Share Verified KYC/KYB Data

Applies a SumSub share token to an existing customer, transferring an already-verified profile instead of requiring the customer to go through verification again. One token covers the whole share: an INDIVIDUAL's own verified profile, or a CORPORATE profile copied together with its verified beneficiaries/UBOs — the company profile is derived from the shared applicant.

The token is validated before it is consumed. If it is rejected, the response reports applied: false with the reason in message; nothing is applied, and the request can be retried after fixing the token. Malformed requests fail with 400 before any side effect.

A customer can be successfully shared exactly once. Repeating the call after a successful share (applied: true) returns 409. If the previous attempt failed (applied: false), the same customer can be shared again with a corrected token.

Not available for partners on the BaaS verification program (403).

Endpoint

POST/v2/compliance/{customerId}/share

Link

https://stagep.tst-apidmndelss.com/openapi/v2.html#/operations/Customer_Share

Request

Path Parameters

Parameter	Type	Description	Required	Example
customerId	string	Customer ID to apply the share to.	Yes	"DCalXLc-KRLb-ICUZ4pnjWNvo"

Headers

Key	Value	Required
Authorization	Bearer <JWT>	Yes
Content-Type	application/json	Yes
Accept	application/json	Yes

Body

ShareRequest carries a SumSub share token for an existing customer. Tokens are short-lived (~20 minutes) and single-use; the token is validated upfront and nothing is consumed if it is rejected.

Field	Type	Description	Required
applicant	object	KycShareApplicant — the customer's own shared, already-verified profile.	Yes
applicant.token	string	The SumSub share token.	Yes

Example Request Body:

{
  "applicant": {
    "token": "string"
  }
}

Response (200 OK)

Returns a KycShareResult reporting the outcome of share-token processing.

Response Fields

Field	Type	Description	Example
applied	boolean	true if and only if compliance accepted and applied the token.	true
message	string	Failure reason when the token was not applied (e.g. expired token, shared applicant not approved).	"Token expired"
outstanding	array[string]	Document sets still required when the shared data did not fully cover the target verification level.	["PROOF_OF_RESIDENCE"]

Example Response — Success, fully verified:

{
  "applied": true,
  "message": "",
  "outstanding": []
}

Example Response — Success, additional documents required:

{
  "applied": true,
  "message": "",
  "outstanding": ["PROOF_OF_RESIDENCE"]
}

Example Response — Token rejected:

{
  "applied": false,
  "message": "Token expired",
  "outstanding": []
}

---

Examples

Request

curl --request POST \
  --url https://tp2.tst-apidmndelss.com/v2/compliance/customerId/share \
  --header 'Accept: application/json' \
  --header 'Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOjUzOCwiZXhwIjoxNzc4MDU5NzU0LCJrZXkiOiI1ODg4MTk4NDNkZWE1OWRkMzhlMjA5MTM3NDg4MmY2OGVkY2Q1MWJkIiwib3RwX3ZlcmlmaWVkIjpmYWxzZX0.JlzM3bXwNcIIDXI8bLS02kuI41w3Z-me3aqj3W3_4RY' \
  --header 'Content-Type: application/json' \
  --data '{
  "applicant": {
    "token": "string"
  }
}'

Response

{
  "applied": true,
  "message": "",
  "outstanding": ["PROOF_OF_RESIDENCE"]
}

---

Error Responses

Malformed Request (400):

{
  "error": "Invalid request body"
}

Access Restricted for BaaS Verification Program (403):

{ 
  "error": "Not available for partners on the BaaS verification program" 
}

Customer Already Shared (409):

{ 
  "error": "Customer has already been shared" 
}

Authorization fail

{ 
  "error": "Unauthorized" 
}

---

Required Follow-Up Steps

A successful share (applied: true) is not the end of the flow — two follow-up actions are required:

1. Finalize the application — call PATCH /v2/customer/{customerId}/application to update the customer's application status based on the applied data.
2. Cover outstanding documents, if any — if the response includes items in outstanding, the shared data did not fully satisfy the required verification level. Generate a link via GET /v2/compliance/{customerId}/web_sdk_link so the customer can upload the missing document sets.

---

Notes

• Single successful share: only a successfully applied token consumes the one-time share. A rejected token (applied: false) does not block retrying with a corrected token for the same customerId.
• Token lifetime: share tokens are short-lived (~20 minutes) and single-use — request a fresh token from SumSub if it expires before use.
• Scope of the share: for CORPORATE applicants, the shared profile includes verified beneficiaries/UBOs; there is no separate call needed to bring those over.
• BaaS verification program: partners operating under the BaaS verification program cannot use this method (403) — their customers must complete standard verification via Get Compliance Link.
• Prerequisite — matching verification levels: Before using this endpoint, ensure that the KYC/KYB verification level shared with the partner via Sumsub Partner Levels exactly matches the level used on your own side. A mismatch between levels will prevent the share flow from working correctly, even if the token itself is valid. See Configuring Partner Verification Levels for setup instructions.

Typical Workflow:

1. Customer's SumSub share token is obtained.
2. Call POST /v2/compliance/{customerId}/share with the token.
3. If applied: false → fix the token and retry from step 2.
4. If applied: true → call PATCH /v2/customer/{customerId}/application to finalize the application.
5. If outstanding is non-empty → generate a GET /v2/compliance/{customerId}/web_sdk_link link for the customer to upload the remaining documents.
6. Customer status updates accordingly (e.g. MODERATED → ACCEPTED).