Skip to main content
Onboarding can be blocked for specific countries under sanctions or risk policy. The check runs on create, after field validation and the uniqueness checks, just before anything is created, in the onboarding direction. A blocked country returns 403 and no customer or applicant is made — there is nothing to clean up afterwards.
403

​
What is checked

The country on the customer being created — an individual’s country, or a business’s company.country.

​
Who controls the list

The allow/deny list is two-tier: a platform-wide list, plus an optional per-partner list layered on top. Both are managed by Endl operations through an internal service API.
This is not something a partner can set or read. There is no partner-facing endpoint for country restrictions. If you need a country enabled, ask Endl rather than looking for an API.

​
Handling it

Treat 403 from create as a policy decision, not a transient fault — retrying will not help, and neither will changing another field. The check runs after field validation and the uniqueness checks, just before anything is created. A 403 means the rest of the payload was valid.
403 is also returned when your key lacks the customers permission. The code distinguishes them — the country case is ERRCUS_1605; the permission case is ERRCORE_1005.