Skip to main content
POST
Submit an application for verification

Authorizations

ā€‹
X-Application-Token
string
header
required

Application-specific token for public URL access. Generated when a customer is created. Provides access to a single application without requiring an API key. Token is valid for 90 days and rate-limited to 250 requests per hour.

Headers

ā€‹
x-idempotency-key
string<uuid>
required

Unique key (UUID) to ensure request idempotency on POST, PUT and PATCH requests.

A key is scoped to your client, the HTTP method and the path, and is remembered for 24 hours after a successful (below 400) response. Repeating the same request (same JSON body, whatever the key order or whitespace) with the same key within that window returns the original response with X-Idempotent-Replayed: true instead of executing the request again. Using the same key on the same endpoint with a different body returns 422 with problem type idempotency-key-reused; the request is not executed. Error responses (4xx and 5xx) are not remembered, so a request refused for a fixable reason can be corrected and retried under the same key. Request bodies that are not JSON (for example file uploads) are not compared.

Path Parameters

ā€‹
application_id
string
required

The unique identifier for the application KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform.

Required string length: 27
Pattern: ^[0-9A-Za-z]{27}$
Example:

"1NFHrqBHb3cTfLVkFSGmHZqdDPi"

Response

Application submitted successfully

Application response with separated entity data and validation state

ā€‹
application_id
string<ksuid>
required

Unique application identifier

Example:

"2hCjxJzUAW6JVRkZqaF9E0KpM3a"

ā€‹
application_type
enum<string>
required

Type of application

Available options:
business,
individual
Example:

"business"

ā€‹
application_status
enum<string>
required

Current status of the application

Available options:
pending,
submitted,
under_review,
request_for_information,
admin_revision,
approved,
declined,
completed,
compliance_review,
closed
Example:

"submitted"

ā€‹
application_created_at
string<date-time>
required

When the application was created

Example:

"2024-01-15T10:30:00Z"

ā€‹
application_updated_at
string<date-time>
required

When the application was last updated

Example:

"2024-01-16T14:45:00Z"

ā€‹
application_submitted_at
string<date-time> | null

When the application was submitted (null if not yet submitted)

Example:

"2024-01-17T16:00:00Z"

ā€‹
rfi_requested_items
object

Reviewer-selected resubmission scope for an RFI.

ā€‹
rfi_resubmitted
boolean

Whether the applicant has already submitted in response to the latest scoped RFI (drives the resubmit page's "already submitted" state).

ā€‹
application_decision
enum<string> | null

Decision outcome for the application (only present after decision is made). Note: auto_declined is mapped to declined in the API response.

Available options:
approved,
declined,
withdrawn
Example:

"approved"

ā€‹
decline_reason
enum<string>

The category of the decline, when application_decision is declined and a category was recorded. Omitted otherwise. This is the one decision detail the applicant-token read returns.

Available options:
unsupported_region,
prohibited_country,
prohibited_business_type,
other
Example:

"prohibited_country"

ā€‹
decline_message
string

The fixed applicant-facing sentence for decline_reason. Present exactly when decline_reason is.

Example:

"The applicant is located in a country Dakota does not support."

ā€‹
entities
object

The people/businesses being onboarded. The per-entity decision_reason and decision_by are compliance-facing and are omitted for callers without compliance review permission (the applicant-token read).

ā€‹
edd
object

Enhanced Due Diligence data (if provided)

ā€‹
attestations
object

Attestations submitted for this application

ā€‹
validation
object

Validation state computed at retrieval time

ā€‹
risk_rating
object

Risk rating. Present for users with compliance review-data access (compliance, compliance_admin, superadmin).

ā€‹
poa_status
enum<string>

Tracks the review state of the Proof of Address for individual applications. Only present for compliance reviewers; absent for business applications, for non-primary-individual rows, and on the token-authenticated hosted onboarding flow.

  • missing ā€” No Proof of Address has been submitted. The individual is subject to the $3,000 USD-equivalent rolling 7-day transaction limit.
  • submitted_pending_review ā€” A PoA-equivalent document (proof_of_address, bank_statement, or utility_bill) has been uploaded and is awaiting compliance review. The individual remains subject to the transaction limit until the review concludes.
  • approved ā€” The Proof of Address has been reviewed and approved. The individual is exempt from the $3,000 / 7-day rolling transaction threshold.
  • rejected ā€” The submitted Proof of Address was rejected. The individual remains subject to the transaction limit and may re-upload a new document.
Available options:
missing,
submitted_pending_review,
approved,
rejected
Example:

"missing"

ā€‹
is_frozen
boolean

Whether the customer's KYB is currently frozen (transactions held pending proof-of-address review). The authoritative source for the reviewer freeze badge. Present (true/false) only for individual applications; absent for business applications.

Example:

true

ā€‹
frozen_at
string<date-time>

When the customer entered the current frozen state, from the KYB status-change log. Drives the days-frozen counter accurately (unlike application_updated_at, which unrelated edits bump). Absent when the customer is not currently frozen, when the freeze predates the status-change log, or for callers without compliance review access.

Example:

"2024-01-16T14:45:00Z"

ā€‹
poa_on_file
boolean

Whether the customer has an approved Proof of Address on file (and is therefore exempt from the transaction-volume limit). Present only for individual applications; absent for business applications.

Example:

false

ā€‹
assignee
object

The compliance reviewer this application is assigned to (its owner). Absent when unassigned.

ā€‹
outstanding_partner_attestations
object[]

Outstanding partner disclosure attestations the customer must accept to unlock a partner-gated capability (e.g. international wires), surfaced so the hosted onboarding flow can present them in the same attestations UI used for first-party attestations. Partner-agnostic: each item is keyed by an opaque terms key + version, never a partner identifier. Only present (and only computed) for an already-decided (approved) application that has outstanding partner onboarding ā€” this is the re-engagement surface for an existing customer who lands on the hosted flow via their application_url. Empty/absent when nothing is outstanding or the partner declaration is unavailable. Accept each by POSTing to /applications/{id}/attestations with disclosure_id = key and disclosure_version = version.