Environments
KYC and KYB submissions, partial updates and lookups go to the KYC platform, not the main API. Use
https://kyc-sandbox.yativo.com with sandbox customers and https://kyc.yativo.com in production. Read the host from config so you can switch. The KYC platform endpoints don’t need your API key. Endpoints on the main API, such as GET /customer/{customer_id}, do. See Sandbox KYC.Integration approaches
Hosted URLs:
- Individual:
https://kyc.yativo.com/individual/{customer_id} - Business:
https://kyc.yativo.com/business/{customer_id}
Build your form with the lookup endpoints
If you collect KYC or KYB data in your own UI, fill every dropdown from the KYC platform’s lookup endpoints instead of hardcoding values. They live onhttps://kyc.yativo.com/api, and you can try each one from the API reference.
1
Country
Load List Countries once. Send the two-letter
code for nationality, every address country and issuing_country.2
Address
When the customer picks a country, load List Subdivisions for the
state dropdown, and Get Postal Code Format to validate postal_code as they type.3
ID documents
Load List ID Types for the issuing country to fill
identifying_information[].type.4
Occupation or industry
Individuals: List Occupations for
most_recent_occupation_code. Businesses: List Business Industries for business_industry. Both lists are long, so use a searchable field.5
Purpose, funds and volume
Individuals: account purposes, sources of funds and expected monthly payments. Businesses: account purposes and sources of funds. The business lists are different from the individual ones.
6
Business activity (KYB only)
List Transaction Currencies for
collection_currencies and List Transaction Countries for beneficiary_geographies.Verification flow
1
Create a customer
Call
POST /customer to create a customer record and receive a customer_id.2
Upload documents (if using API)
Use
POST /storage/upload to upload files and receive back a hosted URL. Pass those URLs in the KYC payload. Alternatively, embed files as base64-encoded strings.3
Submit KYC or KYB
POST to
https://kyc.yativo.com/api/individual-kyc/submit or https://kyc.yativo.com/api/business-kyc/submit.4
Watch the endorsements
Listen for the
endorsement.updated webhook, or read the customer’s endorsement list with GET /customer/{customer_id}. This is the only place verification results appear. See Track verification with endorsements.5
Use each approved service
Each service becomes available when its endorsement’s
status is approved. For example, a USD virtual account needs the endorsement that GET /business/virtual-account/currencies-and-endorsements lists for USD.Upload documents
Before submitting KYC, upload any document files you will reference. Every file must be PDF, JPG, JPEG, PNG, HEIC or TIF, and between 5 KB and 30 MB. ID document images (image_front_file, image_back_file, uploaded_documents[*].file) on individual KYC accept PDF, JPG, JPEG and PNG only. Each file field accepts a hosted URL, a base64 data URI (data:image/jpeg;base64,...) or a multipart/form-data upload. Every file is virus-scanned.
multipart/form-data with the field name document.
document value in the selfie_image, image_front_file, proof_of_address_file, and similar fields below.
Individual KYC
Submit
Step 1 — Personal details
Step 2 — Residential address
Step 3 — Identifying information
At least one government-issued ID document is required.Step 4 — Risk and purpose
The API accepts unknown values for
employment_status, expected_monthly_payments_usd, source_of_funds and account_purpose, but verification fails later if they aren’t on the lists below. The 201 response lists them under warnings, along with other values verification is likely to reject. Check warnings and fix those fields with a partial update. KYB responses can include warnings too, for example when a country isn’t covered by one service. For these four fields, send the lookup key (PascalCase, such as ReceiveSalary, SelfEmployed or LessThan5K). The snake_case form (receive_salary, self_employed, 0_4999) is accepted too. Use the lookup endpoints in Reference lookups.
Step 5 — Supporting documents
Virtual account flags
Rejections to handle
Duplicate person (409). An individual submission is rejected if it matches a different customer on your account by bvn or nin; by the same ID document (same type, issuing_country and number); or by the same email, or phone with the same calling_code, when the first name, last name and date of birth (where both have one) also match. Nothing is saved, and the response names the existing customer:
duplicate_of. Resubmitting under the same customer_id isn’t a duplicate. Customers on other Yativo accounts are never matched. If two different people really share a detail, contact Yativo support to clear the match. Sandbox doesn’t run this check.
Placeholder names (403). A submission is refused with 403 {"message": "Access denied."} if any name field contains test, yativo or admin (any case, anywhere in the value, so "Tester" matches), or an email contains test. This covers individual names, business_legal_name, business_trade_name and every associated person. The customer_id is then blocked permanently, even with corrected data. Use realistic names when testing.
Country values. Send ISO alpha-2 codes. Common variants such as UK, usa or a full English name are converted automatically, but alpha-2 is the supported format.
KYC example request
Business KYB
Submit
Step 1 — Business basics
Step 2 — Addresses
Bothregistered_address and physical_address use the same structure:
Step 3 — Associated persons
At least one person is required. Include all UBOs, directors, and authorized signers. People who own less than the ownership threshold are dropped from the submission, and the response’swarnings tell you who was dropped. Directors, signers and controllers (is_director, is_signer or has_control true) are always kept, whatever they own. The threshold is ownership_threshold (5–100, default 25). At least one person must meet it. A director, signer or controller doesn’t count towards this unless they own enough. The combined ownership_percentage of everyone with has_ownership: true can’t exceed 100.
Each person’s
identifying_information needs at least one ID that isn’t a tax ID, such as a passport or national ID. Associated persons use image_front and image_back, not the _file names used in individual KYC:
For a Naira account in the business’s name, add a
bvn entry (11-digit number, no image) for a Nigerian associated person. See naira in What each endorsement needs.
Step 4 — Risk and purpose
Step 5 — Regulated activity
Step 6 — Business documents
At least one document is required.Step 7 — Business identifying information (optional)
Business-level ID documents (e.g. business licence).Step 8 — Extra documents
extra_documents is an array of { "type": "...", "file": ... }. These are required:
Optional business profile
Describe the business’s activity in three nested objects, not as top-level fields. All are optional. A value outside the allowed list doesn’t block the submission, but it comes back inwarnings.
extra_business_info
collections_data
payouts_data
KYB example request
Track verification with endorsements
A customer’s KYC or KYB result is only available through their endorsements. Each endorsement is one service, such asbase, sepa or cobo_pobo, with its own status. A customer can be approved for one service and still be under review for another, so there’s no single overall status to check.
Don’t rely on customer_kyc_status or is_va_approved to decide what a customer can use. Check the endorsement for the service you need.
Listen for endorsement.updated
Yativo sends endorsement.updated whenever any of a customer’s endorsements changes. endorsements is the customer’s full current list:
Read the current endorsements
To check on demand, for example when your server starts up or you missed a webhook, read the customer’sendorsement list:
What each endorsement needs
You don’t request endorsements directly. Which ones are attempted depends on your submission, mainly the virtual account flags and whether the data is complete enough. A missing field or document doesn’t fail the submission. It leaves that endorsement belowapproved until you fix it.
Three endorsements reject outright instead of waiting in
under_review:
cobo_pobo: no identifiable registration document, or a representative with no ID documentbrazil: any of the items listed above is missingasian: the country isn’t supported. This can also decline an endorsement that was approved before
spei included, with errors: ["Unable to verify customer information"].
Endorsements that failed to start
If an endorsement can’t be submitted at all, because a required document or field is missing or invalid, it stays atnot_started (declined for virtual_card and naira) and errors says why, for example ["Missing required documents: ID document front image, selfie"]. Fix the data with a partial update or a full resubmission, and the endorsement is submitted again automatically.
errors, requirements_due and future_requirements_due are always arrays of readable messages, and empty when there are none.
Which endorsement a service needs
cURL
Update a KYC submission
Use this endpoint to correct information or provide missing documents after a rejection.customer_id is always required.
Partial update on the KYC platform
To correct a few fields on a submission, send only those fields to the KYC platform:state and postal_code are checked against the country’s subdivision and postal code formats. An empty body returns 400 No fields provided., and a customer with no submission returns 404.
Endorsements that failed to start are submitted again automatically once the update is saved. The response lists them in resubmitted_endorsements, for example ["asian"], and each shows under_review while it runs.
cURL
Resubmit one endorsement
After a customer updates their ID document or selfie, re-run verification for one endorsement without touching the others:endorsement is one of base, sepa, spei, faster_payments, naira, virtual_card, asian or brazil. This works for individual customers only. For a business, or for cobo_pobo, native, eurde, usd_latam or eur_latam, use the KYC platform endpoint below.
cURL
Success
200 means the resubmission was queued, not that verification finished. Watch for endorsement.updated, or check the endorsement’s status with GET /customer/{customer_id}. Its metadata.last_resubmission shows whether the resubmission itself could be processed:
service in the customer’s endorsement list is title-cased, for example "Faster payments". Compare it with the lowercase form you sent.
On the KYC platform (individual or business)
base, sepa, eurde, spei, asian, virtual_card, naira, cobo_pobo, faster_payments, native, brazil, usd_latam or eur_latam. The endorsement moves to under_review right away and its errors are cleared. If the stored data can’t be submitted, it returns to its previous status and errors.resubmission_failed says why.
You can call it 30 times a minute.
Service endorsements
Each endorsement unlocks one service. Its status is the verification result for that service.Endorsement statuses
Only
approved means the service is available. Treat every other status as not yet usable.
Regenerate an endorsement link
If an endorsement link has expired, regenerate it and share the new URL with the customer:Reference lookups
The KYC platform serves the lists your form needs. Prefix each path withhttps://kyc.yativo.com/api:
The same occupation and country data is also available on the main API:
Occupation codes
Get the full list of valid occupation codes formost_recent_occupation_code:
Supported countries
Get the list of countries supported for customer registration and verification:Enum reference values
employment_status
expected_monthly_payments_usd
source_of_funds
account_purpose
high_risk_activities (KYB)
The
source_of_funds and account_purpose lists above are for individual KYC. KYB uses its own lists.
KYB account_purpose
charitable_donations, ecommerce_retail_payments, investment_purposes, other, payments_to_friends_or_family_abroad, payroll, personal_or_living_expenses, protect_wealth, purchase_goods_and_services, receive_payments_for_goods_and_services, tax_optimization, third_party_money_transmission, treasury_management
KYB source_of_funds
KYB source_of_funds values are PascalCase:
BusinessLoans, Grants, InterCompanyFunds, InvestmentProceeds, LegalSettlement, OwnersCapital, PensionRetirement, SaleOfAssets, SalesOfGoodsAndServices, ThirdPartyFunds, TreasuryReserves
business_type (KYB)
cooperative, corporation, llc, partnership, sole_prop, trust, other
ID types by country
The acceptedtype values under identifying_information depend on the issuing country. Get the full list for a country from List ID Types. Common types available globally:
Countries also accept country-specific types, for example:
Use
GET /auth/verification-locations to check which countries are supported, and consult the full ID type reference in the API reference section.
Webhooks
KYC and KYB results arrive asendorsement.updated events. There’s no separate KYC status event. See Track verification with endorsements.
Error handling
The KYC platform returns validation errors in its own shape, with422:
validation_errors lists every failing field. field_labels gives a readable name for each, and field_hints gives advice where available. Show both next to the matching form field. KYB returns "message": "Validation failed." and may add notices about associated persons below the ownership threshold.
Common errors and fixes
Go-live checklist
Sandbox is forgiving. Production isn’t. Before switching:- Every request, lookups included, goes to the production host, read from config rather than hardcoded.
- Lookup values cached from sandbox are fetched again from production, or fetched live.
- No sandbox test values are hardcoded. See Sandbox KYC.
- Nigerian customers send their own
bvnandnin, and their name and date of birth match their BVN record. - No real customer has a placeholder name or email.
- You handle
409duplicates by reusingduplicate_of, show422errors field by field, and treat403 Access denied.as final for thatcustomer_id. - A
200or201is shown as “submitted, pending review”, never “approved”. - You’ve submitted one real individual (and one real business, if you onboard businesses) on production and seen the endorsement results end to end.
Implementation notes
- KYC review typically completes within 24 hours. Complex cases may take longer.
- Use
Idempotency-Keyon all POST and PUT requests to prevent duplicate submissions. - Files can be passed as hosted URLs (from
POST /storage/upload) or base64-encoded strings — both are accepted. - For Nigerian nationals or residents (
nationalityorresidential_address.countryis"NG"),bvnandninare mandatory regardless of which ID type is provided. stateaccepts"US-CA"and"CA". Send the bare code from the subdivisions lookup.- Use the
PATCHendpoints in Update a KYC submission for small corrections instead of resubmitting everything.

