Review tasks (manual review API)

Tenant API methods for server-side manual review: list the queue, inspect a task, assign it to the calling API key, approve or reject, comment, change priority, request a step resubmit, and fetch document URLs.

These endpoints are intended for integrators that run review outside the admin console (their own back-office or automation). Admin-panel operators use the console UI; see Admin → Review.

Base paths:

Product	Base
KYC	`/tenant/v1/kyc/review-tasks`
KYB	`/tenant/v1/kyb/review-tasks`

Authentication: HMAC-SHA256 with a KYC or KYB API key. See Authentication.

Required scopes

Scope	Access
`reviews:read`	KYC: list queue, stats, reject reasons, task detail, comments, resubmits
`reviews:write`	KYC: assign, approve, reject, comment, priority, request resubmit
`media:read`	KYC: document presigned URLs (together with `reviews:read`)
`kyb.reviews:read`	KYB read surface
`kyb.reviews:write`	KYB write surface
`kyb.media:read`	KYB document URLs (together with `kyb.reviews:read`)

KYC keys cannot call /kyb/review-tasks/* (HTTP 403). KYB keys cannot call /kyc/review-tasks/*.

Mutations are attributed to the API key (actor_type=api_key): assignment, comments, and final decisions store the key id and display name.

Response fields for actor identity (when present):

Resource	Fields
Queue item / task detail	`assigned_to`, `assigned_to_type` (`admin_user` \| `superadmin_user` \| `api_key`), `assigned_display_name`
Task detail after decision	`decision_by`, `decision_by_type`, `decision_display_name`
Comment	`author_id`, `author_type`, `author_display_name`

Typical flow

Subscribe to verification.needs_review (and related webhooks) — see Webhooks.
GET .../review-tasks — pull the queue (status=pending or in_progress).
GET .../review-tasks/{task_id} — load detail and review_reasons.
POST .../assign — claim the task for this API key.
Inspect media via GET .../documents/{document_id}/url when needed.
Decide:
- POST .../approve
- POST .../reject with a canonical reason_code from GET .../reject-reasons or a nonblank own comment
- or POST .../request-resubmit for a single step (limits apply)

After a final decision, webhooks emit the terminal verification outcome (verification.approved / verification.declined / session completed).

List queue

GET

/v1/kyc/review-tasks

GET

/v1/kyc/review-tasks

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Query Parameters

page?integer

Page (default 1)

page_size?integer

Page size (1-100, default 50)

status?string

Comma-separated statuses: pending,assigned,in_progress,awaiting_resubmit,approved,rejected,completed

priority?string

Comma-separated priorities: low,medium,high,urgent

flow_id?string

Flow UUID

assigned_to?string

Reviewer/API key UUID

session_id?string

Session UUID

applicant_id?string

Applicant UUID

q?string

Search by external ID/name

date_from?string

From (RFC3339)

date_to?string

To (RFC3339)

sla_status?string

SLA status: breached, warning, ok

sort?string

Sort order: priority_desc, sla_asc, created_at_asc, created_at_desc

Header Parameters

Response Body

application/json

response

data?array<>

pagination?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "pagination": {
    "page": 0,
    "page_size": 0,
    "total_items": 0,
    "total_pages": 0
  },
  "success": true,
  "data": [
    {
      "applicant_first_name": "string",
      "applicant_full_name": "string",
      "applicant_full_name_latin": "string",
      "applicant_full_name_native": "string",
      "applicant_full_name_original": "string",
      "applicant_id": "string",
      "applicant_last_name": "string",
      "applicant_middle_name": "string",
      "applicant_nationality": "string",
      "assigned_at": "string",
      "assigned_display_name": "string",
      "assigned_to": "string",
      "assigned_to_type": "string",
      "business_company_name": "string",
      "business_country": "string",
      "business_external_id": "string",
      "business_id": "string",
      "business_registration_number": "string",
      "business_tax_number": "string",
      "created_at": "string",
      "external_user_id": "string",
      "flow_id": "string",
      "flow_name": "string",
      "id": "string",
      "priority": 0,
      "reason": "string",
      "review_reasons": [
        {}
      ],
      "reviewer_email": "string",
      "reviewer_first_name": "string",
      "reviewer_last_name": "string",
      "session_created_at": "string",
      "session_environment": "string",
      "session_id": "string",
      "sla_breached": true,
      "sla_deadline": "string",
      "started_at": "string",
      "status": "string",
      "system_decision": "string",
      "tenant_id": "string",
      "verification_result": "string",
      "verification_score": 0
    }
  ]
}

{  "pagination": {    "page": 0,    "page_size": 0,    "total_items": 0,    "total_pages": 0  },  "success": true,  "data": [    {      "applicant_first_name": "string",      "applicant_full_name": "string",      "applicant_full_name_latin": "string",      "applicant_full_name_native": "string",      "applicant_full_name_original": "string",      "applicant_id": "string",      "applicant_last_name": "string",      "applicant_middle_name": "string",      "applicant_nationality": "string",      "assigned_at": "string",      "assigned_display_name": "string",      "assigned_to": "string",      "assigned_to_type": "string",      "business_company_name": "string",      "business_country": "string",      "business_external_id": "string",      "business_id": "string",      "business_registration_number": "string",      "business_tax_number": "string",      "created_at": "string",      "external_user_id": "string",      "flow_id": "string",      "flow_name": "string",      "id": "string",      "priority": 0,      "reason": "string",      "review_reasons": [        {}      ],      "reviewer_email": "string",      "reviewer_first_name": "string",      "reviewer_last_name": "string",      "session_created_at": "string",      "session_environment": "string",      "session_id": "string",      "sla_breached": true,      "sla_deadline": "string",      "started_at": "string",      "status": "string",      "system_decision": "string",      "tenant_id": "string",      "verification_result": "string",      "verification_score": 0    }  ]}

KYB equivalent: GET /tenant/v1/kyb/review-tasks (same filters; search is company/external id oriented).

Status filter aliases

Query value	Stored statuses
`in_progress`	`assigned`
`completed`	`approved`, `rejected`
other values	passed through (`pending`, `awaiting_resubmit`, …)

Priority values

Wire value	Numeric priority
`low`	1
`medium`	2
`high`	3
`urgent`	4

Stats and reject reasons

GET

/v1/kyc/review-tasks/stats

GET

/v1/kyc/review-tasks/stats

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Header Parameters

Response Body

application/json

response

data?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/stats' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/stats' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "success": true,
  "data": {
    "avg_time_minutes": 0,
    "completed_today": 0,
    "in_progress": 0,
    "pending": 0
  }
}

{  "success": true,  "data": {    "avg_time_minutes": 0,    "completed_today": 0,    "in_progress": 0,    "pending": 0  }}

GET

/v1/kyc/review-tasks/reject-reasons

GET

/v1/kyc/review-tasks/reject-reasons

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Header Parameters

Response Body

application/json

response

data?array<>

pagination?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/reject-reasons' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/reject-reasons' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "pagination": {
    "has_more": true,
    "limit": 0,
    "next_cursor": "string",
    "offset": 0,
    "total": 0
  },
  "success": true,
  "data": [
    {
      "category": "string",
      "code": "string",
      "label_en": "string",
      "label_ru": "string"
    }
  ]
}

{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "category": "string",      "code": "string",      "label_en": "string",      "label_ru": "string"    }  ]}

Canonical rejection codes (must be used on POST .../reject):

Code	Category
`blurry_document`	document
`expired_document`	document
`wrong_document_type`	document
`document_mismatch`	document
`unreadable_document`	document
`face_not_matching`	biometric
`poor_selfie_quality`	biometric
`liveness_failed`	biometric
`face_obscured`	biometric
`sanctions_match`	aml
`pep_match`	aml
`adverse_media`	aml
`suspected_fraud`	general
`duplicate_account`	general
`incomplete_data`	general
`other`	general

Invalid reason_code → HTTP 400.

Task detail, comments, documents

GET

/v1/kyc/review-tasks/{task_id}

GET

/v1/kyc/review-tasks/{task_id}

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Response Body

application/json

response

data?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "success": true,
  "data": {
    "comments": [
      {
        "author_display_name": "string",
        "author_id": "string",
        "author_type": "string",
        "content": "string",
        "created_at": "string",
        "id": "string",
        "task_id": "string"
      }
    ],
    "task": {
      "applicant_id": "string",
      "approval_blocked_reason": "string",
      "assigned_at": "string",
      "assigned_display_name": "string",
      "assigned_to": "string",
      "assigned_to_type": "string",
      "completed_at": "string",
      "created_at": "string",
      "decision": "string",
      "decision_at": "string",
      "decision_by": "string",
      "decision_by_type": "string",
      "decision_display_name": "string",
      "external_user_id": "string",
      "flow_id": "string",
      "flow_name": "string",
      "history": [
        {
          "action": "string",
          "actor_id": "string",
          "actor_name": "string",
          "actor_type": "string",
          "created_at": "string",
          "details": {
            "property1": null,
            "property2": null
          },
          "id": "string"
        }
      ],
      "id": "string",
      "notes": "string",
      "priority": 0,
      "reason": "string",
      "reason_details": "string",
      "reject_reason_code": "string",
      "resubmit_limit_override": 0,
      "review_reasons": [
        {}
      ],
      "session_created_at": "string",
      "session_entity_type": "string",
      "session_environment": "string",
      "session_id": "string",
      "session_status": "string",
      "status": "string",
      "system_decision": "string",
      "tenant_id": "string"
    }
  }
}

{  "success": true,  "data": {    "comments": [      {        "author_display_name": "string",        "author_id": "string",        "author_type": "string",        "content": "string",        "created_at": "string",        "id": "string",        "task_id": "string"      }    ],    "task": {      "applicant_id": "string",      "approval_blocked_reason": "string",      "assigned_at": "string",      "assigned_display_name": "string",      "assigned_to": "string",      "assigned_to_type": "string",      "completed_at": "string",      "created_at": "string",      "decision": "string",      "decision_at": "string",      "decision_by": "string",      "decision_by_type": "string",      "decision_display_name": "string",      "external_user_id": "string",      "flow_id": "string",      "flow_name": "string",      "history": [        {          "action": "string",          "actor_id": "string",          "actor_name": "string",          "actor_type": "string",          "created_at": "string",          "details": {            "property1": null,            "property2": null          },          "id": "string"        }      ],      "id": "string",      "notes": "string",      "priority": 0,      "reason": "string",      "reason_details": "string",      "reject_reason_code": "string",      "resubmit_limit_override": 0,      "review_reasons": [        {}      ],      "session_created_at": "string",      "session_entity_type": "string",      "session_environment": "string",      "session_id": "string",      "session_status": "string",      "status": "string",      "system_decision": "string",      "tenant_id": "string"    }  }}

Unassigned tasks omit assigned_to / assigned_to_type / assigned_display_name (they are not defaulted to admin_user). After assign or decision, type is one of admin_user | superadmin_user | api_key.

GET

/v1/kyc/review-tasks/{task_id}/comments

GET

/v1/kyc/review-tasks/{task_id}/comments

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Response Body

application/json

response

data?array<>

pagination?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/comments' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/comments' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "pagination": {
    "has_more": true,
    "limit": 0,
    "next_cursor": "string",
    "offset": 0,
    "total": 0
  },
  "success": true,
  "data": [
    {
      "author_display_name": "string",
      "author_id": "string",
      "author_type": "string",
      "content": "string",
      "created_at": "string",
      "id": "string",
      "task_id": "string"
    }
  ]
}

{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "author_display_name": "string",      "author_id": "string",      "author_type": "string",      "content": "string",      "created_at": "string",      "id": "string",      "task_id": "string"    }  ]}

POST

/v1/kyc/review-tasks/{task_id}/comments

POST

/v1/kyc/review-tasks/{task_id}/comments

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Request Body

Comment payload

application/json

body

content?string

Content is the comment text (required, non-empty after trim).

Response Body

application/json

response

data?

success?boolean

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/comments' \
  -H 'X-Timestamp: string' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/comments' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'

Example ResponseSchema

{
  "success": true,
  "data": {
    "author_display_name": "string",
    "author_id": "string",
    "author_type": "string",
    "comment_id": "string",
    "content": "string",
    "created_at": "string",
    "message": "string",
    "task_id": "string"
  }
}

{  "success": true,  "data": {    "author_display_name": "string",    "author_id": "string",    "author_type": "string",    "comment_id": "string",    "content": "string",    "created_at": "string",    "message": "string",    "task_id": "string"  }}

Comment body field is content (JSON string). Example: {"content":"Needs a clearer passport photo"}. Response includes author_id, author_type (api_key for HMAC callers), and author_display_name.

GET

/v1/kyc/review-tasks/{task_id}/documents/{document_id}/url

GET

/v1/kyc/review-tasks/{task_id}/documents/{document_id}/url

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

document_id*string

Document ID or storage key suffix

Header Parameters

Response Body

application/json

response

data?unknown

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/documents/string/url' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/documents/string/url' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "data": null,
  "success": true
}

{  "data": null,  "success": true}

document_id may be a full storage key or a suffix under the session documents prefix. Path traversal (.., \) is rejected.

Mutations: assign, priority, decide

POST

/v1/kyc/review-tasks/{task_id}/assign

POST

/v1/kyc/review-tasks/{task_id}/assign

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Response Body

application/json

response

data?unknown

success?boolean

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/assign' \
  -H 'X-Timestamp: string'

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/assign' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "data": null,
  "success": true
}

{  "data": null,  "success": true}

Assign only succeeds for tasks in pending or awaiting_resubmit. The task is assigned to the current API key (not an admin user).

PATCH

/v1/kyc/review-tasks/{task_id}/priority

PATCH

/v1/kyc/review-tasks/{task_id}/priority

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Request Body

Priority payload

application/json

body

priority?string

Response Body

application/json

response

data?unknown

success?boolean

Example Request

curl -X PATCH 'https://example.com/tenant/v1/kyc/review-tasks/string/priority' \
  -H 'X-Timestamp: string' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example Request

curl -X PATCH 'https://example.com/tenant/v1/kyc/review-tasks/string/priority' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'

Example ResponseSchema

{
  "data": null,
  "success": true
}

{  "data": null,  "success": true}

POST

/v1/kyc/review-tasks/{task_id}/approve

POST

/v1/kyc/review-tasks/{task_id}/approve

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Request Body

Optional comment and optimistic lock timestamp

application/json

body

comment?string

if_unmodified_since?string

Response Body

application/json

response

data?unknown

success?boolean

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/approve' \
  -H 'X-Timestamp: string' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/approve' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'

Example ResponseSchema

{
  "data": null,
  "success": true
}

{  "data": null,  "success": true}

POST

/v1/kyc/review-tasks/{task_id}/reject

POST

/v1/kyc/review-tasks/{task_id}/reject

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Request Body

Reject payload

application/json

body

comment?string

if_unmodified_since?string

reason_code?string

Response Body

application/json

response

data?unknown

success?boolean

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/reject' \
  -H 'X-Timestamp: string' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/reject' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'

Example ResponseSchema

{
  "data": null,
  "success": true
}

{  "data": null,  "success": true}

Optional optimistic concurrency: send if_unmodified_since (RFC3339) with the last known updated_at / task timestamp when available.

Resubmit

POST

/v1/kyc/review-tasks/{task_id}/request-resubmit

POST

/v1/kyc/review-tasks/{task_id}/request-resubmit

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

Path Parameters

task_id*string

Review task UUID

Header Parameters

Request Body

Resubmit payload

application/json

body

client_message?string

internal_notes?string

reason_code?string

request_id?string

scope?string

step_id?string

Response Body

application/json

response

data?

success?boolean

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/request-resubmit' \
  -H 'X-Timestamp: string' \
  -H 'Content-Type: application/json' \
  -d '{}'

Example Request

curl -X POST 'https://example.com/tenant/v1/kyc/review-tasks/string/request-resubmit' \  -H 'X-Timestamp: string' \  -H 'Content-Type: application/json' \  -d '{}'

Example ResponseSchema

{
  "success": true,
  "data": {
    "clientMessage": "string",
    "createdAt": "string",
    "deliveredAt": "string",
    "deliveryChannel": "string",
    "expiresAt": "string",
    "fulfilledAt": "string",
    "id": "string",
    "internalNotes": "string",
    "reasonCode": "string",
    "requestedBy": "string",
    "requestedByDisplayName": "string",
    "requestedByType": "string",
    "scope": "string",
    "sessionID": "string",
    "status": "string",
    "stepID": "string",
    "taskID": "string",
    "tenantID": "string",
    "updatedAt": "string"
  }
}

{  "success": true,  "data": {    "clientMessage": "string",    "createdAt": "string",    "deliveredAt": "string",    "deliveryChannel": "string",    "expiresAt": "string",    "fulfilledAt": "string",    "id": "string",    "internalNotes": "string",    "reasonCode": "string",    "requestedBy": "string",    "requestedByDisplayName": "string",    "requestedByType": "string",    "scope": "string",    "sessionID": "string",    "status": "string",    "stepID": "string",    "taskID": "string",    "tenantID": "string",    "updatedAt": "string"  }}

GET

/v1/kyc/review-tasks/{task_id}/resubmits

GET

/v1/kyc/review-tasks/{task_id}/resubmits

Authorization

ApiKeyAuth

headerAuthorization<token>

HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>. SignedHeaders=x-timestamp is optional. Requires X-Timestamp header.

response

data?array<>

pagination?

success?boolean

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/resubmits' \
  -H 'X-Timestamp: string'

Example Request

curl -X GET 'https://example.com/tenant/v1/kyc/review-tasks/string/resubmits' \  -H 'X-Timestamp: string'

Example ResponseSchema

{
  "pagination": {
    "has_more": true,
    "limit": 0,
    "next_cursor": "string",
    "offset": 0,
    "total": 0
  },
  "success": true,
  "data": [
    {
      "clientMessage": "string",
      "createdAt": "string",
      "deliveredAt": "string",
      "deliveryChannel": "string",
      "expiresAt": "string",
      "fulfilledAt": "string",
      "id": "string",
      "internalNotes": "string",
      "reasonCode": "string",
      "requestedBy": "string",
      "requestedByDisplayName": "string",
      "requestedByType": "string",
      "scope": "string",
      "sessionID": "string",
      "status": "string",
      "stepID": "string",
      "taskID": "string",
      "tenantID": "string",
      "updatedAt": "string"
    }
  ]
}

{  "pagination": {    "has_more": true,    "limit": 0,    "next_cursor": "string",    "offset": 0,    "total": 0  },  "success": true,  "data": [    {      "clientMessage": "string",      "createdAt": "string",      "deliveredAt": "string",      "deliveryChannel": "string",      "expiresAt": "string",      "fulfilledAt": "string",      "id": "string",      "internalNotes": "string",      "reasonCode": "string",      "requestedBy": "string",      "requestedByDisplayName": "string",      "requestedByType": "string",      "scope": "string",      "sessionID": "string",      "status": "string",      "stepID": "string",      "taskID": "string",      "tenantID": "string",      "updatedAt": "string"    }  ]}

Resubmit reason codes (step quality) are separate from final rejection codes:

Code	Meaning
`illegible`	Text unreadable
`blurry`	Image blurred
`cropped`	Document cropped
`glare`	Glare
`wrong_document`	Wrong type
`expired_document`	Expired
`partial`	Incomplete capture

Limits: ≤ 3 resubmits per session, 7-day TTL, one active resubmit request per session. See webhooks Manual Review Resubmit events.

KYB

All operations are mirrored under /tenant/v1/kyb/review-tasks with kyb.reviews:* and kyb.media:read. Interactive reference: KYB API reference and OpenAPI.

What is admin-only

Not exposed on the Tenant API (admin console / JWT only):

reassign / unassign to another human reviewer
delegate to the KnowaKYC manual-review team
cancel a resubmit request
list resubmittable steps helper endpoints used by the console UI

Webhooks — verification.needs_review, resubmit events, terminal outcomes
Authentication — HMAC and scopes
Admin → Review — operator UI workflow
OpenAPI — full machine-readable spec

Review tasks (manual review API)

Required scopesCopy Anchor Link

Typical flowCopy Anchor Link

List queueCopy Anchor Link

AuthorizationCopy Anchor Link

Query ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Status filter aliasesCopy Anchor Link

Priority valuesCopy Anchor Link

Stats and reject reasonsCopy Anchor Link

AuthorizationCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Task detail, comments, documentsCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Mutations: assign, priority, decideCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

ResubmitCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Request BodyCopy Anchor Link

Response BodyCopy Anchor Link

AuthorizationCopy Anchor Link

Path ParametersCopy Anchor Link

Header ParametersCopy Anchor Link

Response BodyCopy Anchor Link

KYBCopy Anchor Link

What is admin-onlyCopy Anchor Link

RelatedCopy Anchor Link

On this page

Required scopes

Typical flow

List queue

Authorization

Query Parameters

Header Parameters

Response Body

Status filter aliases

Priority values

Stats and reject reasons

Authorization

Header Parameters

Response Body

Authorization

Header Parameters

Response Body

Task detail, comments, documents

Authorization

Path Parameters

Header Parameters

Response Body

Authorization

Path Parameters

Header Parameters

Response Body

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

Authorization

Path Parameters

Header Parameters

Response Body

Mutations: assign, priority, decide

Authorization

Path Parameters

Header Parameters

Response Body

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

Resubmit

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

Authorization

Path Parameters

Header Parameters

Response Body

KYB

What is admin-only

Related