curl --request GET \
--url https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance \
--header 'X-Application-Token: <api-key>'const options = {method: 'GET', headers: {'X-Application-Token': '<api-key>'}};
fetch('https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance"
headers = {"X-Application-Token": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-Application-Token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"application_type": "business",
"outstanding_documents": [
{
"key": "dakota_tos",
"title": "Dakota Terms of Service",
"version": "2026-09",
"revision": 4
}
],
"accepted_agreements": [
{
"attestation_type": "terms_of_service",
"version": "2026-02"
},
{
"attestation_type": "e_sign",
"version": "2025-11"
}
],
"attestors": [
{
"id": "3H96fIU3lr1KQwe5cXmgD5x6kHy",
"name": "Ada Lovelace"
}
]
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}What this application still needs to accept, and who may accept it
Returns exactly what the accept-agreements page renders: the agreements this application still owes, and the people permitted to accept them.
This exists so that page does not need GET /applications/{application_id}?include=all.
That response carries the full KYB record — the business entity, and every
associated individual’s date of birth, nationality and email address —
none of which this page displays. The link that reaches this endpoint is
emailed and travels in a URL query string, so the credential it carries
is scoped to this endpoint and the attestation submission, and cannot
read the application.
Authentication: Accepts Application Token (X-Application-Token header), including the narrow legal-acceptance token issued by a terms refusal.
curl --request GET \
--url https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance \
--header 'X-Application-Token: <api-key>'const options = {method: 'GET', headers: {'X-Application-Token': '<api-key>'}};
fetch('https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance"
headers = {"X-Application-Token": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.platform.dakota.xyz/applications/{application_id}/legal-acceptance"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-Application-Token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"application_type": "business",
"outstanding_documents": [
{
"key": "dakota_tos",
"title": "Dakota Terms of Service",
"version": "2026-09",
"revision": 4
}
],
"accepted_agreements": [
{
"attestation_type": "terms_of_service",
"version": "2026-02"
},
{
"attestation_type": "e_sign",
"version": "2025-11"
}
],
"attestors": [
{
"id": "3H96fIU3lr1KQwe5cXmgD5x6kHy",
"name": "Ada Lovelace"
}
]
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}{
"type": "https://docs.dakota.xyz/api-reference/errors#not-found",
"title": "Customer Not Found",
"status": 404,
"detail": "Customer cst_2abc123 was not found in your organization.",
"instance": "https://api.platform.dakota.xyz/customers/cst_2abc123",
"request_id": "req_7f3a8b2c"
}Authorizations
Application-specific token for public URL access. Generated when a customer is created. Provides access to a single application without requiring an API key. Token is valid for 90 days and rate-limited to 250 requests per hour.
Path Parameters
The unique identifier for the application KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform.
27^[0-9A-Za-z]{27}$"1NFHrqBHb3cTfLVkFSGmHZqdDPi"
Response
Outstanding agreements and permitted attestors
The minimum an acceptance page needs: what is still owed, and who may sign it. Deliberately NOT the application — see the endpoint description.
Decides whether a signer is chosen or stated. A business may have several control persons; an individual application has exactly one permissible attestor, so asking them to pick themselves from a list of one is a step with no purpose.
business, individual Agreements this application has not accepted at the revision now in
force. Identity only — no document text. The bodies are served by
GET /legal/documents/{document_key}, which is cacheable and shared
with the published pages, and are ~120KB of markdown that would
otherwise ride this response.
Show child attributes
Show child attributes
People permitted to record an acceptance for this application. For a business this is its control persons; the API enforces the same rule on submission, so offering anyone else would only produce a 400.
Show child attributes
Show child attributes
What is already on file, per attestation type. The page compares each against the revision now in force to decide whether an agreement is genuinely outstanding — having signed an OLDER revision is not the same as never having signed, and the two need different copy.
Separate from outstanding_documents, which reports only documents
never accepted at all. A customer on a superseded revision appears
here and not there.
Show child attributes
Show child attributes
Was this page helpful?

