Send an application back to DRAFT
Admin override that resets an application to DRAFT from any status, clearing the provider session, verification result, rejection reason and reapply cooldown so it can re-run verification from scratch. resubmission_count is preserved. Optionally set force_new_enroll to make the applicant’s next Smile ID session a fresh enrollment (overwriting the enrolled biometric). Org-scoped and gated on the backend accounts.write permission (override with KYC_REVIEWER_PERMISSION).
Authorization
oauth2 Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.
In: header
Path Parameters
KYC application id.
uuidRequest Body
application/json
Optional body for the admin override that resets a KYC application to DRAFT.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/kyc/applications/550e8400-e29b-41d4-a716-446655440000/draft" \ -H "Content-Type: application/json" \ -d '{}'{ "id": "550e8400-e29b-41d4-a716-446655440000", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "organization_id": "cowdi", "user_type": "INDIVIDUAL", "merchant_type": "SOLE_PROPRIETOR", "status": "DRAFT", "source": "USER", "documents": [ { "id": "3fa2c1d4-8b8e-4c9a-9c9e-1f2e3a4b5c6d", "document_type": "NATIONAL_ID", "document_sub_type": "string", "document_number": "string", "expiry_date": "string", "presigned_url": "string", "uploaded_at": "2026-06-04T10:20:00.000Z" } ], "verification": { "provider": "SMILE_ID", "provider_job_id": "string", "result": "PASSED", "confidence_score": 0, "completed_at": "2026-06-04T10:20:00.000Z" }, "verification_reason_code": "string", "external_reason_code": "DOCUMENT_IMAGE_UNUSABLE", "external_reason": "Part of your ID document was cut off. Retake the photo with all four corners of the document inside the frame.", "resubmission_count": 0, "force_new_enroll": true, "reapply_blocked_until": "2026-06-04T10:20:00.000Z", "submitted_at": "2026-06-04T10:20:00.000Z", "created_at": "2026-06-04T10:20:00.000Z", "updated_at": "2026-06-04T10:20:00.000Z"}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}{ "code": "INVALID_PARAMS", "description": "user_id must be a UUID", "identifier": "string", "invalid_params": [ { "path": "user_id", "reason": "must be a UUID", "sub_code": "string" } ]}Submit a selfie and ID POST
Deprecated — use POST /applications/{id}/verification with `channel: "server_upload"`. Kept as a thin alias over the same engine. Server-side capture-then-submit: the browser captures a liveness selfie (with its liveness frames) and the ID document (front + optional back) with Smile ID’s smart-camera-web component and POSTs the base64 images here. They are submitted server-side to Smile ID Enhanced Document Verification (job_type 11) — keeping the government database cross-check while also capturing the back of the ID, which the hosted widget cannot. Include `liveness_images` to run Smile ID’s active-liveness / anti-spoofing check (a lone selfie only gets the passive check). The result arrives asynchronously via the provider callback, so the application is left ID_VERIFICATION_PENDING. Answers with a `Deprecation` header and a `Link` to the Versions page.
Reopen an expired application POST
Resets an `EXPIRED` application to `DRAFT` so the applicant can start verification again. Clears the provider session, the verification result, and the resubmission count. Returns 400 when the application is not `EXPIRED`. Call POST /applications/{id}/verification next to start a new attempt.