Import a verified session

Import a verification the customer already passed on the partner’s own Sumsub level, handed over as a share token. Prerequisites, and what does and doesn’t transfer: KYC Sumsub Shared Token.

Answers 200, not 202: the import is committed before the response, which carries the same requirements breakdown as GET /organization/{organizationId}/kyc?requirements=true.

That breakdown covers the identity stage only. Send what it lists, then wait for kycUpdated and read the requirements again: proofOfAddress and customerAgreement appear only when the customer reaches their stages. See Requirements unlock in stages.

Only shareToken is accepted. The verification level and the customer’s identity are ours to decide. The token is a credential; it is never logged and appears in no response.

No country is sent: it is read from the shared verification and used to route the customer. The customer’s registered userInfo.email is required and is set on the imported applicant.

Nothing is trusted wholesale. Everything imported is re-checked against Etherfuse’s own requirements, so a session approved in the partner’s account is not automatically approved here.

Importing again. If the customer’s verification has not reached review, a new import replaces it, for example after an earlier import left documents missing. Once the customer is approved, denied, or in review, the import returns 409.

POST /organization/{organizationId}/verification/import

Import a verified session

cURL

curl --request POST \
  --url https://api.sand.etherfuse.com/organization/{organizationId}/verification/import \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "shareToken": "_act-sbx-jwt-eyJhbGciOi...",
  "additionalInfo": {
    "curp": "XEXX010101HNEXXXA4"
  }
}
'

200

{
  "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "status": "inProgress",
  "requirements": [
    {
      "type": "personalData",
      "status": "satisfied",
      "requiresLaunch": false
    },
    {
      "type": "identityDocument",
      "status": "satisfied",
      "requiresLaunch": false
    },
    {
      "type": "occupation",
      "status": "pending",
      "requiresLaunch": false
    },
    {
      "type": "selfie",
      "status": "satisfied",
      "requiresLaunch": true
    },
    {
      "type": "customerAgreement",
      "status": "pending",
      "requiresLaunch": false
    }
  ]
}

Authorizations

Authorization · string · header · required

API key sent in the Authorization header, with no Bearer prefix.

Path Parameters

organizationId · string<uuid> · required

The organization this call acts for: your API key's organization or one of its customer organizations. Any other id returns 404 not-found.

Body

application/json

A verification session the partner already completed with the same provider, handed over as a share token they created for us. No other fields are accepted.

shareToken · string · required

The single-use, short-lived share token created for the verified applicant, targeting Etherfuse's client id.

Example:

"_act-sbx-jwt-eyJhbGciOi..."

additionalInfo · object

Information a shared session does not bring across. Custom fields on your own verification level are not copied when you share an applicant.

Show child attributes

Response

200

application/json

The session was imported. requirements lists what is still outstanding. If we could not read the requirements, we leave the field out; read GET /organization/{organizationId}/kyc?requirements=true instead.

The outcome of importing a verification session.

organizationId · string<uuid> · required

status · enum<string> · required

• notStarted: verification has not started.
• inProgress: the customer started but has not submitted everything.
• submitted: submitted and waiting for review.
• approved: cleared.
• denied: rejected, or a previous approval was revoked.

Available options: notStarted, inProgress, submitted, approved, denied

requirements · object[]

What is still outstanding after the import: the same breakdown GET /organization/{organizationId}/kyc?requirements=true returns. Left out if we could not read the requirements after the import.

Show child attributes