К содержимому
OneKYC
Tenant API (KYC)

Задачи ревью (manual review API)

Обновлено:

Методы Tenant API для серверного ручного ревью: очередь, деталь задачи, assign на API-ключ, approve/reject, комментарии, приоритет, resubmit шага и presigned URL документов.

Эндпоинты рассчитаны на интеграторов, которые ведут ревью во внешней системе (свой back-office или автоматизация). Операторы админ-панели работают через UI — см. Админ → Ревью.

Базовые пути:

ПродуктBase
KYC/tenant/v1/kyc/review-tasks
KYB/tenant/v1/kyb/review-tasks

Аутентификация: HMAC-SHA256 с KYC или KYB API-ключом. См. Аутентификация.

Необходимые scopes

ScopeДоступ
reviews:readKYC: очередь, stats, reject-reasons, деталь, комментарии, resubmits
reviews:writeKYC: assign, approve, reject, comment, priority, request-resubmit
media:readKYC: URL документов (вместе с reviews:read)
kyb.reviews:readKYB чтение
kyb.reviews:writeKYB запись
kyb.media:readKYB URL документов (вместе с kyb.reviews:read)

KYC-ключ не может вызывать /kyb/review-tasks/* (HTTP 403), и наоборот.

Мутации атрибутируются API-ключу (actor_type=api_key): assign, комментарии и финальные решения сохраняют id ключа и display name.

Поля ответа для идентичности актора (если заполнены):

РесурсПоля
Очередь / деталь задачиassigned_to, assigned_to_type (admin_user | superadmin_user | api_key), assigned_display_name
Деталь после решенияdecision_by, decision_by_type, decision_display_name
Комментарийauthor_id, author_type, author_display_name

Типовой сценарий

  1. Подписка на verification.needs_review — Вебхуки.
  2. GET .../review-tasks — очередь (status=pending / in_progress).
  3. GET .../review-tasks/{task_id} — деталь и review_reasons.
  4. POST .../assign — взять задачу на текущий API-ключ.
  5. При необходимости GET .../documents/{document_id}/url.
  6. Решение:
    • POST .../approve
    • POST .../reject с каноническим reason_code из GET .../reject-reasons
    • или POST .../request-resubmit для одного шага

После финального решения уходят terminal webhook-события (verification.approved / verification.declined).

Очередь

GET
/v1/kyc/review-tasks

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Query Parameters

page?integer

Page (default 1)

page_size?integer

Page size (1-100, default 50)

status?string

Comma-separated statuses: pending,assigned,in_progress,awaiting_resubmit,approved,rejected,completed

priority?string

Comma-separated priorities: low,medium,high,urgent

flow_id?string

Flow UUID

assigned_to?string

Reviewer/API key UUID

session_id?string

Session UUID

applicant_id?string

Applicant UUID

q?string

Search by external ID/name

date_from?string

From (RFC3339)

date_to?string

To (RFC3339)

sla_status?string

SLA status: breached, warning, ok

sort?string

Sort order: priority_desc, sla_asc, created_at_asc, created_at_desc

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?array<>
pagination?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks' \  -H 'X-Timestamp: string'
Example Response
{  "pagination": {    "page": 0,    "page_size": 0,    "total_items": 0,    "total_pages": 0  },  "success": true,  "data": [    {      "applicant_first_name": "string",      "applicant_full_name": "string",      "applicant_full_name_latin": "string",      "applicant_full_name_native": "string",      "applicant_full_name_original": "string",      "applicant_id": "string",      "applicant_last_name": "string",      "applicant_middle_name": "string",      "applicant_nationality": "string",      "assigned_at": "string",      "assigned_display_name": "string",      "assigned_to": "string",      "assigned_to_type": "string",      "business_company_name": "string",      "business_country": "string",      "business_external_id": "string",      "business_id": "string",      "business_registration_number": "string",      "business_tax_number": "string",      "created_at": "string",      "external_user_id": "string",      "flow_id": "string",      "flow_name": "string",      "id": "string",      "priority": 0,      "reason": "string",      "review_reasons": [        {}      ],      "reviewer_email": "string",      "reviewer_first_name": "string",      "reviewer_last_name": "string",      "session_created_at": "string",      "session_environment": "string",      "session_id": "string",      "sla_breached": true,      "sla_deadline": "string",      "started_at": "string",      "status": "string",      "system_decision": "string",      "tenant_id": "string",      "verification_result": "string",      "verification_score": 0    }  ]}

KYB: GET /tenant/v1/kyb/review-tasks (те же фильтры; поиск по company/external id).

Алиасы status

QueryВнутренние статусы
in_progressassigned
completedapproved, rejected
прочиекак есть (pending, awaiting_resubmit, …)

Приоритет

ЗначениеЧисло
low1
medium2
high3
urgent4

Stats и причины отклонения

GET
/v1/kyc/review-tasks/stats

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/stats' \  -H 'X-Timestamp: string'
Example Response
{  "success": true,  "data": {    "avg_time_minutes": 0,    "completed_today": 0,    "in_progress": 0,    "pending": 0  }}
GET
/v1/kyc/review-tasks/reject-reasons

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?array<>
pagination?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/reject-reasons' \  -H 'X-Timestamp: string'
Example Response
{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "category": "string",      "code": "string",      "label_en": "string",      "label_ru": "string"    }  ]}

Канонические коды reject (только их принимает POST .../reject):

blurry_document, expired_document, wrong_document_type, document_mismatch, unreadable_document, face_not_matching, poor_selfie_quality, liveness_failed, face_obscured, sanctions_match, pep_match, adverse_media, suspected_fraud, duplicate_account, incomplete_data, other.

Неканонический reason_code → HTTP 400.

Деталь, комментарии, документы

GET
/v1/kyc/review-tasks/{task_id}

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string' \  -H 'X-Timestamp: string'
Example Response
{  "success": true,  "data": {    "comments": [      {        "author_display_name": "string",        "author_id": "string",        "author_type": "string",        "content": "string",        "created_at": "string",        "id": "string",        "task_id": "string"      }    ],    "task": {      "applicant_id": "string",      "approval_blocked_reason": "string",      "assigned_at": "string",      "assigned_display_name": "string",      "assigned_to": "string",      "assigned_to_type": "string",      "completed_at": "string",      "created_at": "string",      "decision": "string",      "decision_at": "string",      "decision_by": "string",      "decision_by_type": "string",      "decision_display_name": "string",      "external_user_id": "string",      "flow_id": "string",      "flow_name": "string",      "history": [        {          "action": "string",          "actor_id": "string",          "actor_name": "string",          "actor_type": "string",          "created_at": "string",          "details": {            "property1": null,            "property2": null          },          "id": "string"        }      ],      "id": "string",      "notes": "string",      "priority": 0,      "reason": "string",      "reason_details": "string",      "reject_reason_code": "string",      "resubmit_limit_override": 0,      "review_reasons": [        {}      ],      "session_created_at": "string",      "session_entity_type": "string",      "session_environment": "string",      "session_id": "string",      "session_status": "string",      "status": "string",      "system_decision": "string",      "tenant_id": "string"    }  }}

У неназначенных задач нет assigned_to / assigned_to_type / assigned_display_name (не подставляется admin_user). После assign/decision type — одно из admin_user | superadmin_user | api_key.

GET
/v1/kyc/review-tasks/{task_id}/comments

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?array<>
pagination?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/comments' \  -H 'X-Timestamp: string'
Example Response
{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "author_display_name": "string",      "author_id": "string",      "author_type": "string",      "content": "string",      "created_at": "string",      "id": "string",      "task_id": "string"    }  ]}
POST
/v1/kyc/review-tasks/{task_id}/comments

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Request Body

Comment payload

application/json
  1. body
content?string

Content is the comment text (required, non-empty after trim).

Response Body

OK

application/json
  1. response
data?
success?boolean
Example Request
curl -X POST 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/comments' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "success": true,  "data": {    "author_display_name": "string",    "author_id": "string",    "author_type": "string",    "comment_id": "string",    "content": "string",    "created_at": "string",    "message": "string",    "task_id": "string"  }}

Поле текста комментария — content (не body). Пример: {"content":"Нужно более чёткое фото паспорта"}. В ответе: author_id, author_type (api_key для HMAC), author_display_name.

GET
/v1/kyc/review-tasks/{task_id}/documents/{document_id}/url

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

document_id*string

Document ID or storage key suffix

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?unknown
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/documents/string/url' \  -H 'X-Timestamp: string'
Example Response
{  "data": null,  "success": true}

Мутации: assign, priority, decide

POST
/v1/kyc/review-tasks/{task_id}/assign

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?unknown
success?boolean
Example Request
curl -X POST 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/assign' \  -H 'X-Timestamp: string'
Example Response
{  "data": null,  "success": true}

Assign возможен для pending и awaiting_resubmit. Задача назначается на текущий API-ключ.

PATCH
/v1/kyc/review-tasks/{task_id}/priority

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Request Body

Priority payload

application/json
  1. body
priority?string

Response Body

OK

application/json
  1. response
data?unknown
success?boolean
Example Request
curl -X PATCH 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/priority' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "data": null,  "success": true}
POST
/v1/kyc/review-tasks/{task_id}/approve

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Request Body

Optional comment and optimistic lock timestamp

application/json
  1. body
comment?string
if_unmodified_since?string

Response Body

OK

application/json
  1. response
data?unknown
success?boolean
Example Request
curl -X POST 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/approve' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "data": null,  "success": true}
POST
/v1/kyc/review-tasks/{task_id}/reject

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Request Body

Reject payload

application/json
  1. body
comment?string
if_unmodified_since?string
reason_code?string

Response Body

OK

application/json
  1. response
data?unknown
success?boolean
Example Request
curl -X POST 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/reject' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "data": null,  "success": true}

Опционально: if_unmodified_since (RFC3339) для optimistic concurrency.

Resubmit

POST
/v1/kyc/review-tasks/{task_id}/request-resubmit

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Request Body

Resubmit payload

application/json
  1. body
client_message?string
internal_notes?string
reason_code?string
request_id?string
scope?string
step_id?string

Response Body

OK

application/json
  1. response
data?
success?boolean
Example Request
curl -X POST 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/request-resubmit' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "success": true,  "data": {    "clientMessage": "string",    "createdAt": "string",    "deliveredAt": "string",    "deliveryChannel": "string",    "expiresAt": "string",    "fulfilledAt": "string",    "id": "string",    "internalNotes": "string",    "reasonCode": "string",    "requestedBy": "string",    "requestedByDisplayName": "string",    "requestedByType": "string",    "scope": "string",    "sessionID": "string",    "status": "string",    "stepID": "string",    "taskID": "string",    "tenantID": "string",    "updatedAt": "string"  }}
GET
/v1/kyc/review-tasks/{task_id}/resubmits

Authorization

ApiKeyAuth
headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

X-Timestamp*string

Unix timestamp (seconds, max 5 min drift)

Response Body

OK

application/json
  1. response
data?array<>
pagination?
success?boolean
Example Request
curl -X GET 'https://api.onekyc.io/tenant/v1/kyc/review-tasks/string/resubmits' \  -H 'X-Timestamp: string'
Example Response
{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "clientMessage": "string",      "createdAt": "string",      "deliveredAt": "string",      "deliveryChannel": "string",      "expiresAt": "string",      "fulfilledAt": "string",      "id": "string",      "internalNotes": "string",      "reasonCode": "string",      "requestedBy": "string",      "requestedByDisplayName": "string",      "requestedByType": "string",      "scope": "string",      "sessionID": "string",      "status": "string",      "stepID": "string",      "taskID": "string",      "tenantID": "string",      "updatedAt": "string"    }  ]}

Коды resubmit (качество шага), не путать с reject reasons: illegible, blurry, cropped, glare, wrong_document, expired_document, partial.

Лимиты: ≤ 3 на сессию, TTL 7 дней, один active request на пару (session, step). Вебхуки: Manual Review Resubmit.

KYB

Зеркальные методы: /tenant/v1/kyb/review-tasks со scopes kyb.reviews:* и kyb.media:read. См. KYB API — Справочник и OpenAPI.

Только admin (не Tenant API)

  • reassign / unassign другому оператору
  • delegate команде OneKYC
  • cancel resubmit
  • вспомогательные list resubmittable steps UI-эндпоинты консоли

См. также

На этой странице