> ## Documentation Index > Fetch the complete documentation index at: https://docs.dakota.xyz/llms.txt > Use this file to discover all available pages before exploring further. # What this application still needs to accept, and who may accept it > Returns exactly what the accept-agreements page renders: the agreements this application still owes, and the people permitted to accept them. This exists so that page does not need `GET /applications/{application_id}?include=all`. That response carries the full KYB record — the business entity, and every associated individual's date of birth, nationality and email address — none of which this page displays. The link that reaches this endpoint is emailed and travels in a URL query string, so the credential it carries is scoped to this endpoint and the attestation submission, and cannot read the application. **Authentication:** Accepts Application Token (X-Application-Token header), including the narrow legal-acceptance token issued by a terms refusal. ## OpenAPI ````yaml /openapi.yaml get /applications/{application_id}/legal-acceptance openapi: 3.0.3 info: title: Dakota Platform API version: 1.0.0 description: >- Combined API specification for Dakota Platform services: - Issuance API: Asset minting and burning operations - Onboarding API: Know Your Business/Customer verification - On/Off Ramp API: Managing on-ramp and off-ramp accounts - Recipients API: Managing destinations for KYB'd entities - Transactions API: Viewing transaction history across platform operations ## Authentication and API Headers All API endpoints require the following headers: - `x-idempotency-key`: Required for all POST endpoints to ensure request idempotency - `x-api-key`: Required for authentication across all endpoints Note: On /applications endpoints you need a token for authentication instead of a x-api-key - `x-application-token`: Required for authentication on public /applications endpoints (alternative to `x-api-key` where documented) ## Rate Limits Requests are rate limited per API key. Every response includes the following headers: | Header | Description | | --- | --- | | `X-RateLimit-Limit` | Maximum requests allowed in the current one-minute window. | | `X-RateLimit-Remaining` | Requests remaining in the current window. | | `X-RateLimit-Reset` | Absolute Unix timestamp (seconds since epoch) when the current rate-limit window resets. | When a request is throttled (`429`), responses also include `Retry-After` with seconds to wait before retrying. servers: - url: https://api.platform.dakota.xyz description: Production environment - url: https://api.platform.sandbox.dakota.xyz description: Sandbox — safe for testing with simulated data security: - ApiKeyAuth: [] tags: - name: Agentic Payments x-alpha: true description: >- Alpha — agent-driven payments: provision agents, draft and approve spending mandates, accept reviewed instructions, and manage scheduled payments. **Prerequisites:** Customer onboarded; signer groups attached for recognition. **Related:** Wallets, Signer Groups, Transactions - name: Mandates x-alpha: true description: >- Alpha — spending mandates: signed, signer-bound authorizations governing what may be spent, approved or cancelled by a second recognized signer (§8 — the dual-control rule that every mandate mutation must be signed by a recognized signer OTHER than the bound one). Independent of agents and scheduled payments. **Prerequisites:** Signer groups attached for recognition. **Related:** Signer Groups, Transactions - name: Insights x-alpha: true description: >- Alpha — read-only account insight: a deterministic report over a customer's agentic activity (funding balances, upcoming obligations, failures, mandate headroom and expiry) plus an advisory chat that narrates it. Never moves money, never creates or changes anything. **Prerequisites:** Customer onboarded; insight is computed from the customer's scheduled payments, mandates, and wallets. **Related:** Agentic Payments, Mandates - name: Customers description: >- Manage customer entities representing businesses and organizations onboarded to Dakota. **Prerequisites:** Complete KYB via Onboarding endpoints before initiating money movement. **Related:** Onboarding, Recipients, Transactions, Accounts, Wallets - name: Wallets description: >- Manage wallets, balances, and wallet-to-signer-group relationships for custody and movement controls. **Prerequisites:** Customer must exist. Configure signer groups before policy-enforced workflows. **Related:** Signer Groups, Policies, Transactions, Customers - name: Transactions description: >- Create, cancel, and retrieve transaction records across account and wallet flows. **Prerequisites:** Accounts or destinations must be configured based on flow type. **Related:** Accounts, Recipients, Policies, Events - name: Recipients description: >- Manage recipient entities and destination rails used by customers for payouts and transfers. **Prerequisites:** Customer must be onboarded and active. **Related:** Customers, Transactions, Accounts, Onboarding - name: Accounts description: >- Manage account resources used for onramp, offramp, and swap operations. **Prerequisites:** Customer must be created and network/asset constraints must be known. **Related:** Customers, Transactions, Auto Transactions, Info - name: Auto Transactions description: >- Manage automated transaction configurations and execution history for account automation workflows. **Prerequisites:** Source account must exist and be configured for automation. **Related:** Accounts, Transactions, Events - name: Onboarding description: >- Manage KYB/KYC onboarding lifecycle, application documents, attestations, and verification steps. **Prerequisites:** Customer context and required entity/application metadata. **Related:** Customers, Exceptions, Recipients, Transactions - name: Policies description: >- Define and manage policy objects and rules used for transaction governance and risk controls. **Prerequisites:** Wallet and signer group resources should be configured for enforcement scenarios. **Related:** Wallets, Signer Groups, Transactions - name: Signer Groups description: >- Manage signer groups and signer assignments for multi-party authorization models. **Prerequisites:** Wallets should exist before linking signer groups. **Related:** Wallets, Policies, Transactions - name: Authentication description: >- Manage API authentication credentials and key lifecycle for platform access. **Prerequisites:** Client organization must be provisioned. **Related:** Users, Info - name: Users description: >- Manage client users, roles, and identity metadata for platform access control. **Prerequisites:** Auth credentials and client context must be established. **Related:** Authentication - name: Webhooks description: >- Manage outbound webhook targets and delivery configuration for event notifications. **Prerequisites:** Subscriber endpoint must be reachable and secured. **Related:** Events, Authentication - name: Payouts description: >- Manage where Dakota sends your accrued developer-fee payouts. **Prerequisites:** Auth credentials and client context must be established. **Related:** Events - name: Events description: >- Retrieve event records emitted by platform operations for audit and troubleshooting. **Prerequisites:** Requesting client must have access to referenced resources. **Related:** Webhooks, Transactions, Onboarding - name: Info description: >- Read platform capability metadata, such as supported rails, networks, and assets. These operations are served under `/capabilities/*` - `GET /capabilities/countries` and `GET /capabilities/networks`. The tag name does not appear in the request paths. **Prerequisites:** Valid authentication headers. **Related:** Accounts, Transactions - name: Sandbox description: >- Trigger sandbox-only simulation endpoints for safe end-to-end integration testing with synthetic data. The sandbox host (`https://api.platform.sandbox.dakota.xyz`) also accepts a family of `X-Sandbox-*` request headers on most write endpoints (`Customers`, `Accounts`, `Transactions`, simulate endpoints) that let integrators drive deterministic failure modes — pick a preset via `X-Sandbox-Scenario`, or compose a custom one with `X-Sandbox-Error-Step`/`X-Sandbox-Error-Status`/`X-Sandbox-Error-Message`. `X-Sandbox-Instant-Completion` collapses async flows to a single synchronous step, and `X-Sandbox-Skip-Auto-Approval` keeps newly created KYB applications in `pending` for manual-review testing. All `X-Sandbox-*` headers are ignored in production. **Prerequisites:** Sandbox environment and test customer data. **Related:** Customers, Accounts, Transactions, Onboarding - name: Legal description: |- The legal documents customers accept — terms of service, privacy policy, e-sign notice, and partner agreements. Dakota publishes these here, and this is the authoritative source: the hosted onboarding flow, the dakota.xyz website, and your own integration all read the same revisions. Present the current revision to your customer before capturing their acceptance so the record reflects the text they actually saw. paths: /applications/{application_id}/legal-acceptance: get: tags: - Onboarding summary: What this application still needs to accept, and who may accept it description: > Returns exactly what the accept-agreements page renders: the agreements this application still owes, and the people permitted to accept them. This exists so that page does not need `GET /applications/{application_id}?include=all`. That response carries the full KYB record — the business entity, and every associated individual's date of birth, nationality and email address — none of which this page displays. The link that reaches this endpoint is emailed and travels in a URL query string, so the credential it carries is scoped to this endpoint and the attestation submission, and cannot read the application. **Authentication:** Accepts Application Token (X-Application-Token header), including the narrow legal-acceptance token issued by a terms refusal. operationId: getLegalAcceptanceContext parameters: - name: application_id in: path required: true description: The unique identifier for the application schema: $ref: '#/components/schemas/KSUID' responses: '200': description: Outstanding agreements and permitted attestors content: application/json: schema: $ref: '#/components/schemas/LegalAcceptanceContext' example: application_type: business outstanding_documents: - key: dakota_tos title: Dakota Terms of Service version: 2026-09 revision: 4 accepted_agreements: - attestation_type: terms_of_service version: 2026-02 - attestation_type: e_sign version: 2025-11 attestors: - id: 3H96fIU3lr1KQwe5cXmgD5x6kHy name: Ada Lovelace '403': description: Invalid or expired token, or a token not scoped to this action content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '404': description: Application not found content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' security: - ApplicationTokenAuth: [] components: schemas: KSUID: type: string title: KSUID description: >- KSUID is a 27-character globally unique ID that combines a timestamp with a random component. Used for all entity identifiers in the Dakota platform. pattern: ^[0-9A-Za-z]{27}$ minLength: 27 maxLength: 27 example: 1NFHrqBHb3cTfLVkFSGmHZqdDPi LegalAcceptanceContext: type: object description: > The minimum an acceptance page needs: what is still owed, and who may sign it. Deliberately NOT the application — see the endpoint description. required: - application_type - outstanding_documents - attestors properties: application_type: type: string enum: - business - individual description: | Decides whether a signer is chosen or stated. A business may have several control persons; an individual application has exactly one permissible attestor, so asking them to pick themselves from a list of one is a step with no purpose. outstanding_documents: type: array description: | Agreements this application has not accepted at the revision now in force. Identity only — no document text. The bodies are served by `GET /legal/documents/{document_key}`, which is cacheable and shared with the published pages, and are ~120KB of markdown that would otherwise ride this response. items: $ref: '#/components/schemas/OutstandingLegalDocument' attestors: type: array description: | People permitted to record an acceptance for this application. For a business this is its control persons; the API enforces the same rule on submission, so offering anyone else would only produce a 400. items: $ref: '#/components/schemas/LegalAcceptanceAttestor' accepted_agreements: type: array description: > What is already on file, per attestation type. The page compares each against the revision now in force to decide whether an agreement is genuinely outstanding — having signed an OLDER revision is not the same as never having signed, and the two need different copy. Separate from `outstanding_documents`, which reports only documents never accepted at all. A customer on a superseded revision appears here and not there. items: $ref: '#/components/schemas/AcceptedAgreement' ProblemDetails: type: object required: - type - title - status description: | Error response following RFC 9457 Problem Details. Public API error responses use this format. example: type: https://docs.dakota.xyz/api-reference/errors#not-found title: Customer Not Found status: 404 detail: Customer cst_2abc123 was not found in your organization. instance: https://api.platform.dakota.xyz/customers/cst_2abc123 request_id: req_7f3a8b2c properties: type: type: string format: uri description: | URI reference identifying the problem type. Resolves to human-readable documentation. example: https://docs.dakota.xyz/api-reference/errors#not-found title: type: string description: >- Short, human-readable summary of the problem type. Stable across occurrences. example: Customer Not Found status: type: integer description: HTTP status code for this occurrence. example: 404 detail: type: string description: Human-readable explanation specific to this occurrence. example: Customer cst_2abc123 was not found in your organization. instance: type: string format: uri description: The request path that triggered this error. example: https://api.platform.dakota.xyz/customers/cst_2abc123 request_id: type: string description: Unique request identifier. Include when contacting support. example: req_7f3a8b2c errors: type: array description: Field-level validation errors (present for validation failures). items: $ref: '#/components/schemas/ValidationError' resolution_url: type: string format: uri description: | A link the customer can follow to CLEAR this error, present only on problems with a concrete self-service remedy. Today this is returned by `#terms-not-accepted`, where it points at the hosted flow in which the outstanding agreement can be signed. The link is token-gated and usable as-is — send the customer to it directly rather than parsing it out of `detail`. example: >- https://onboarding.dakota.xyz/applications/2abc123?token=tok_7f3a8b2c user_message: type: string description: | A plain-language rendition of `detail` written for the end customer, present when one exists for this error. `detail` names request fields and actions so a machine caller (such as a payment agent drafting proposals) can self-correct; `user_message` says the same thing without API vocabulary. Clients that relay errors into a human surface (chat, email, UI) should show `user_message` when present and fall back to `detail`. example: >- ACH payments pay out USD, so a USDC payout isn't possible on this rail. Change the payout currency to USD and try again. OutstandingLegalDocument: type: object description: | A legal document the customer has never accepted. The revision named is the one currently in force. Fetch its text with `GET /legal/documents/{document_key}` — it is deliberately not inlined here, because these documents run to tens of kilobytes each and this field rides on every application read. required: - key - version - revision - title properties: key: type: string description: Stable identifier of the document example: dakota_tos version: type: string description: Version of the revision that needs accepting example: '2026-08-04' revision: type: integer description: Monotonic ordinal of the revision within this document example: 5 title: type: string description: Human-readable title example: Dakota Terms of Service attestation_type: $ref: '#/components/schemas/AttestationType' LegalAcceptanceAttestor: type: object required: - id - name properties: id: allOf: - $ref: '#/components/schemas/KSUID' description: | The applicant id to submit as `applicant_id`. This is the application-individual link, not the individual — the same value the attestation endpoint validates against. name: type: string description: > Display name. NOTHING else about the person is returned: this page shows a name in a picker, and date of birth, nationality and email are exactly the fields the scoped credential exists to keep out of an emailed link. example: Ada Lovelace AcceptedAgreement: type: object required: - attestation_type properties: attestation_type: type: string description: The attestation type this acceptance was recorded under. example: terms_of_service version: type: string description: > The revision accepted. Empty for an acceptance predating the registry, whose revision is derived from its timestamp rather than stored. example: '2026-07-23' ValidationError: type: object required: - field - message properties: field: type: string description: Field path using dot notation for nested fields. example: bank_account.routing_number message: type: string description: Human-readable description of the field error. example: Routing number must be exactly 9 digits code: type: string description: Machine-readable error code for this field. example: invalid_format AttestationType: type: string description: Type of attestation being submitted enum: - information_accuracy - terms_of_service - privacy_policy - funds_transfer_agreement - lead_bank_privacy_policy - e_sign example: information_accuracy securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key ApplicationTokenAuth: type: apiKey in: header name: X-Application-Token description: > Application-specific token for public URL access. Generated when a customer is created. Provides access to a single application without requiring an API key. Token is valid for 90 days and rate-limited to 250 requests per hour. ````