Import an individual KYC token

Imports an opaque Sumsub share token into the authenticated subject's existing individual KYC case. This alternative path is enabled by approved Vortex policy despite unresolved legal/consent wording and provider-environment confirmations; no live sandbox verification is claimed. Authentication and profile-bound principal enforcement run before managed-profile authorization and strict body validation. Use either a profile-bound secret X-API-Key or a Supabase Bearer session. A controlling manager may add X-Managed-Profile-Id; direct managed-child credentials are rejected even without the selector. Public and ownerless credentials are insufficient.

The body accepts only importToken and literal consentAttested: true; CPF, tax ID, subaccount ID, applicant ID, entity ID, provider-customer ID, profile ID, and other caller identity selectors are forbidden. The provisional server-controlled consent policy is sumsub-share-v1. Every token claim appends actor, subject, policy version, and timestamp consent evidence without storing the raw token.

The first normal KYC artifact, status read, or token-import claim permanently selects that case's method. Import the token before reading KYC or onboarding status because a status read selects a nullable method as standard. The same idempotency key and token returns a stored confirmed attempt or safely reconciles a durable submitted/ambiguous claim through provider reads, without another provider POST or replaying the token. A different token under the same key returns 409. A provider 401 means the feature precondition is unavailable, records a failed attempt, returns 412, and may be retried only with a new idempotency key; the new claim appends consent evidence while preserving prior attestations. Every other post-send provider, transport, malformed-response, timeout, or local-confirmation failure is ambiguous, returns 502, and is never replayed automatically.

Acceptance is pending only. Vortex polls the exact returned provider attempt; EXPIRED remains non-approved and locally pending for reconciliation, and its external status is retained. Only a provider COMPLETED plus APPROVED completes KYC. The provider webhook is notification-only and cannot approve the case.

Request

Authorization

API Key

Add parameter in header

X-API-Key

Example:

X-API-Key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Header Params

Body Params application/jsonRequired

Examples

curl --location '/v1/brl/kyc/import-token' \ --header 'X-Managed-Profile-Id;' \ --header 'Idempotency-Key;' \ --header 'X-API-Key: <api-key>' \ --header 'Content-Type: application/json' \ --data '{ "consentAttested": true, "importToken": "string" }'

Import an individual KYC token

Request

Responses