Skip to main content
POST
Upload owner document

Authorizations

API-KEY
string
header
required

Your partner API key. The key must carry the customers permission.

Headers

Api-Version
string
default:2026-09.1
required

The API version this request targets. Required on every /api/v0/* call. Format YYYY-MM.<release>; 2026-09.1 is the latest. The version that served the request is echoed back on the response. Missing, malformed or unsupported values are rejected with 400.

Pattern: ^\d{4}-\d{2}\.\d+$

Path Parameters

userId
string
required

The customer reference id returned by create — a cus_-prefixed string, not a UUID.

uboRef
string
required

The owner's applicantId, returned per beneficiary by create. Owners have no userId of their own.

Body

multipart/form-data
document
file
required

JPEG, PNG or PDF. Maximum 5 MB; the whole request is capped at 10 MB.

idDocType
string
required

PASSPORT, ID_CARD, DRIVERS, RESIDENCE_PERMIT, SELFIE, or UTILITY_BILL for proof of address. DRIVERS_LICENSE is still accepted as an alias for DRIVERS. These are the recommended values: Endl does not validate the value, and any non-blank idDocType is passed to the verification provider. ERRCUS_1406 is not returned here. Omitted entirely → 400 ERRCORE_1001 (idDocType is required); sent but blank → ERRCUS_1405.

country
string
required

ISO 3166-1 alpha-3. Omitted entirely → 400 ERRCORE_1001 (country is required); sent but blank → ERRCUS_1012; invalid → ERRCUS_1013.

side
string

FRONT or BACK, for two-sided documents (ID_CARD, DRIVERS). Not validated.

Response

Accepted. A business keeps its current status (normally INITIATED) until the company and every owner are in, then PENDING. A business never returns SUBMITTED.

accepted
boolean

Whether the upload was accepted.

status
string

The customer's verification status after the upload.

missing
string[]

The document steps (IDENTITY, SELFIE, PROOF_OF_RESIDENCE) this owner still needs; omitted when none.