounting Pty Ltd\",\n \"abn\": \"12345678901\",\n \"externalId\": \"acct-1042\",\n \"contactEmail\": \"dylan.app.test+contact@gmail.com\",\n \"status\": \"ARCHIVED\",\n \"billingStatus\": \"NO_PAYMENT_METHOD\",\n \"unpaidChargeBalanceCents\": 0,\n \"billingThresholdCents\": null,\n \"createdAt\": \"2026-06-10T00:00:00.000Z\",\n \"updatedAt\": \"2026-06-10T00:00:00.000Z\"\n}" }, { "id": "7056981b-b16b-43bc-9b73-61e37b5eceb5", "name": "Unpaid balance — re-send with `?force=true`.", "originalRequest": { "url": { "path": [ "v1", "contacts", ":id", "archive" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "force", "value": "true", "description": { "content": "Archive even when the contact has an unpaid balance.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"CONFLICT\",\n \"message\": \"The request conflicts with the current resource state.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "f5f0effa-d804-4d3a-8142-f206d927070f", "name": "Mint a contact card-management link", "request": { "name": "Mint a contact card-management link", "description": { "content": "Mints a single-use, token-bearing guest URL the contact uses to save a card and accept the merchant-initiated billing authorisation. The `url` is returned ONCE — it is never delivered via webhook and never returned by any `GET`. Dispatch it to the contact via your own channel.\n\nOnce the contact saves a card and the consent verifies, you receive a `contact.card.saved` webhook and the contact's `billingStatus` flips to `ACTIVE`.\n\nOptionally pass a `redirectUrl` in the body to send the contact back to your platform once they finish. The guest is redirected to it with `?status=success` (or `?status=removed`) appended; use a `{contactId}` placeholder to receive the contact id back and fetch its latest `billingStatus`. Must be an HTTP/HTTPS URL. The body is optional — omit it to keep the previous behaviour.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "card-link" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"redirectUrl\": \"https://app.example.com/card-done?contact={contactId}\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "9b6f16b6-5da8-4b65-b2d6-0267bc4a92db", "name": "Card-management link minted.", "originalRequest": { "url": { "path": [ "v1", "contacts", ":id", "card-link" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) Contact id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the contact. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"url\": \"https://guest-demo.admiin.com/guest/contact-card?token=&source=cp\",\n \"expiresAt\": \"2026-06-17T00:00:00.000Z\"\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.url) { var m = String(b.url).match(/token=([^&]+)/); if (m) pm.environment.set('cardToken', m[1]); }", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "bf44c463-5f7b-45be-9041-adf0f128d0f2", "name": "Contacts (guest)", "description": "Token-authenticated endpoints behind the hosted guest card-management page (`/guest/contact-card`). You normally never call these — the hosted page does. They are here so you can inspect the contract.", "item": [ { "id": "5e22db8f-5ade-4d91-b89a-3a0953175f64", "name": "Resolve a contact card-management token (guest)", "request": { "name": "Resolve a contact card-management token (guest)", "description": { "content": "Side-effect-free resolve of a contact card-management token. No bearer auth — token validation IS the auth. Returns the contact display name, the partner's branding and a saved-card summary when one exists. An unknown token returns `404`; an expired token returns `410` (never distinguished, to avoid leaking which tokens exist).", "type": "text/plain" }, "url": { "path": [ "v1", "public", "contact-card" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "token", "value": "{{cardToken}}", "description": { "content": "(Required) Token from the card-link URL's `token` query param.", "type": "text/plain" } } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "fc762a52-eebe-4087-b60a-2e4ff2c245b4", "name": "Token resolved.", "originalRequest": { "url": { "path": [ "v1", "public", "contact-card" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "token", "value": "", "description": { "content": "(Required) Token from the card-link URL's `token` query param.", "type": "text/plain" } } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"contactName\": \"Acme Accounting\",\n \"branding\": {\n \"logoUrl\": \"https://cdn-demo.admiin.com/partners//logo.png\",\n \"primaryColor\": \"#111111\"\n },\n \"savedCard\": {\n \"id\": \"cpm_01HZX0000000000000000000\",\n \"brand\": \"visa\",\n \"last4\": \"1142\",\n \"status\": \"ACTIVE\",\n \"consentStatus\": \"VERIFIED\",\n \"createdAt\": \"2026-06-10T00:05:00.000Z\"\n }\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "442b370b-19f5-48b1-94e8-6f8d1fd15192", "name": "Record consent and mint a $0 PaymentIntent (guest)", "request": { "name": "Record consent and mint a $0 PaymentIntent (guest)", "description": { "content": "Called automatically when the guest card page loads (there is no separate checkbox — the embedded card form carries the merchant-initiated authorisation wording and the page links the full Terms of Authorisation). Validates the token, records the consent evidence (`acceptedAt`, `sourceIp`, `userAgent`, `termsVersion`) server-side, then mints the $0 PaymentIntent the card form attaches to. `accepted` must be `true` (else 400). No bearer auth — token validation IS the auth.\n\nThe normal save-card flow runs through the hosted guest page — use this request only to exercise the API directly.", "type": "text/plain" }, "url": { "path": [ "v1", "public", "contact-card", "consent-intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"token\": \"{{cardToken}}\",\n \"accepted\": true,\n \"termsVersion\": \"1\"\n}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "noauth" } }, "response": [ { "id": "5b787cff-e6cd-4f58-bee9-a3188f7088d4", "name": "Consent recorded; PaymentIntent minted.", "originalRequest": { "url": { "path": [ "v1", "public", "contact-card", "consent-intent" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"token\": \"\",\n \"termsVersion\": \"1.0\",\n \"accepted\": true\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"intentId\": \"int_xxxxxxxxxxxxxxxxxxx\",\n \"clientSecret\": \"\",\n \"customerId\": \"cus_xxxxxxxxxxxxxxxxxxx\"\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "5fcd8a7e-d35c-43ab-ad22-65e2867e5be4", "name": "Remove the saved card", "request": { "name": "Remove the saved card", "description": { "content": "Removes the contact's saved card via the card-management link (token IS the auth — no bearer token, no X-Partner-Id). Disables the saved payment method and consent, drops the contact to `billingStatus: NO_PAYMENT_METHOD` and emits `contact.card.removed`. Returns `{\"removed\": false}` when no active card existed. 404 = unknown token, 410 = expired.", "type": "text/plain" }, "url": { "raw": "{{baseUrl}}/v1/public/contact-card/remove", "host": [ "{{baseUrl}}" ], "path": [ "v1", "public", "contact-card", "remove" ], "query": [], "variable": [] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"token\": \"{{cardToken}}\"\n}", "options": { "raw": { "language": "json" } } }, "auth": { "type": "noauth" } }, "response": [], "event": [] } ], "event": [] }, { "name": "Verification", "description": "KYC/KYB verification requests and per-individual links.", "item": [ { "id": "a0815d42-98af-4506-a042-c6ecec0e13af", "name": "Create a verification request", "request": { "name": "Create a verification request", "description": { "content": "Creates a verification request from a hand-curated party list (the MANUAL, no-KYB path). Lands in `UBO_REVIEW` with `structureSource: MANUAL` — add more parties via `POST /v1/verifications/{id}/individuals` and finalise via `PUT /v1/verifications/{id}/structure-confirmation` with `{ \"confirmed\": true }` before minting links.\n\nTo instead bind UBOs discovered by a KYB lookup (each party carries the discovered-UBO / KYB structure correlation key as `idvEntityId`), use **Create a verification request (bind from KYB lookup)** which supplies `lookupRequestId`.\n\n**Data minimisation (APP 3.2):** never send `firstName`/`lastName`/`email`/`phone` (400). **Partner ID** comes from the `X-Partner-Id` header (mismatch → 403).\n\n**Skipping UBO review.** A manual (no `lookupRequestId`) request sits in `UBO_REVIEW` until its structure is confirmed. Pass `structureConfirmed: true` to confirm at create when the supplied individuals are already the complete structure (e.g. an individual / sole trader) — the request lands directly in `READY_TO_SEND`. Build trusts, companies and other multi-party structures incrementally and confirm later via `PUT /v1/verifications/{id}/structure-confirmation`.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"Postman Test Co\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "id": "b19fbcb4-6b4b-41b3-9430-2ee181da0225", "name": "Verification request created.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"status\": \"IN_PROGRESS\",\n \"individuals\": [\n {\n \"id\": \"\",\n \"status\": \"IN_PROGRESS\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"OTHER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"status\": \"PASSED\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"MEMBER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "cb767b0f-e1cf-4018-9429-a0de06fc76d2", "name": "Validation error.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "745be2a8-aaa4-4a65-ba26-fb8827c3c6e3", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "6ac817d9-62cb-4558-aea6-f25916e42043", "name": "Forbidden (`X-Partner-Id` mismatch).", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('verificationId', b.id);", " if (b.individuals && b.individuals[0] && b.individuals[0].id != null) pm.environment.set('individualId', b.individuals && b.individuals[0] && b.individuals[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "fd263e43-d9b8-453c-abec-4f71a14123a1", "name": "Create a verification request (billed to a contact)", "request": { "name": "Create a verification request (billed to a contact)", "description": { "content": "Same as **Create a verification request**, but billed to one of your contacts (sub-customers) instead of to your partner account. Admiin validates the contact belongs to you and runs the contact billing gate — the contact must have a saved card with a verified consent (`billingStatus: ACTIVE`) and must not be blocked by a failed billing run. The charges for every individual on this request settle against the contact's card once the contact crosses its billing threshold.\n\nGate failures return a typed error body: `PAYMENT_METHOD_REQUIRED` (no usable card), `CONTACT_BILLING_BLOCKED` (last billing run failed), `CONTACT_NOT_FOUND`, `CONTACT_INVALID` (archived contact).\n\n**Data minimisation (APP 3.2):** never send `firstName`/`lastName`/`email`/`phone` (400). **Partner ID** comes from the `X-Partner-Id` header (mismatch → 403).\n\n**Skipping UBO review.** A manual (no `lookupRequestId`) request sits in `UBO_REVIEW` until its structure is confirmed. Pass `structureConfirmed: true` to confirm at create when the supplied individuals are already the complete structure (e.g. an individual / sole trader) — the request lands directly in `READY_TO_SEND`. Build trusts, companies and other multi-party structures incrementally and confirm later via `PUT /v1/verifications/{id}/structure-confirmation`.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"contactId\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"structureConfirmed\": false,\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "591c1c25-98fc-45b9-bc42-bef1d7d79858", "name": "Verification request created.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"contactId\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"status\": \"IN_PROGRESS\",\n \"individuals\": [\n {\n \"id\": \"\",\n \"status\": \"IN_PROGRESS\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"OTHER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"status\": \"PASSED\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"MEMBER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "40b1f140-75e7-412e-bc5c-7f8f6c26f7ce", "name": "Validation error.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"contactId\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "0b4e73c0-d356-4f2b-9aa8-7eb8f6b146c8", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"contactId\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "b4e3f89f-bcbc-4c1e-8db3-f693c06eda3e", "name": "Forbidden (`X-Partner-Id` mismatch).", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"contactId\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"entityName\": \"\",\n \"individuals\": [\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n },\n {\n \"externalId\": \"\",\n \"role\": \"TRUSTEE\",\n \"roleDescription\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ea262793-ea91-48c1-99c2-8d30516b8066", "name": "Create a verification request (bind from KYB lookup)", "request": { "name": "Create a verification request (bind from KYB lookup)", "description": { "content": "Binds discovered UBOs from a completed `FULL` or `UBO_ONLY` KYB lookup into a new verification. Each bound UBO carries its `idvEntityId` — the discovered-UBO / KYB structure correlation key for that party (identity verification itself runs against a dedicated per-individual entity).\n\n- Supply `lookupRequestId` (from `POST /v1/business-lookups`) and OMIT `individuals` to bind every discovered UBO.\n- Supply `individuals: [{ idvEntityId }]` (the per-UBO ids from `GET /v1/business-lookups/{id}` or the `business-lookup.completed` webhook) to bind only a subset — one or both.\n\nThe request lands in `READY_TO_SEND` with `structureSource: AUTO` (KYB-authoritative — no structure confirmation required). The lookup must be owned by the caller and `COMPLETED` (else 403 / 409); an `idvEntityId` not in the named lookup returns 400; an `idvEntityId` without a `lookupRequestId` returns 400. `ASIC_ONLY` lookups cannot be bound automatically and return `400 VALIDATION_ERROR` at `/lookupRequestId`; create deliberate manual parties instead.\n\nThen call `POST /v1/verifications/{id}/links` to mint per-UBO verification URLs.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "auth": null, "body": { "mode": "raw", "raw": "{\n \"mode\": \"AUSTRAC_CDD\",\n \"lookupRequestId\": \"\",\n \"individuals\": [\n {\n \"idvEntityId\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "response": [] }, { "id": "da0ce664-bb2c-4899-9484-9eb929bf7330", "name": "Add a party to a verification request (manual structure)", "request": { "name": "Add a party to a verification request (manual structure)", "description": { "content": "Adds one party to an existing verification request — the incremental affordance for a MANUAL (no-KYB) ownership structure.\n\nThe request is marked `structureManuallyAugmented` and held in `UBO_REVIEW` until the structure is confirmed via `PUT /v1/verifications/{id}/structure-confirmation` with `{ \"confirmed\": true }`. Adding a party to an already-confirmed structure invalidates that confirmation and re-pins to `UBO_REVIEW`.\n\n**Data minimisation (APP 3.2).** `firstName`/`lastName`/`email`/`phone` are rejected with 400 — use `externalId` for partner-side mapping; the party's name is OCR'd during IDV. Allowed while the request is non-terminal (a terminal request returns 409).", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Verification request id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "auth": null, "body": { "mode": "raw", "raw": "{\n \"role\": \"DIRECTOR\",\n \"externalId\": \"{{runTag}}\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.id != null) pm.environment.set('individualId', b.id);", "}" ] } } ] }, { "id": "b7f3a2c1-9e84-4d56-8a21-0f3c7d2e1a90", "name": "Set UBO structure confirmation (manual)", "request": { "name": "Set UBO structure confirmation (manual)", "description": { "content": "**Canonical route** for confirming or re-opening a MANUAL (or manually-augmented) ownership structure.\n\nSend `{ \"confirmed\": true }` to confirm — the server stamps `structureConfirmedAt` and releases the pin so the request rolls up past `UBO_REVIEW` to `READY_TO_SEND`. Send `{ \"confirmed\": false }` to re-open — it clears `structureConfirmedAt` and re-engages the pin (back to `UBO_REVIEW`).\n\nIdempotent: re-sending the same `confirmed` value is a no-op. The confirmation is stored server-side as a timestamp; the client only expresses intent and never supplies the timestamp. `confirmed` is **required** and must be a boolean (else 400). A KYB-authoritative (`structureSource: AUTO`) request is implicitly confirmed and returns 400.\n\nRead the structure-confirmation state back from `GET /v1/verifications/{id}` (`structureConfirmedAt` + `status`).", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "structure-confirmation" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) Verification request id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id that owns the verification. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "PUT", "auth": null, "body": { "mode": "raw", "raw": "{\n \"confirmed\": true\n}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "id": "1460edf1-4901-4358-975c-9529003c84be", "name": "List the partner's verification requests", "request": { "name": "List the partner's verification requests", "description": { "content": "Lists the channel partner's verification requests. Partner ID comes\nfrom the `X-Partner-Id` header and is cross-checked against the\nauthenticated principal — a mismatch returns `403 Forbidden`.\n\nSupports cursor paging via `limit` and `from` and optional status filtering.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of DRAFT,VERIFICATIONS_SENT,IN_PROGRESS,PASSED,PARTIALLY_PASSED,FAILED,CANCELLED)", "type": "text/plain" }, "key": "status", "value": "CANCELLED" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "5eb098a1-4584-4bd5-880f-87c6d99be3c5", "name": "The partner's verification requests.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of DRAFT,VERIFICATIONS_SENT,IN_PROGRESS,PASSED,PARTIALLY_PASSED,FAILED,CANCELLED)", "type": "text/plain" }, "key": "status", "value": "CANCELLED" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"\",\n \"channelPartnerId\": \"\",\n \"entityName\": \"\",\n \"mode\": \"AUSTRAC_CDD\",\n \"status\": \"IN_PROGRESS\",\n \"individuals\": [\n {\n \"id\": \"\",\n \"status\": \"IN_PROGRESS\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"MEMBER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"status\": \"FAILED\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"DIRECTOR\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"channelPartnerId\": \"\",\n \"entityName\": \"\",\n \"mode\": \"TPB_POI\",\n \"status\": \"FAILED\",\n \"individuals\": [\n {\n \"id\": \"\",\n \"status\": \"LOCKED_OUT\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"MEMBER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"status\": \"PENDING\",\n \"verificationRequestId\": \"\",\n \"externalId\": \"\",\n \"role\": \"MEMBER\",\n \"roleDescription\": \"\",\n \"attemptCount\": \"\",\n \"maxAttempts\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"manualOverride\": \"\",\n \"failureReason\": \"\",\n \"completedAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ],\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ],\n \"total\": \"\",\n \"from\": \"\",\n \"limit\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "21d74546-7731-44d1-b322-4d005d2ffa37", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of DRAFT,VERIFICATIONS_SENT,IN_PROGRESS,PASSED,PARTIALLY_PASSED,FAILED,CANCELLED)", "type": "text/plain" }, "key": "status", "value": "CANCELLED" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "ab82f925-b119-44e3-9c9d-197d970854ea", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "verifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" }, { "disabled": false, "description": { "content": " (This can only be one of DRAFT,VERIFICATIONS_SENT,IN_PROGRESS,PASSED,PARTIALLY_PASSED,FAILED,CANCELLED)", "type": "text/plain" }, "key": "status", "value": "CANCELLED" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.items && b.items[0] && b.items[0].id != null) pm.environment.set('verificationId', b.items && b.items[0] && b.items[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "851eaca6-c974-4355-8603-05d872484630", "name": "Get a verification request", "request": { "name": "Get a verification request", "description": { "content": "Returns one verification request with every individual on it. Use this to confirm terminal status after the webhook fan-out has run, or to poll if your webhook receiver is temporarily offline.\n\n**`verificationUrl` is NEVER populated by this endpoint.** URLs are only returned by `POST /v1/verifications/{id}/links` and are not persisted in a queryable form.\n\n**Partner ID source.** The `X-Partner-Id` header is required and is validated against the OAuth principal.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "5ba6cda4-5e6e-4b36-90f2-1191efbf5513", "name": "Verification request (passed).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94\",\n \"channelPartnerId\": \"3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3\",\n \"entityName\": \"Noble & Associates Pty Ltd\",\n \"mode\": \"AUSTRAC_CDD\",\n \"status\": \"PASSED\",\n \"structureSource\": \"AUTO\",\n \"structureManuallyAugmented\": false,\n \"structureConfirmedAt\": null,\n \"individuals\": [\n {\n \"id\": \"d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830\",\n \"verificationRequestId\": \"b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94\",\n \"idvEntityId\": \"8c2b5a91-7d34-4e6f-b018-3a9c1e7d5f42\",\n \"externalId\": \"lodgeit-contact-48210\",\n \"role\": \"DIRECTOR\",\n \"roleDescription\": null,\n \"status\": \"PASSED\",\n \"attemptCount\": 1,\n \"maxAttempts\": 3,\n \"manualOverride\": null,\n \"failureReason\": null,\n \"completedAt\": \"2026-07-23T03:49:12.004Z\",\n \"riskLevel\": \"LOW\",\n \"issueList\": [],\n \"checkResults\": [\n {\n \"checkType\": \"id\",\n \"checkClass\": \"kyc\",\n \"result\": \"PASS\",\n \"name\": \"Government ID\",\n \"code\": null,\n \"message\": null\n },\n {\n \"checkType\": \"two_plus\",\n \"checkClass\": \"kyc\",\n \"result\": \"PASS\",\n \"name\": null,\n \"code\": null,\n \"message\": null\n },\n {\n \"checkType\": \"idvalidate\",\n \"checkClass\": \"kyc\",\n \"result\": \"PASS\",\n \"name\": \"IDV\",\n \"code\": null,\n \"message\": null\n },\n {\n \"checkType\": \"pep_media\",\n \"checkClass\": \"aml\",\n \"result\": \"CLEAR\",\n \"name\": \"PEP/Sanctions\",\n \"code\": null,\n \"message\": null\n }\n ],\n \"createdAt\": \"2026-07-23T00:07:41.882Z\",\n \"updatedAt\": \"2026-07-23T03:49:12.004Z\"\n }\n ],\n \"createdAt\": \"2026-07-23T00:07:41.882Z\",\n \"updatedAt\": \"2026-07-23T03:49:12.004Z\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "c1a4f2d6-8b03-4e57-9a26-0d7e5c1b4f38", "name": "Verification request (individual in MANUAL_REVIEW).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94\",\n \"channelPartnerId\": \"3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3\",\n \"entityName\": \"Noble & Associates Pty Ltd\",\n \"mode\": \"AUSTRAC_CDD\",\n \"status\": \"IN_PROGRESS\",\n \"structureSource\": \"AUTO\",\n \"structureManuallyAugmented\": false,\n \"structureConfirmedAt\": null,\n \"individuals\": [\n {\n \"id\": \"d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830\",\n \"verificationRequestId\": \"b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94\",\n \"idvEntityId\": \"8c2b5a91-7d34-4e6f-b018-3a9c1e7d5f42\",\n \"externalId\": \"lodgeit-contact-48210\",\n \"role\": \"DIRECTOR\",\n \"roleDescription\": null,\n \"status\": \"MANUAL_REVIEW\",\n \"attemptCount\": 1,\n \"maxAttempts\": 3,\n \"manualOverride\": null,\n \"failureReason\": null,\n \"completedAt\": \"2026-07-23T03:49:12.004Z\",\n \"riskLevel\": \"MEDIUM\",\n \"issueList\": [\n \"PEP\"\n ],\n \"checkResults\": [\n {\n \"checkType\": \"id\",\n \"checkClass\": \"kyc\",\n \"result\": \"PASS\",\n \"name\": \"Government ID\",\n \"code\": null,\n \"message\": null\n },\n {\n \"checkType\": \"pep\",\n \"checkClass\": \"aml\",\n \"result\": \"FAIL\",\n \"name\": \"PEP/Sanctions\",\n \"code\": \"POTENTIAL_MATCH\",\n \"message\": \"Potential Match (Manual review required)\"\n }\n ],\n \"createdAt\": \"2026-07-23T00:07:41.882Z\",\n \"updatedAt\": \"2026-07-23T03:49:12.004Z\"\n }\n ],\n \"createdAt\": \"2026-07-23T00:07:41.882Z\",\n \"updatedAt\": \"2026-07-23T03:49:12.004Z\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "11a8e800-9161-4095-b3b4-99e8fbdb66c1", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "073a76a8-a402-496a-921e-6f7e8a941df9", "name": "Forbidden (`X-Partner-Id` mismatch or verification not owned by this partner).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" }, { "id": "a6b4a3d9-37cf-4209-bebc-b8fbd0d6a8f8", "name": "Verification not found.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a1d2e3f4-5b6c-47d8-9e0a-1c2d3e4f5a6b", "name": "Get document & biometric evidence for an individual", "request": { "name": "Get document & biometric evidence for an individual", "description": { "content": "Returns the deep document and biometric evidence for one individual — the uploaded ID document(s), OCR-extracted fields, the applicant's claimed identity and the biometric (selfie) comparison.\n\n**Live-fetched, never persisted.** The detail is fetched from the verification provider on each call and is not stored. It may be empty until the individual has completed (or started) verification — poll after a terminal individual webhook, since the evidence is not carried in webhooks.\n\n**Graceful-degradation envelope.** Always returns `200` with a `status` discriminator: `OK`, `NOT_AVAILABLE` or `UPSTREAM_UNAVAILABLE`.\n\n**Images included by default.** Pass `?includeScans=false` to request OCR/metadata only.\n\n**This is PII** (raw ID images, OCR PII, biometric comparison). Handle and store per your data-handling obligations.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "document-details" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "includeScans", "value": "true", "disabled": true, "description": { "content": "When `false`, omit the base64 scan bytes and return OCR/metadata only. Defaults to `true`.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "{{individualId}}", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "e7b0c395-1d42-4a68-b0f3-6c2a9e4d7051", "name": "Document & biometric evidence (status OK, ?includeScans=false).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "document-details" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "includeScans", "value": "false", "disabled": false, "description": { "content": "When `false`, omit the base64 scan bytes and return OCR/metadata only. Defaults to `true`.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"OK\",\n \"fetchedAt\": \"2026-07-29T01:12:44.318Z\",\n \"errorMessage\": null,\n \"documents\": [\n {\n \"documentId\": \"7b9e2c41-0d68-4a35-9f27-6c8b1e0a4d53\",\n \"idType\": \"DRIVERS_LICENCE\",\n \"idSubType\": null,\n \"country\": \"AUS\",\n \"region\": \"NSW\",\n \"idNumber\": \"12345678\",\n \"idIssued\": \"2021-04-11\",\n \"idExpiry\": \"2026-04-11\",\n \"documentStatus\": \"VERIFIED\",\n \"extractedFields\": [\n {\n \"key\": \"GIVEN_NAME\",\n \"value\": \"ROGER\"\n },\n {\n \"key\": \"FAMILY_NAME\",\n \"value\": \"HUNG\"\n },\n {\n \"key\": \"DATE_OF_BIRTH\",\n \"value\": \"1979-02-18\"\n },\n {\n \"key\": \"LICENCE_NUMBER\",\n \"value\": \"12345678\"\n },\n {\n \"key\": \"CARD_NUMBER\",\n \"value\": \"AB1234567\"\n },\n {\n \"key\": \"ADDRESS\",\n \"value\": \"12 SAMPLE ST, SYDNEY NSW 2000\"\n },\n {\n \"key\": \"ocr_process_status\",\n \"value\": \"COMPLETED\"\n }\n ],\n \"scans\": [\n {\n \"scanDocId\": \"a1c7d930-52b8-4e16-bf04-9d3a7c105e68\",\n \"side\": \"FRONT\",\n \"mime\": \"image/jpeg\",\n \"scanType\": \"DOCUMENT\",\n \"pageNum\": 1,\n \"base64\": null,\n \"presignedUrl\": null,\n \"expiresAt\": null,\n \"tooLarge\": false,\n \"scanDeleted\": false\n },\n {\n \"scanDocId\": \"e5b2f18c-7a40-4d93-8c61-2f0d9a3b7451\",\n \"side\": \"BACK\",\n \"mime\": \"image/jpeg\",\n \"scanType\": \"DOCUMENT\",\n \"pageNum\": 1,\n \"base64\": null,\n \"presignedUrl\": null,\n \"expiresAt\": null,\n \"tooLarge\": false,\n \"scanDeleted\": false\n }\n ],\n \"createdFromScan\": true,\n \"manuallyModified\": false\n }\n ],\n \"biometric\": {\n \"comparisonId\": \"c93f7d21-4b06-48ea-9157-8d2c0b6f3a94\",\n \"compareDocumentId\": \"7b9e2c41-0d68-4a35-9f27-6c8b1e0a4d53\",\n \"toDocumentId\": \"f20a6e83-1c95-4b7d-a834-5e1b8c0d92f7\",\n \"confidenceScore\": 0.94,\n \"livenessState\": \"PASSED\",\n \"result\": \"MATCH\",\n \"selfie\": {\n \"scanDocId\": \"f20a6e83-1c95-4b7d-a834-5e1b8c0d92f7\",\n \"side\": null,\n \"mime\": \"image/jpeg\",\n \"scanType\": \"SELFIE\",\n \"pageNum\": null,\n \"base64\": null,\n \"presignedUrl\": null,\n \"expiresAt\": null,\n \"tooLarge\": false,\n \"scanDeleted\": false\n }\n },\n \"claimedIdentity\": {\n \"firstName\": \"Roger\",\n \"middleName\": null,\n \"lastName\": \"Hung\",\n \"dateOfBirth\": \"1979-02-18\",\n \"address\": \"12 Sample St, Sydney NSW 2000\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f4d81c07-9a53-4b2e-8615-3e0b7a2c9d46", "name": "Graceful degradation (status NOT_AVAILABLE).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "document-details" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "includeScans", "value": "false", "disabled": false, "description": { "content": "When `false`, omit the base64 scan bytes and return OCR/metadata only. Defaults to `true`.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"NOT_AVAILABLE\",\n \"fetchedAt\": \"2026-07-29T01:12:45.117Z\",\n \"errorMessage\": \"No verification evidence available for this individual yet.\",\n \"documents\": []\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b2c3d4e5-6f70-48a9-8b1c-2d3e4f5a6b7c", "name": "Get PEP, sanctions & fraud match detail for an individual", "request": { "name": "Get PEP, sanctions & fraud match detail for an individual", "description": { "content": "Returns the matched-entity detail behind a PEP / sanction / watchlist / adverse-media hit for one individual, plus KYC fraud-check matches. Both ride on a single provider round-trip.\n\n**Live-fetched, never persisted.** The detail is fetched from the verification provider on each call and is not stored. It may be empty until the individual has completed verification — poll after a terminal individual webhook, since the detail is not carried in webhooks.\n\n**Graceful-degradation envelope.** Always returns `200` with a `status` discriminator: `OK`, `NOT_AVAILABLE` or `UPSTREAM_UNAVAILABLE`.\n\n**This is PII** (matched-entity names, list sources and dates). Handle and store per your data-handling obligations.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "aml-matches" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "{{individualId}}", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "a8c25f31-6b74-4d09-9e83-1f5c0a7b2d64", "name": "AML & fraud match detail (status OK).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "aml-matches" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"OK\",\n \"fetchedAt\": \"2026-07-29T01:12:44.902Z\",\n \"errorMessage\": null,\n \"matches\": [\n {\n \"matchId\": \"9d4c7e02-38b1-4f6a-95d7-0e2c8a1b6f39\",\n \"category\": \"PEP\",\n \"listName\": \"PEP Class 2\",\n \"listSource\": \"Dow Jones Watchlist\",\n \"confidenceLevel\": 82,\n \"currentState\": \"POTENTIAL_MATCH\",\n \"firstCheckDate\": \"2026-07-23\",\n \"latestCheckDate\": \"2026-07-23\",\n \"details\": [\n {\n \"key\": \"MATCH_NAME\",\n \"value\": \"ROGER HUNG\"\n },\n {\n \"key\": \"MATCH_COUNTRY\",\n \"value\": \"AUS\"\n },\n {\n \"key\": \"MATCH_DATE_OF_BIRTH\",\n \"value\": \"1979\"\n },\n {\n \"key\": \"PEP_POSITION\",\n \"value\": \"Local government official\"\n },\n {\n \"key\": \"MATCH_STRENGTH\",\n \"value\": \"MEDIUM\"\n }\n ]\n },\n {\n \"matchId\": \"1f8a3b60-c927-4d05-8e13-7a4b2c9d5e08\",\n \"category\": \"ADVERSE_MEDIA\",\n \"listName\": \"Adverse Media\",\n \"listSource\": \"Dow Jones Watchlist\",\n \"confidenceLevel\": 61,\n \"currentState\": \"FALSE_POSITIVE\",\n \"firstCheckDate\": \"2026-07-23\",\n \"latestCheckDate\": \"2026-07-23\",\n \"details\": [\n {\n \"key\": \"MATCH_NAME\",\n \"value\": \"R. HUNG\"\n },\n {\n \"key\": \"CATEGORY\",\n \"value\": \"Financial crime\"\n }\n ]\n }\n ],\n \"fraudMatches\": []\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "b93e7a10-4c85-4f26-8d07-2a6b1e9c5f30", "name": "Graceful degradation (status UPSTREAM_UNAVAILABLE).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "aml-matches" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "b7c1f0a2-4e3d-4c5a-9f81-2a6d0e5b7c94", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } }, { "type": "any", "value": "d41e8f60-9a72-4b3c-8e05-1c7fa9b2d830", "key": "individualId", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "3f9a2c18-6b40-4d7e-8c11-95e2a0d4f6b3" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"UPSTREAM_UNAVAILABLE\",\n \"fetchedAt\": \"2026-07-29T01:12:45.117Z\",\n \"errorMessage\": \"The verification provider was temporarily unavailable. Retry shortly.\",\n \"matches\": [],\n \"fraudMatches\": []\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "9c6a2cae-77df-48fa-8b60-aml-evidence-review", "name": "Get authoritative AML evidence for review", "request": { "name": "Get authoritative AML evidence for review", "description": { "content": "Live-fetches authoritative PEP, sanctions, watchlist and adverse-media evidence. A 200 response licenses each opaque resultToken to this same authenticated principal for 15 minutes. Provider unavailability is a 503 EVIDENCE_UNAVAILABLE body with no results key, never an empty successful collection. The screening provider remains the source of truth. Treat the response as personal information and do not log it.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "aml-matches", "evidence" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id" }, { "type": "any", "value": "{{individualId}}", "key": "individualId" } ] }, "header": [ { "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "name": "Authoritative evidence and opaque result token.", "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"fetchedAt\": \"2026-09-02T06:00:00.000Z\",\n \"results\": [\n {\n \"resultToken\": \"aml-profile-result:v1:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"categories\": [\"PEP\"],\n \"group\": {\"listSource\": \"Screening search record\", \"checkType\": \"GROUP\", \"checkFrequency\": \"ADHOC\", \"dataSource\": null, \"confidenceLevel\": 82, \"currentState\": \"POTENTIAL_MATCH\", \"firstCheckDate\": \"2026-09-02\", \"latestCheckDate\": \"2026-09-02\", \"details\": []},\n \"children\": [],\n \"currentDecision\": null,\n \"externalDecision\": \"NONE\",\n \"currentState\": \"POTENTIAL_MATCH\",\n \"lastOperation\": null\n }\n ]\n}" }, { "name": "Provider unavailable (no results key).", "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"EVIDENCE_UNAVAILABLE\",\n \"message\": \"Verification evidence is temporarily unavailable.\",\n \"fields\": []\n}", "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "433bec7d-11a4-4558-9d71-aml-disposition", "name": "Mark AML results false positive or true positive", "request": { "name": "Mark AML results false positive or true positive", "description": { "content": "Available to every authorised channel partner for its own AUSTRAC_CDD verifications. Call the authoritative evidence request first with this same access token, then submit unchanged result tokens within 15 minutes. One idempotent request sends one decision directly to the screening provider: FALSE_POSITIVE means the result does not describe the screened person, TRUE_POSITIVE_ACCEPT means it is a true match and you accept the associated risk and TRUE_POSITIVE_REJECT means it is a true match and you reject the associated risk. Reasoning is required. True-positive PEP evidence requires pepSubtype and true-positive sanctions evidence requires the current complete checklist. Branch on HTTP status and each result outcome; only SYNCED is provider-confirmed.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "aml-matches", "dispositions" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id" }, { "type": "any", "value": "{{individualId}}", "key": "individualId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Partner-Id", "value": "{{partnerId}}" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"idempotencyKey\": \"review-case-4821-v1\",\n \"resultTokens\": [\n \"aml-profile-result:v1:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"\n ],\n \"decision\": \"FALSE_POSITIVE\",\n \"reasoning\": \"Reviewed the current source evidence against the verified identity.\",\n \"pepSubtype\": null,\n \"sanctionsAcknowledgement\": null\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [ { "name": "Provider-confirmed success.", "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"operationId\": \"amlop_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"state\": \"SYNCED\",\n \"requestedDisposition\": \"FALSE_POSITIVE\",\n \"requestedAt\": \"2026-09-02T06:02:00.000Z\",\n \"results\": [{\"resultToken\": \"aml-profile-result:v1:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\", \"outcome\": \"SYNCED\", \"providerCurrentState\": \"FALSE_POSITIVE\", \"providerErrorCode\": null, \"confirmedAt\": \"2026-09-02T06:02:01.000Z\"}]\n}" }, { "name": "Accepted, awaiting provider confirmation.", "status": "Accepted", "code": 202, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"operationId\": \"amlop_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"state\": \"PENDING_CONFIRMATION\",\n \"requestedDisposition\": \"FALSE_POSITIVE\",\n \"requestedAt\": \"2026-09-02T06:02:00.000Z\",\n \"results\": [{\"resultToken\": \"aml-profile-result:v1:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\", \"outcome\": \"PROVIDER_ACCEPTED\", \"providerCurrentState\": \"POTENTIAL_MATCH\", \"providerErrorCode\": null, \"confirmedAt\": null}]\n}" }, { "name": "Mixed provider-confirmed and terminal outcomes.", "status": "Multi-Status", "code": 207, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"operationId\": \"amlop_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"state\": \"PARTIAL_TERMINAL\",\n \"requestedDisposition\": \"TRUE_POSITIVE_REJECT\",\n \"requestedAt\": \"2026-09-02T06:04:00.000Z\",\n \"results\": [{\"resultToken\": \"aml-profile-result:v1:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\", \"outcome\": \"SYNCED\", \"providerCurrentState\": \"TRUE_POSITIVE_REJECT\", \"providerErrorCode\": null, \"confirmedAt\": \"2026-09-02T06:04:01.000Z\"}, {\"resultToken\": \"aml-profile-result:v1:sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\", \"outcome\": \"FAILED_TERMINAL\", \"providerCurrentState\": \"POTENTIAL_MATCH\", \"providerErrorCode\": \"AML_PROVIDER_UNPROCESSABLE\", \"confirmedAt\": null}]\n}" }, { "name": "Evidence stale; fetch evidence again.", "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"EVIDENCE_STALE\",\n \"message\": \"Evidence stale.\",\n \"fields\": []\n}", "_postman_previewlanguage": "json" }, { "name": "Provider read unavailable.", "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"AML_PROVIDER_READ_UNAVAILABLE\",\n \"message\": \"The screening service is temporarily unavailable.\",\n \"fields\": []\n}", "_postman_previewlanguage": "json" }, { "name": "Sanctions checklist required.", "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"SANCTIONS_ACKNOWLEDGEMENT_REQUIRED\",\n \"message\": \"Sanctions acknowledgement required.\",\n \"fields\": []\n}", "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "ff2eb75c-4725-4195-964e-bf1923f66ee6", "name": "Mint and return per-individual verification URLs", "request": { "name": "Mint and return per-individual verification URLs", "description": { "content": "**Mints a fresh verification URL for every individual on the request (or the subset listed in `individualIds`) and returns the URLs synchronously in the response body.**\n\nStatus transitions from `DRAFT` to `VERIFICATIONS_SENT`.\n\n### Dispatch boundary\n\nThe `individuals[].verificationUrl` values are returned **only** in this response. They are:\n\n- never delivered via webhook (rev 11 simplification: no `verification.individual.link_ready` / `link_sent` event exists),\n- never returned by `GET /v1/verifications/{id}` or any other endpoint,\n- never persisted in a queryable form (only an HMAC-SHA-256 digest of the token is stored at rest).\n\n**Capture each URL from the response and dispatch it via your own email, SMS or in-app channel.** Admiin does not send transactional email or SMS for channel-partner-issued verification links. See the **Dispatch Boundary** section in the Verification Quick Start for partner responsibilities (anti-phishing, branding, APP 5 collection notice).\n\nEach token is single-use with a 72-hour TTL. Calling `/links` again mints a fresh token for the same individual and invalidates the previous one.\n\n**Status code is `200`, not `201`.** `/links` mutates an existing verification request — it does not create a new resource.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "0281cddd-13f0-4db3-8607-9df6ac34a967", "name": "Verification URLs minted. The response body contains the URLs — capture them now; they are not returned again.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"status\": \"VERIFICATIONS_SENT\",\n \"individuals\": [\n {\n \"id\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"idvEntityId\": \"\"\n },\n {\n \"id\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\",\n \"idvEntityId\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f2e95ee2-3b92-448b-b76a-468df500253a", "name": "Validation error (e.g. unknown `individualIds`, request already terminal).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "8e70efd6-49be-40e4-9a15-2ac0d760a4e5", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "b23186b6-d833-46cd-8975-38e6ca7394a5", "name": "Forbidden (`X-Partner-Id` mismatch).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" }, { "id": "cbda504e-3f4c-4919-9f20-8436ecfcc91c", "name": "Verification not found.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" }, { "id": "543e8865-4885-40ae-9ca8-aeac6e7ab369", "name": "Conflict — request is in a state that cannot accept `/links` (e.g. already `PASSED`).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "links" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"individualIds\": [\n \"\",\n \"\"\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"CONFLICT\",\n \"message\": \"The request conflicts with the current resource state.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "0c8d5b21-4e6a-4f39-9d02-7b1c3a5e8f64", "name": "Generate the entity (customer) verification report", "request": { "name": "Generate the entity (customer) verification report", "description": { "content": "Renders the branded **Entity Verification Report** for a whole verification request and returns a presigned download URL that expires in **15 minutes**.\n\nThis is the CUSTOMER-level document: the business being verified, its registry identity, how the party structure was determined, every party with their role and outcome, and the decision trail. The per-individual report (`POST /v1/verifications/{id}/individuals/{individualId}/report`) is the companion document for one natural person, in full check detail.\n\n**POST, not GET** — generation writes a PDF and appends an audit entry. Repeat calls are cheap: an unchanged request returns `cached: true` and the same rendering.\n\n**Availability.** `AUSTRAC_CDD` mode, at least one party, past `DRAFT`. A request still in progress renders with a provisional banner rather than being refused.\n\n**Party names.** Shown for structures determined from the business register. For a party list you supplied yourself, names are not shown — Admiin does not collect personal details for your parties (APP 3.2); match them with the `externalId` reference column.\n\n**Handle the URL as bearer material.** Anyone holding it can fetch the report until it expires. Download and store the file yourself rather than emailing or pasting the link.\n\n**Partner ID source.** The `X-Partner-Id` header is required and is validated against the OAuth principal.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [ { "id": "b3f7c1e0-52a9-4d84-8c17-6e0a9d2b4f51", "name": "Report generated (or served from cache). The `url` expires in 15 minutes.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"url\": \"https://example-verification-reports.s3.ap-southeast-2.amazonaws.com/...\",\n \"generatedAt\": \"2026-09-04T04:21:09.318Z\",\n \"dataAsOf\": \"2026-09-04T04:21:08.774Z\",\n \"cached\": false\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "7d2a4e93-118b-4c60-a5f3-92d7be418c05", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "f01c6b48-9a35-4e72-bd18-3c5f7a0e2d96", "name": "Forbidden (`X-Partner-Id` mismatch or verification not owned by this partner).", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" }, { "id": "2e9b7f36-6c40-41d5-8a93-0b4d1e7c5a82", "name": "Verification not found.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" }, { "id": "5a1d8c74-3f62-4b09-9e57-8d0a2c6b1f43", "name": "`REPORT_NOT_AVAILABLE` — the request is not in a reportable state, or the report is not enabled in this environment.", "originalRequest": { "url": { "path": [ "v1", "verifications", ":id", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"code\": \"CONFLICT\",\n \"message\": \"The request conflicts with the current resource state.\",\n \"fields\": []\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "d6e0c186-cef8-4c67-9b5b-957fcdf8fab2", "name": "Generate the branded verification report for an individual", "request": { "name": "Generate the branded verification report for an individual", "description": { "content": "Renders the branded Individual Verification Report PDF for one individual and returns a short-lived presigned download URL.\n\n**POST, not GET.** Generation is a side effect: it writes the rendered PDF to object storage and appends an audit entry. Repeat calls are cheap — see caching below.\n\n**The URL expires in 15 minutes.** Download it promptly and store the file yourself if you need to retain it. Do not embed the URL in an email, a ticket or anything long-lived: it is bearer material for its lifetime and anyone holding it can fetch the report.\n\n**Cached by render input, not by time.** `cached: true` means an identical report had already been rendered for the same underlying data and was served again. When the underlying verification data changes, the next call re-renders. `dataAsOf` tells you when the data behind the PDF was read.\n\n**Availability.** The individual must have completed checks — `PASSED`, `MANUALLY_PASSED`, `FAILED`, `MANUALLY_FAILED`, `MANUAL_REVIEW` or `LOCKED_OUT`. Anything earlier returns `409 REPORT_NOT_AVAILABLE`. The report renders the provider's raw findings regardless of any manual override applied in your workflow.\n\n**This is PII.** The PDF contains identity-document and screening detail for a natural person. Handle and store it per your data-handling obligations.\n\n**Partner ID source.** The `X-Partner-Id` header is required and is validated against the OAuth principal.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":id", "individuals", ":individualId", "report" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } }, { "type": "any", "value": "{{individualId}}", "key": "individualId", "disabled": false, "description": { "content": "(Required) individualId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Verification (guest)", "description": "Public token-based verification endpoints (no partner auth).", "item": [ { "id": "7353e992-74ef-461b-b687-bd9a563035aa", "name": "Fetch verification context (guest)", "request": { "name": "Fetch verification context (guest)", "description": { "content": "**Guest endpoint** consumed by the hosted Next.js verification page. Not a partner integration target — partners do not call this directly. Documented here so partner engineers understand what happens when the end user opens the URL captured from the `/links` response.\n\nThe token is the path segment of the URL returned by `/links`. It is looked up by HMAC-SHA-256 digest server-side; the raw value never leaves the request. No `X-Partner-Id` header and no authentication.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "486be2eb-bf95-40f4-a358-c8f91de29a0d", "name": "Verification context for the guest page.", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"mode\": \"TPB_POI\",\n \"partnerId\": \"\",\n \"sessionToken\": \"\",\n \"entityName\": \"\",\n \"partnerBranding\": {}\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "b698025a-88a8-4e75-bed9-c41b81f68118", "name": "Token is missing or malformed.", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "3f7a6497-53cf-48d8-9327-dfa287977f4d", "name": "Token is invalid, expired or revoked (returns a typed terminal state).", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "0db94975-e614-4002-9707-9ec125f774ca", "name": "Renew an expired verification link (guest)", "request": { "name": "Renew an expired verification link (guest)", "description": { "content": "**Guest endpoint.** When a verification URL has expired (default TTL 72 hours), the guest page calls this endpoint with the original token in the path to request a fresh URL bound to the same identity.\n\nThe renew response carries a freshly-minted `verificationUrl`. Partners typically surface a \"request a new link\" affordance to the end user in their own dispatch flow; that affordance ultimately leads back to this endpoint.\n\nThe previous token is invalidated by this call. No request body — the token is the path segment.\n", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", "by-token", ":token", "renew" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "token", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": { "type": "noauth" } }, "response": [ { "id": "961eb682-e923-43c9-98cf-9c363ec07046", "name": "New verification URL minted.", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token", "renew" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"success\": \"\",\n \"verificationUrl\": \"\",\n \"verificationTokenExpiresAt\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "40e29329-97f3-48c5-ac8c-94741123c6b8", "name": "Token is missing or malformed.", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token", "renew" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"BAD_REQUEST\",\n \"message\": \"The request is invalid.\",\n \"fields\": []\n}" }, { "id": "06275d6d-cc02-424d-9060-e46fd11443e3", "name": "Token is invalid or already consumed.", "originalRequest": { "url": { "path": [ "v1", "verifications", "by-token", ":token", "renew" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "token" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"NOT_FOUND\",\n \"message\": \"The requested resource was not found.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Deed Analysis", "description": { "content": "Upload a trust deed and get its controlling parties back.\n\nA trust's controlling parties are exactly what ASIC and the ABR cannot tell you, so this is the missing input to the manual verification path.\n\n**Three steps:** create -> upload -> start.\n\n1. `POST /v1/deed-analyses` returns the job and a presigned upload.\n2. `PUT` the PDF to `upload.url`, replaying `upload.headers` **verbatim** — same keys, same values. Rebuilding your own header set returns a 403.\n3. `POST /v1/deed-analyses/{id}/start` validates the file (25 MB, 150 pages, real PDF) and begins analysis.\n\n**The parties arrive only in the `deed-analysis.completed` webhook.** No endpoint returns them, they are not stored, and they cannot be re-sent — persist them when the webhook lands. `GET /v1/deed-analyses/{id}` gives you status and counts so you can confirm you received them all.\n\n**What the completed webhook carries.** Each party has a role, whether it is an individual or a company, a confidence level, and a page plus a verbatim quote so a reviewer can check it. A company party also carries `acn` and `abn` when the deed prints them — digits only, check-digit validated, `null` if the number fails, so you can run a KYB lookup without parsing the quote. Every party carries `address.full` when the deed states one: an object rather than a bare string, so structured components can be added later without breaking you.\n\nThe payload also names the trust itself in a `trust` block — name, ABN, structure, governing `jurisdiction` and the establishment and vesting dates as printed. It is `null` when the deed names no trust, which is normal for an amending deed.\n\n**No date of birth is ever returned**, even if a deed prints one.", "type": "text/plain" }, "item": [ { "id": "d41762bd-6bdf-44fb-a7c0-02afa7d5ff01", "name": "Create a deed analysis (get upload URL)", "request": { "name": "Create a deed analysis (get upload URL)", "description": { "content": "Creates the job and returns a signed PUT valid for 15 minutes.\n\nReplay every key and value in `upload.headers` verbatim on the PUT. Do not build your own set — any drift returns a 403.\n\nThe deed and extracted working text are deleted when analysis completes, fails or is discarded. An upload that is not started is ordinarily removed within two hours, with a seven-day automatic expiry as a final backstop. Temporary processing results may remain for up to seven days. Webhook payloads are retained only for delivery retries, then scheduled for asynchronous deletion after about 33 hours under the standard retry window.\n\nNo filename is accepted or stored: a deed filename is very often a family name. Correlate on `deedAnalysisId`.", "type": "text/plain" }, "url": { "path": [ "v1", "deed-analyses" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"verificationRequestId\": \"{{verificationRequestId}}\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [] }, { "id": "09ed1805-0d29-4b30-ab1a-bb12f3e279cd", "name": "Start the analysis", "request": { "name": "Start the analysis", "description": { "content": "Call once the PUT has succeeded.\n\nValidates size (25 MB), page count (150) and that it is a real PDF. All four rejections (`UPLOAD_NOT_FOUND`, `FILE_TOO_LARGE`, `NOT_A_PDF`, `TOO_MANY_PAGES`) leave the analysis `AWAITING_UPLOAD`, so you can fix the file and upload again against the same id.\n\nCalling it twice is safe — the second call returns current state rather than starting a second analysis.", "type": "text/plain" }, "url": { "path": [ "v1", "deed-analyses", "{{deedAnalysisId}}", "start" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST" }, "response": [] }, { "id": "72b27409-63ae-4b5e-8ffb-0dec08f6de28", "name": "Get a deed analysis", "request": { "name": "Get a deed analysis", "description": { "content": "Status and counts. **Never returns parties** — those come only in the webhook.\n\nPoll this if you also want a fallback to the webhook, and stop at `REVIEW_READY`, `FAILED`, `DISCARDED` or `EXPIRED`. `partyCount` lets you confirm the webhook covered everything; `documentPurgedAt` tells you the source document is gone.", "type": "text/plain" }, "url": { "path": [ "v1", "deed-analyses", "{{deedAnalysisId}}" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [] }, { "id": "affa8a5a-b164-4625-962d-1ae5cdb1c046", "name": "List deed analyses", "request": { "name": "List deed analyses", "description": { "content": "Your analyses, newest first. Optionally filter by `status`.", "type": "text/plain" }, "url": { "path": [ "v1", "deed-analyses" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "status", "value": "REVIEW_READY", "disabled": true } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [] }, { "id": "5cde5067-9815-4a24-89bf-8aec13604174", "name": "Discard a deed analysis", "request": { "name": "Discard a deed analysis", "description": { "content": "Destroys the deed PDF and extracted working text and marks the analysis `DISCARDED`.\n\nUse this when the wrong deed was uploaded, the request was withdrawn or the analysis no longer has a valid business purpose. It is most useful before analysis starts because completed and failed analyses have already deleted their document content.\n\nThe status record is kept so the request and any charge remain reconcilable. Discard does not recall a delivered webhook or reverse an existing charge. Idempotent.", "type": "text/plain" }, "url": { "path": [ "v1", "deed-analyses", "{{deedAnalysisId}}" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) Partner id. Must match the authenticated principal.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE" }, "response": [] } ] }, { "name": "Billing", "description": "Charges and pricing.", "item": [ { "id": "e60ef38f-ae84-4bb5-92ba-f30fc298109d", "name": "List charges", "request": { "name": "List charges", "description": { "content": "Lists the channel partner's charges. Partner ID comes from the\n`X-Partner-Id` header and is cross-checked against the authenticated\nprincipal — a mismatch returns `403 Forbidden`.\n\nThe generic `charges` resource scales beyond verification; use the\noptional `?type=` filter (default `verification`) to scope the result.\n", "type": "text/plain" }, "url": { "path": [ "v1", "charges" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Charge type filter. Defaults to `verification`.", "type": "text/plain" }, "key": "type", "value": "verification" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "fromDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "toDate", "value": "" }, { "disabled": true, "description": { "content": "Scopes the result to charges attributed to a single contact (sub-customer). Combines (AND) with the other filters.", "type": "text/plain" }, "key": "contactId", "value": "{{contactId}}" }, { "disabled": true, "description": { "content": "Scopes the result to charges captured by a specific billing run — pairs with the `billingRunId` on the `contact.billing.*` webhook events for charge↔run reconciliation.", "type": "text/plain" }, "key": "billingRunId", "value": "" }, { "disabled": true, "description": { "content": "Filters by charge payment status: PENDING, PENDING_CAPTURE, SUCCEEDED or FAILED. An unknown value returns 400.", "type": "text/plain" }, "key": "paymentStatus", "value": "SUCCEEDED" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "05aa1c40-0bb0-4e5f-99a2-731a3881060b", "name": "The partner's charges.", "originalRequest": { "url": { "path": [ "v1", "charges" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Charge type filter. Defaults to `verification`.", "type": "text/plain" }, "key": "type", "value": "verification" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "fromDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "toDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "599935b6-cd8c-431e-b4a2-86dc688f3446", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "charges" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Charge type filter. Defaults to `verification`.", "type": "text/plain" }, "key": "type", "value": "verification" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "fromDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "toDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "f4ca4d51-48c1-49bf-b37f-75d4f8f10b79", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "charges" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "Charge type filter. Defaults to `verification`.", "type": "text/plain" }, "key": "type", "value": "verification" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "fromDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "toDate", "value": "" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "limit", "value": "20" }, { "disabled": false, "description": { "content": "", "type": "text/plain" }, "key": "from", "value": "0" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "e0123421-0819-4058-a88c-09a4bbf2aeb4", "name": "Export charges as CSV", "request": { "name": "Export charges as CSV", "description": { "content": "Exports the channel partner's charges as a CSV file. **Synchronous** —\nthe CSV body is returned directly in the `200` response with\n`Content-Type: text/csv`; there is no async-job lifecycle. Partner ID\ncomes from the `X-Partner-Id` header.\n", "type": "text/plain" }, "url": { "path": [ "v1", "charges", "export" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "text/csv" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"fromDate\": \"\",\n \"toDate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": null }, "response": [ { "id": "37b4064a-9817-4a60-85b0-70e78d0e55cd", "name": "CSV export of the partner's charges.", "originalRequest": { "url": { "path": [ "v1", "charges", "export" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "text/csv" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"fromDate\": \"\",\n \"toDate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "text/csv" } ], "body": "", "cookie": [], "_postman_previewlanguage": "text" }, { "id": "ecc70085-18de-4911-8ecb-935694736a31", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "charges", "export" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"fromDate\": \"\",\n \"toDate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "67cb36ba-c52f-49d0-962b-bf1348a13ad6", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "charges", "export" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"fromDate\": \"\",\n \"toDate\": \"\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "e6780499-3e24-4343-adb9-fd8b598bc668", "name": "Get partner pricing", "request": { "name": "Get partner pricing", "description": { "content": "Returns the merged pricing for the channel partner (partner-specific\noverrides layered over GLOBAL defaults). Partner ID comes from the\n`X-Partner-Id` header.\n", "type": "text/plain" }, "url": { "path": [ "v1", "pricing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "38695799-9de7-46a0-bfb7-e6023e0532de", "name": "The partner's pricing items.", "originalRequest": { "url": { "path": [ "v1", "pricing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [], "cookie": [], "_postman_previewlanguage": "text" }, { "id": "01173c2a-a045-4783-838d-b3f67954c53c", "name": "Unauthorized.", "originalRequest": { "url": { "path": [ "v1", "pricing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"GATEWAY_UNAUTHORIZED\",\n \"message\": \"Authentication is required.\",\n \"fields\": []\n}" }, { "id": "48db9a4b-9e50-44dd-b3ec-53881c69c9d1", "name": "Forbidden (`X-Partner-Id` does not match the authenticated principal).", "originalRequest": { "url": { "path": [ "v1", "pricing" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "_postman_previewlanguage": "json", "body": "{\n \"code\": \"FORBIDDEN\",\n \"message\": \"You do not have permission to perform this action.\",\n \"fields\": []\n}" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Webhooks", "description": "Webhook notification history, category filters and retries.", "item": [ { "id": "c07b2f53-164c-4d8c-84b0-d55d9ac0e2e3", "name": "List webhook notifications", "request": { "name": "List webhook notifications", "description": { "content": "Returns webhook notification delivery attempts for the authenticated partner. Partners and client-credential integrations receive only their own notifications. This endpoint provides a global view across all event categories.", "type": "text/plain" }, "url": { "path": [ "v1", "webhook-notifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "eventCategory", "value": "PAYMENTS", "description": { "content": "Optional webhook event category filter.", "type": "text/plain" }, "disabled": true } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "4a4b9090-5a75-4ba3-ab47-301787280e2c", "name": "Webhook notifications", "originalRequest": { "url": { "path": [ "v1", "webhook-notifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"\",\n \"paymentId\": \"\",\n \"partnerId\": \"\",\n \"endpoint\": \"\",\n \"eventCategory\": \"PAYMENTS\",\n \"status\": \"FAILED\",\n \"attemptCount\": \"\",\n \"attempts\": [\n {\n \"attempt\": \"\",\n \"timestamp\": \"\",\n \"statusCode\": \"\",\n \"success\": \"\",\n \"error\": \"\"\n },\n {\n \"attempt\": \"\",\n \"timestamp\": \"\",\n \"statusCode\": \"\",\n \"success\": \"\",\n \"error\": \"\"\n }\n ],\n \"payload\": {\n \"id\": \"\",\n \"status\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"commissionAmount\": \"\",\n \"payoutFailureReason\": \"\",\n \"declinedReason\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"metadata\": {\n \"key_0\": \"\",\n \"key_1\": \"\"\n }\n },\n \"lastAttemptAt\": \"\",\n \"lastErrorMessage\": \"\",\n \"responseStatusCode\": \"\",\n \"nextAttemptAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n },\n {\n \"id\": \"\",\n \"paymentId\": \"\",\n \"partnerId\": \"\",\n \"endpoint\": \"\",\n \"eventCategory\": \"PAYMENTS\",\n \"status\": \"RETRYING\",\n \"attemptCount\": \"\",\n \"attempts\": [\n {\n \"attempt\": \"\",\n \"timestamp\": \"\",\n \"statusCode\": \"\",\n \"success\": \"\",\n \"error\": \"\"\n },\n {\n \"attempt\": \"\",\n \"timestamp\": \"\",\n \"statusCode\": \"\",\n \"success\": \"\",\n \"error\": \"\"\n }\n ],\n \"payload\": {\n \"id\": \"\",\n \"status\": \"\",\n \"amount\": \"\",\n \"cardFeeAmount\": \"\",\n \"commissionAmount\": \"\",\n \"payoutFailureReason\": \"\",\n \"declinedReason\": \"\",\n \"payerDisplayName\": \"\",\n \"paymentFor\": \"\",\n \"redirectUrl\": \"\",\n \"metadata\": {\n \"key_0\": \"\"\n }\n },\n \"lastAttemptAt\": \"\",\n \"lastErrorMessage\": \"\",\n \"responseStatusCode\": \"\",\n \"nextAttemptAt\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\"\n }\n ],\n \"total\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code < 300) {", " var b = {}; try { b = pm.response.json(); } catch (e) {}", " if (b.items && b.items[0] && b.items[0].id != null) pm.environment.set('notificationId', b.items && b.items[0] && b.items[0].id);", "}" ] } } ], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a5bd38bb-4d42-4949-86a5-e4b1cb23a4cb", "name": "Retry a webhook notification", "request": { "name": "Retry a webhook notification", "description": { "content": "Requeues a webhook notification for delivery by notification ID only. This endpoint provides a simpler way to retry notifications without requiring the payment ID. Partners and client-credential integrations are limited to their own notifications.", "type": "text/plain" }, "url": { "path": [ "v1", "webhook-notifications", ":id", "retry" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{notificationId}}", "key": "id", "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the notification owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [ { "id": "c00cbd7b-d8e4-4871-bc94-55a355c84fc8", "name": "Notification queued for delivery", "originalRequest": { "url": { "path": [ "v1", "webhook-notifications", ":id", "retry" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) ", "type": "text/plain" }, "type": "any", "value": "", "key": "id" } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the notification owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: oauth2", "type": "text/plain" }, "key": "Authorization", "value": "" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"\",\n \"endpoints\": \"\",\n \"createdCount\": \"\",\n \"newNotificationIds\": [\n \"\",\n \"\"\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "f28abca7-6649-48e4-9f70-3949978066af", "name": "List webhook notifications for a payment", "request": { "name": "List webhook notifications for a payment", "description": { "content": "Returns delivery attempts to the partner-configured webhook endpoints for the specified channel payment. Administrators can inspect any payment. Partners and client-credential integrations may only access notifications for their own payments. The nested webhook-notifications path is kept under the legacy `channel-payments` prefix and is not part of the W8 prefix-drop — there is no canonical alias.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-payments", ":id", "webhook-notifications" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a9c77e46-a644-43df-ad7d-85fbd2c22c48", "name": "Retry a webhook notification for a payment", "request": { "name": "Retry a webhook notification for a payment", "description": { "content": "Requeues a webhook notification for delivery. This endpoint can be used to manually resend notifications that previously failed. Administrators can retry any payment while partners and client-credential integrations are limited to their own payments. The nested webhook-notifications path is kept under the legacy `channel-payments` prefix and is not part of the W8 prefix-drop — there is no canonical alias.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-payments", ":id", "webhook-notifications", ":notificationId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{paymentId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } }, { "type": "any", "value": "{{notificationId}}", "key": "notificationId", "disabled": false, "description": { "content": "(Required) notificationId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials. The partner id must match the payment owner and the OAuth client used to fetch the token.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "71cee834-2d4d-4d61-bf51-80d03a192ea8", "name": "List webhook notifications for a partner", "request": { "name": "List webhook notifications for a partner", "description": { "content": "Same handler and response as `GET /v1/webhook-notifications`, addressed by partner id. A partner user or client-credentials integration may only supply its own partner id; any other id receives `403`. For client-credentials calls the `X-Partner-Id` header must equal `{id}`.", "type": "text/plain" }, "url": { "path": [ "v1", "channel-partners", ":id", "webhook-notifications" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "eventCategory", "value": "PAYMENTS" }, { "disabled": true, "key": "subjectType", "value": "payment", "description": { "content": "Limit results to one subject type.", "type": "text/plain" } }, { "disabled": true, "key": "subjectId", "value": "", "description": { "content": "Limit results to one subject id (pair with `subjectType`).", "type": "text/plain" } }, { "disabled": true, "key": "paymentId", "value": "", "description": { "content": "Legacy filter on the payment id. Prefer `subjectType=payment` with `subjectId`.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{partnerId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Required when authenticating with client credentials; must equal `{id}`.", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "id": "df0d5b7f-2546-4850-aa5d-d751630260fb", "name": "Monitoring", "item": [ { "id": "60b412bc-02aa-472d-91f2-5b971323e50d", "name": "Get monitoring for one verification", "request": { "name": "Get monitoring for one verification", "description": { "content": "Returns monitoring settings and coverage for one verification and\nproduct.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "f3ea7d5f-7900-4fea-9469-610177f3db60", "name": "Enable or disable a product for one verification", "request": { "name": "Enable or disable a product for one verification", "description": { "content": "`ENABLED` requires the matching preview token and confirmed authority.\nThe billing-consent gate is re-run before acceptance. Provider work is\nasynchronous. `DISABLED` needs no preview and remains available when\nbilling consent is unavailable. Reusing an idempotency key with another\ncommand returns `409 IDEMPOTENCY_KEY_REUSED`.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"product\": \"INDIVIDUAL_AML\",\n \"state\": \"ENABLED\",\n \"idempotencyKey\": \"\",\n \"authorityConfirmed\": true,\n \"previewToken\": \"\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "c7e8bf36-afec-4160-bc95-f0628e962ada", "name": "Preview one verification monitoring command", "request": { "name": "Preview one verification monitoring command", "description": { "content": "Returns an expiring opaque token bound to the exact verification,\nproduct, payer, cohort, price and command. Preview makes no screening\nservice call and creates no charge. Two enabled verifications for one payer may\neach create their own monthly charge.\n\nRepeating an identical preview is safe. The same authority is re-issued\nwith a fresh token, so a token that expired before it was used can\nalways be replaced. Once that authority has been accepted by\n`PATCH /v1/verifications/{verificationId}/monitoring` it is spent, and\nrepeating the preview answers `409\nMONITORING_AUTHORITY_ALREADY_ACCEPTED` rather than authorising the same\ncharge twice.\n\nDisabling monitoring and enabling it again is a separate authorisation,\nnot a repeat. Preview it as normal: you get a new authority and a new\ntoken, and the earlier one stays spent.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "preview" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"product\": \"INDIVIDUAL_AML\",\n \"command\": {\n \"type\": \"SET_POLICY\",\n \"state\": \"ENABLED\"\n }\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b65c177e-f579-471a-a570-ccd01a699e86", "name": "List subjects for one verification and product", "request": { "name": "List subjects for one verification and product", "description": { "content": "List subjects for one verification and product", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "subjects" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "994999bd-ba17-4d58-b3cc-0be199f9299c", "name": "Get one verification monitoring subject", "request": { "name": "Get one verification monitoring subject", "description": { "content": "Get one verification monitoring subject", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "subjects", ":subjectId" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } }, { "type": "any", "value": "{{subjectId}}", "key": "subjectId", "disabled": false, "description": { "content": "(Required) subjectId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "87f641f9-f862-48e3-84eb-d736106d2ebb", "name": "Exclude or re-include one verification subject", "request": { "name": "Exclude or re-include one verification subject", "description": { "content": "Re-inclusion while enabled requires a matching preview token.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "subjects", ":subjectId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } }, { "type": "any", "value": "{{subjectId}}", "key": "subjectId", "disabled": false, "description": { "content": "(Required) subjectId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"product\": \"INDIVIDUAL_AML\",\n \"exclusion\": \"NONE\",\n \"idempotencyKey\": \"\",\n \"authorityConfirmed\": true\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a9ca9cf5-37ce-4a05-9912-a12beecf8349", "name": "List cases for one verification and product", "request": { "name": "List cases for one verification and product", "description": { "content": "List cases for one verification and product", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "alerts" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } }, { "disabled": true, "key": "status", "value": "OPEN" }, { "disabled": true, "key": "limit", "value": "" }, { "disabled": true, "key": "nextToken", "value": "" } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "0b75933c-99a7-44ae-b467-072515a9fb9b", "name": "Get one verification monitoring case", "request": { "name": "Get one verification monitoring case", "description": { "content": "Get one verification monitoring case", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "alerts", ":alertId" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "aafda333-b589-4576-8379-02e6a5db8b37", "name": "Get evidence for one verification monitoring case", "request": { "name": "Get evidence for one verification monitoring case", "description": { "content": "Get evidence for one verification monitoring case", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "alerts", ":alertId", "evidence" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "(Required)", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "e54450d0-667a-4652-8ff3-04cf4650d009", "name": "Classify one verification monitoring case", "request": { "name": "Classify one verification monitoring case", "description": { "content": "Classify one verification monitoring case", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "alerts", ":alertId", "classify" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"disposition\": \"FALSE_POSITIVE\",\n \"reason\": \"\",\n \"product\": \"INDIVIDUAL_AML\",\n \"idempotencyKey\": \"\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "e51f4b35-3cd1-4e08-9930-ade2c8a8ecb0", "name": "Simulate verification monitoring in non-production", "request": { "name": "Simulate verification monitoring in non-production", "description": { "content": "Non-production only. Operates only on already materialised subjects in\nthis verification partition, queues provider-shaped local events and\nmakes no screening service call or charge.", "type": "text/plain" }, "url": { "path": [ "v1", "verifications", ":verificationId", "monitoring", "simulate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{verificationId}}", "key": "verificationId", "disabled": false, "description": { "content": "(Required) verificationId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"product\": \"INDIVIDUAL_AML\",\n \"action\": \"ENROL\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a6a5675e-c8eb-497b-9e0f-15e4da8578df", "name": "Get a contact's monitoring settings", "request": { "name": "Get a contact's monitoring settings", "description": { "content": "**Deprecated compatibility route.** New integrations must use\n`/v1/verifications/{verificationId}/monitoring`. Contact-wide reads and\nwrites are independently disabled by default and cannot be used to arm\nmore than one verification.\n\nReturns the contact's monitoring override, the partner default it inherits from, the resolved effective intent and a summary of the subject population in scope for that contact.\n\n**The `{id}` on every monitoring route is the Admiin contact id** — the `id` field on the contact object, returned by `POST /v1/contacts` and on every row of `GET /v1/contacts`. It is NOT your `externalId` and NOT a verification request id; both are refused with `404 CONTACT_NOT_FOUND`. If you hold only your own key, `GET /v1/contacts?externalId=` resolves it.\n\n**Environment availability.** Ongoing monitoring runs only in the screening provider's production environment. Sandbox environments point at the provider's test environment, which does not support it and cannot simulate a change to a customer's AML status, so a sandbox contact never leaves `Reconciliation pending`, the counters stay at zero and no alert opens. The settings, alert and evidence routes are all live and their contracts are stable, so you can integrate against them; only the provider-driven events are absent. Use `POST /v1/contacts/{id}/monitoring/simulate` to open a real alert in a sandbox, and the portal's Developer page to fire signed `monitoring.*` fixtures at your endpoint.\n\nA contact that has never had an override returns `entityOverride: null`; `effectiveIntent` always carries a concrete answer.\n\nReading an archived contact is allowed — you are entitled to see what is still being screened. Writing one is not.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The Admiin contact id — the `id` returned by `POST /v1/contacts`, not your `externalId` and not a verification request id.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "65f3bcac-8455-40bc-9f58-4ccad90c8ceb", "name": "Set a contact's monitoring override", "request": { "name": "Set a contact's monitoring override", "description": { "content": "Sets the contact's override. `INHERIT` returns the contact to the partner default.\n\nRecords INTENT. The provider subscription is reconciled asynchronously, so the count buckets in the response describe the population as it stands now, not as it will stand once reconciliation completes.\n\n`idempotencyKey` is required. Re-sending the same key returns the original result without applying a second change.\n\nActivation also requires `authorityConfirmed`, `authorityVersion` and the preview's `expectedEligibleSubjectCount`. Anything else is refused with `UNSUPPORTED_FIELD`.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The Admiin contact id — the `id` returned by `POST /v1/contacts`, not your `externalId` and not a verification request id.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"override\": \"INHERIT\",\n \"product\": \"INDIVIDUAL_AML\",\n \"idempotencyKey\": \"\",\n \"authorityConfirmed\": true\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "420a46d3-729e-415d-b92f-985847721bf4", "name": "Preview contact monitoring cost", "request": { "name": "Preview contact monitoring cost", "description": { "content": "Returns the current eligible individual count, the USD monthly unit rate, the estimated monthly total and the authority version required to activate monitoring. Fetch a new preview if activation returns `ELIGIBLE_SUBJECT_COUNT_CHANGED`.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "preview" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "31801560-5866-437c-b9af-efc4b9607be8", "name": "List a contact's monitoring subjects", "request": { "name": "List a contact's monitoring subjects", "description": { "content": "Returns tenant-safe subject state. Provider identifiers and raw evidence are never returned.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "subjects" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "a2b46068-189a-4660-87e9-eb6fcdc64c0d", "name": "Get a contact monitoring subject", "request": { "name": "Get a contact monitoring subject", "description": { "content": "Get a contact monitoring subject", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "subjects", ":subjectId" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } }, { "type": "any", "value": "{{subjectId}}", "key": "subjectId", "disabled": false, "description": { "content": "(Required) subjectId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "5a40e683-9f0f-49a1-be10-9bbb8ad440e7", "name": "Set a person monitoring override", "request": { "name": "Set a person monitoring override", "description": { "content": "Sets `INHERIT`, `DISABLED` or `ENABLED_PEP_SANCTIONS` for this person. An increase requires authority confirmation and an idempotency key. The actor is derived from the access token.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "subjects", ":subjectId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) id", "type": "text/plain" } }, { "type": "any", "value": "{{subjectId}}", "key": "subjectId", "disabled": false, "description": { "content": "(Required) subjectId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"override\": \"INHERIT\",\n \"product\": \"INDIVIDUAL_AML\",\n \"idempotencyKey\": \"\",\n \"authorityConfirmed\": true\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "2ea58f78-cd31-4e9b-bb57-c36136cb4061", "name": "Simulate a monitoring event (non-production only)", "request": { "name": "Simulate a monitoring event (non-production only)", "description": { "content": "Performs the two steps the screening provider would otherwise perform, so the monitoring loop can be exercised where the provider cannot produce an event.\n\n**Returns `403` in production, always.** This route does not exist in the production deployment and the handler refuses a production environment before it reads anything.\n\n`action` selects what runs:\n\n- `ENROL` — records the subscription state a successful provider reconcile would have written for every eligible subject on the contact. A `monitoring.subscription.enabled` webhook follows through the normal fan-out.\n- `ALERT` — delivers a provider-shaped notification into the real inbound webhook path, so provenance classification, the evidence read, case creation and fan-out all run exactly as they would in production.\n- `BOTH` (default) — `ENROL` then `ALERT`.\n\n**Evidence is real, not fabricated.** The alert flow reads the subject's actual match containers from the provider, so a contact whose subject has no AML result set produces no alert. That is the correct production behaviour and is worth observing.\n\nMonitoring must already be enabled for the contact or the partner: an effective intent of `DISABLED` is refused with `409 MONITORING_NOT_ENABLED` rather than being enrolled implicitly.\n\n**Per product.** `product` selects which subjects are simulated, the same way it does on the settings routes:\n\n- `INDIVIDUAL_AML` (default) — every verified individual on the contact with a provider entity is enrolled and, on `ALERT`, receives a risk-change notification.\n- `BUSINESS_DETAILS_OWNERSHIP` — exactly one organisation subject is seeded from the contact's latest completed business lookup, through the same producer a real lookup completion uses, and, on `ALERT`, receives an ownership-change notification that runs the real inbound business path. No individual subject is written. A contact with no completed business lookup that produced an organisation is refused with `409 SIMULATE_NO_ORGANISATION`; the simulation never invents one. Available only while business monitoring is enabled for the environment (`503 BUSINESS_MONITORING_UNAVAILABLE` otherwise).", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "simulate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The contact id. A verification request id is not a contact id and is refused.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"action\": \"ENROL\",\n \"product\": \"INDIVIDUAL_AML\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "51684fca-f08c-428e-8789-5116db1a78c5", "name": "List a contact's monitoring alerts", "request": { "name": "List a contact's monitoring alerts", "description": { "content": "Returns the compliance cases raised against this contact by ongoing screening, newest first.\n\nAlerts are always contact-scoped. There is no partner-wide alert feed — a case belongs to a contact, and you reach it through that contact.\n\nReading an archived contact's alerts is allowed: you are entitled to see the cases raised while the relationship was live.\n\nThe response carries no provider identifiers, no match content and no evidence fingerprint. Match detail is served only by the separate `/evidence` route.\n\n**The listing is scoped to one product.** Omit `product` for `INDIVIDUAL_AML` cases; pass `product=BUSINESS_DETAILS_OWNERSHIP` for ownership cases, which stay behind the business monitoring control. The route never mixes products in one page.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "alerts" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML", "description": { "content": "The product whose cases to list. Defaults to `INDIVIDUAL_AML`. An unrecognised value is refused with `400 INVALID_PRODUCT` rather than silently defaulting; `BUSINESS_DETAILS_OWNERSHIP` answers `503 BUSINESS_MONITORING_UNAVAILABLE` while that control is off.", "type": "text/plain" } }, { "disabled": true, "key": "status", "value": "OPEN", "description": { "content": "Filter to one case status. An unrecognised value is refused rather than silently returning nothing.", "type": "text/plain" } }, { "disabled": true, "key": "limit", "value": "" }, { "disabled": true, "key": "nextToken", "value": "", "description": { "content": "Opaque cursor from a previous page. A malformed cursor is refused rather than restarting at page one.", "type": "text/plain" } } ], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The contact id. A verification request id is not a contact id and is refused.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "d8bb2e59-4f67-4991-a4ad-a1d82e977b33", "name": "Get one monitoring alert", "request": { "name": "Get one monitoring alert", "description": { "content": "Returns a single compliance case.\n\nThe alert is addressed through your own partition, so an alert id belonging to another partner answers `404` rather than `403` — there is nothing to leak.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "alerts", ":alertId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The Admiin contact id — the `id` returned by `POST /v1/contacts`, not your `externalId` and not a verification request id.", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "e645b09a-311a-4b8c-acf7-840bd8867c94", "name": "Classify a monitoring alert", "request": { "name": "Classify a monitoring alert", "description": { "content": "Records your adjudication of a compliance case.\n\n**You must fetch the evidence first.** This route refuses with `409 EVIDENCE_STALE` unless the calling principal fetched `/evidence` for this alert within the last 15 minutes, that fetch succeeded, and the match set has not changed since. This is a deliberate control: a reviewer who has not seen the matches cannot close a case, and an empty or unavailable evidence response never licenses a classification.\n\n**The reviewer is recorded from your authenticated principal.** There is no reviewer field on this request and one will not be accepted.\n\nDispositions map to case status as follows:\n\n| `disposition` | resulting `status` |\n|---|---|\n| `FALSE_POSITIVE` | `FALSE_POSITIVE` |\n| `TRUE_POSITIVE_ACCEPT` | `TRUE_POSITIVE_ACCEPT` |\n| `TRUE_POSITIVE_REJECT` | `TRUE_POSITIVE_REJECT` |\n| `REOPEN` | `OPEN` |\n\nRe-adjudicating a closed case must go through `REOPEN` first, so the case history shows the reopen as its own decision.\n\nAdjudicating an archived contact's case IS allowed — archiving ends the relationship, it does not close an open compliance case.\n\n`idempotencyKey` is required. Re-sending the same key returns the original result; sending it while the first attempt is still running answers `409 IDEMPOTENCY_KEY_IN_PROGRESS`.\n\n`providerSyncStatus` reports whether the disposition was pushed to the screening provider. It is currently always `NOT_ATTEMPTED`: the case closes in Admiin and is not mirrored upstream.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "alerts", ":alertId" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The Admiin contact id — the `id` returned by `POST /v1/contacts`, not your `externalId` and not a verification request id.", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"disposition\": \"FALSE_POSITIVE\",\n \"reason\": \"\",\n \"product\": \"INDIVIDUAL_AML\",\n \"idempotencyKey\": \"\"\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "33fc5afe-0a28-4dc3-837a-44de8b8c557a", "name": "Fetch the live match evidence for an alert", "request": { "name": "Fetch the live match evidence for an alert", "description": { "content": "Returns the match records behind a compliance case, fetched live from the screening provider.\n\n**This route never returns an empty list to mean \"unavailable\".** If the evidence cannot be served — the live-fetch control is off, the provider returned 404 or 429, or the upstream call failed — it answers **`503` with `code: EVIDENCE_UNAVAILABLE` and NO `matches` key at all**. There is deliberately nothing for a client to misread as \"no matches found\".\n\n**Treat a `503` from this route as a blocking state in your UI, never as an empty result.** An alert exists *because* the provider found matches, so an unreachable evidence read means the detail is unavailable — not that the person is clear. Rendering it as \"no matches\" is how a true positive gets closed as a false positive.\n\nA successful call is also what licenses a subsequent `PATCH` for the next 15 minutes, for the calling principal only, and only for the match set it served.\n\nA `200` carrying an empty `matches` array is possible and means the provider genuinely returned an empty set. It does NOT license a classification — the `PATCH` will still answer `EVIDENCE_STALE`.\n\n**`BUSINESS_DETAILS_OWNERSHIP` cases are served differently.** Nothing is fetched live: the body is `{ fetchedAt, changes }`, the ownership changes recorded on the case, with **no `matches` key**. The read licenses a `PATCH` by the calling principal for as long as the case's evidence is unchanged; the fifteen-minute window does not apply. If the recorded changes no longer match the case's evidence fingerprint the route answers `503 EVIDENCE_UNAVAILABLE` with `reason: NOT_FOUND`.", "type": "text/plain" }, "url": { "path": [ "v1", "contacts", ":id", "monitoring", "alerts", ":alertId", "evidence" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "{{contactId}}", "key": "id", "disabled": false, "description": { "content": "(Required) The Admiin contact id — the `id` returned by `POST /v1/contacts`, not your `externalId` and not a verification request id.", "type": "text/plain" } }, { "type": "any", "value": "{{alertId}}", "key": "alertId", "disabled": false, "description": { "content": "(Required) alertId", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "1c2698bc-af4b-49ca-bda4-bdf127576eba", "name": "Get partner monitoring settings", "request": { "name": "Get partner monitoring settings", "description": { "content": "Returns the partner-wide monitoring default and a summary of every monitoring subject across the partner account.\n\nEvery partner starts `DISABLED`. Historical eligible subjects are materialised only through an explicitly authorised activation and are never resubmitted for KYC.", "type": "text/plain" }, "url": { "path": [ "v1", "monitoring", "settings" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "04de509b-c34e-4fad-8b61-8eb21f03c08a", "name": "Set the partner monitoring default", "request": { "name": "Set the partner monitoring default", "description": { "content": "Sets the default applied to every contact that has not overridden it.\n\nThis writes ONE policy revision. Contacts already in scope are reconciled asynchronously in bounded pages, so a large partner account changes just as fast as a small one and nothing fans out inside the request.\n\n`idempotencyKey` is required. Re-sending the same key returns the original result without applying a second change.\n\nActivation also requires `authorityConfirmed`, `authorityVersion` and the preview's `expectedEligibleSubjectCount`. Anything else is refused with `UNSUPPORTED_FIELD`. The acting principal is recorded server-side from the access token.", "type": "text/plain" }, "url": { "path": [ "v1", "monitoring", "settings" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "PATCH", "body": { "mode": "raw", "raw": "{\n \"default\": \"DISABLED\",\n \"product\": \"INDIVIDUAL_AML\",\n \"idempotencyKey\": \"\",\n \"authorityConfirmed\": true\n}", "options": { "raw": { "language": "json" } } }, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b6f4955a-8d44-4278-9925-0a2e1d40a101", "name": "Preview partner-wide monitoring cost", "request": { "name": "Preview partner-wide monitoring cost", "description": { "content": "Returns the current eligible individual count, USD 0.66 monthly unit rate, estimated total and authority version. The count must be supplied unchanged when partner-wide monitoring is activated.", "type": "text/plain" }, "url": { "path": [ "v1", "monitoring", "settings", "preview" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "product", "value": "INDIVIDUAL_AML" } ], "variable": [] }, "header": [ { "disabled": false, "description": { "content": "(Required)", "type": "text/plain" }, "key": "X-Partner-Id", "value": "{{partnerId}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {}, "auth": null }, "response": [], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{accessToken}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "// Auto-fetch an OAuth2 client-credentials token when missing or expired,", "// so every request just works. Token + expiry are stored on the active", "// environment. Skips quietly if creds are not set yet.", "const token = pm.environment.get(\"accessToken\");", "const expiresAt = Number(pm.environment.get(\"accessTokenExpiresAt\")) || 0;", "const fresh = token && Date.now() < expiresAt;", "const tokenUrl = pm.environment.get(\"tokenUrl\");", "const clientId = pm.environment.get(\"clientId\");", "const clientSecret = pm.environment.get(\"clientSecret\");", "if (!fresh && tokenUrl && clientId && clientSecret) {", " pm.sendRequest({", " url: tokenUrl,", " method: \"POST\",", " header: { \"Content-Type\": \"application/x-www-form-urlencoded\" },", " body: { mode: \"urlencoded\", urlencoded: [", " { key: \"grant_type\", value: \"client_credentials\" },", " { key: \"client_id\", value: clientId },", " { key: \"client_secret\", value: clientSecret },", " { key: \"scope\", value: \"channel-partner-api/server\" },", " ] },", " }, (err, res) => {", " if (err) { console.log(\"Token fetch failed:\", err); return; }", " if (res.code !== 200) { console.log(\"Token fetch HTTP\", res.code, res.text()); return; }", " const body = res.json();", " pm.environment.set(\"accessToken\", body.access_token);", " pm.environment.set(\"accessTokenExpiresAt\", Date.now() + ((body.expires_in || 3600) - 60) * 1000);", " console.log(\"Refreshed accessToken (expires in\", body.expires_in, \"s).\");", " });", "}", "", "// --- Default values for manual testing ---", "if (!pm.environment.get('fakeUuid')) pm.environment.set('fakeUuid', '00000000-0000-0000-0000-000000000000');", "if (!pm.environment.get('foreignPartnerId')) pm.environment.set('foreignPartnerId', '11111111-1111-1111-1111-111111111111');", "if (!pm.environment.get('validPrn')) pm.environment.set('validPrn', '000000000000009700');", "// dueAt = today + 12 days (YYYY-MM-DD), refreshed each send", "pm.environment.set('dueAt', new Date(Date.now() + 12 * 864e5).toISOString().slice(0, 10));", "// unique tag for externalId / idempotency on each send", "pm.environment.set('runTag', 'pm-' + Date.now());", "// backfill unset id slots with fakeUuid so a bare request resolves to a clean 404", "['paymentId','paymentToken','contactId','cardToken','verificationId','individualId','lookupId','notificationId'].forEach(function (k) {", " if (!pm.environment.get(k)) pm.environment.set(k, pm.environment.get('fakeUuid'));", "});" ] } } ], "variable": [ { "key": "deedAnalysisId", "value": "", "type": "string" } ], "info": { "_postman_id": "c36d7ba3-0144-4012-a6db-3adbbba252c2", "name": "Admiin Channel Partner API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": { "content": "Postman collection for the **Admiin Channel Partner API**.\n\n## Quick start\n1. Select an environment (top-right): **Channel Partner – Demo** or **– Production**.\n2. Fill `clientId` and `clientSecret` (your partner OAuth credentials) and `partnerId`\n in the environment.\n3. Get a token — either open the collection → **Authorization** → **Get New Access\n Token** (OAuth 2.0 client-credentials, inherited by every request), or send\n **Authentication → Get access token**.\n4. Send any request. Guest endpoints (marked *(guest)*) take a token in the path\n and need no auth.\n\nVariables: `baseUrl`, `tokenUrl`, `clientId`, `clientSecret`, `partnerId` — driven by the selected environment.", "type": "text/markdown" } } }