> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endl.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding overview

> Verify your end customers — individuals (KYC) and businesses (KYB) — through one REST surface

The Partner Onboarding API verifies your end customers' identity. You create a
customer, upload their documents, and the verification result comes back
asynchronously. Endl handles the verification provider; you only work with the
endpoints here.

<Warning>
  This API does **not** share the Partner API's response envelope. A successful
  response body *is* the data object — there is no `{ data, code, message, status }`
  wrapper. See [Errors and lifecycle](/api-reference/onboarding/errors).
</Warning>

## Two customer types, the same endpoints

<Columns cols={2}>
  <Card title="Individual (KYC)" icon="user" href="/api-reference/onboarding/individual-kyc">
    Identity fields, a questionnaire and custom fields, then a photo ID and a selfie.
  </Card>

  <Card title="Business (KYB)" icon="building" href="/api-reference/onboarding/business-kyb">
    A company plus one entry per beneficial owner, company documents, and each owner's documents.
  </Card>
</Columns>

There is also an **import** path: if you have already verified the customer
elsewhere, pass a `shareToken` instead of the full payload.

## Base URL

| Environment | Base URL                  |
| ----------- | ------------------------- |
| QA          | `https://qa-api.endl.xyz` |
| Local       | `http://localhost:8090`   |

Every endpoint lives under `/api/v0/customer`.

<Note>
  The testing guide gives the local host and says the QA host comes from the
  backend team. `https://qa-api.endl.xyz` is used here for consistency with the
  rest of this documentation — confirm it before pointing an integration at it.
</Note>

## Authentication

One header. There is no login step and no secret to send.

| Header    | Required | Notes                                                         |
| --------- | -------- | ------------------------------------------------------------- |
| `API-KEY` | Yes      | Your partner API key. Must carry the `onboarding` permission. |

```bash theme={null}
curl https://qa-api.endl.xyz/api/v0/customer?size=1 \
  -H "API-KEY: $ENDL_API_KEY"
```

A missing or blank key returns `401 Authentication Failed!`. A key without the
`onboarding` permission returns `403` on every call.

## Content types

<ResponseField name="JSON endpoints" type="application/json">
  Create, update, get, list, kyc-link and delete. Any other content type returns `415`.
</ResponseField>

<ResponseField name="Document uploads" type="multipart/form-data">
  A file part named `document`, plus text form fields.
</ResponseField>

## Rate limiting

Each partner has a per-minute cap. Exceeding it returns `429` and the request is
not processed — retry in the next minute window.

|                         |                                               |
| ----------------------- | --------------------------------------------- |
| Limit (sandbox partner) | 120 requests / minute                         |
| Response                | `429 Rate limit exceeded, please retry later` |
| Headers                 | `X-RateLimit-Limit`, `X-RateLimit-Remaining`  |

## Correlation id

Every response carries an **`X-Request-ID`** header. Log it, and quote it when
reporting a problem so the backend can trace that exact request.

## Validate everything, then create

On create and update the **whole** payload — identity, questionnaire and custom
fields — is validated before anything is written. If a single field is wrong the
request is rejected with `400` and nothing is created. It is all-or-nothing, so a
failed create leaves no partial customer behind.