Get a user’s subject details
Internal endpoint for backend services. The /v1/internal/kyc form is available on the shared API host; the /api/internal/kyc form remains available for cluster-local service calls. Authenticated with either a backend user bearer token or a WorkOS M2M token holding org:kyc.applications:read; returns the full identity and document payload for a KYC subject (ID and selfie images inlined as base64), used to submit a Choice Bank onboarding during current-account self-activation. A machine caller must pass a non-empty organization_id naming the tenant to read; a user token may not pass it. Returns 404 when the user has no provisioned subject yet.
Authorization
oauth2 Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.
In: header
Query Parameters
Global user id (JWT sub) to look up.
uuidTarget organization to scope the lookup to. Honored only for a platform (cowdi) API key holding PLATFORM-scoped access; every other caller resolves the organization from its bearer token and must omit this parameter (otherwise 400/403).
1 <= lengthResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/v1/internal/kyc/subject?user_id=550e8400-e29b-41d4-a716-446655440000"{ "subject_id": "string", "first_name": "string", "last_name": "string", "birthday": "1990-05-21", "gender": "MALE", "country_code": "KE", "mobile": "string", "id_type": "NATIONAL_ID", "id_number": "string", "front_side_photo": "string", "back_side_photo": "string", "selfie_photo": "string", "email": "string", "kra_pin": "string", "address": "string"}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Get a user’s status GET
Internal KYC status endpoint for backend, backoffice, and onboarding orchestration. The /v1/internal/kyc form is exposed on the shared API host; the /api/internal/kyc form remains available for cluster-local service calls. Authenticated with either a backend user bearer token or a WorkOS M2M token holding org:kyc.applications:read; returns the backend-compatible status DTO for a user. A machine caller must pass a non-empty organization_id naming the tenant to read; a user token may not pass it, since its organization comes from the token.
Get the caller’s current status GET
Returns a lightweight status — including the current application id — for the authenticated user’s most recent KYC application. Lets a client resolve the current application id (and status) without fetching the full application via /applications/current.