POST
/
onboardings
curl --request POST \
  --url https://sandbox.api.openfx.com/v1/onboardings \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "entityType": "individual",
  "fullName": "Jane Doe",
  "dateOfBirth": "1985-03-15",
  "nationality": "US",
  "email": "jane@example.com",
  "address": {
    "line1": "123 Main St",
    "city": "San Francisco",
    "state": "CA",
    "postalCode": "94105",
    "country": "US"
  },
  "autoSubmit": true
}
'
{
  "id": "onb_01953e1a5f4b7800",
  "status": "completed",
  "entityId": "ent_01953e1a5f4b7100",
  "customerId": "cus_01953e1a5f4b7000",
  "relationshipIds": [
    "erel_01953e1a5f4b7101"
  ],
  "kybStatus": "approved",
  "createdAt": "2026-02-23T12:00:00Z",
  "updatedAt": "2026-02-23T13:00:00Z"
}

Authorizations

Authorization
string
header
required

API key issued at onboarding. Passed as a Bearer token in the Authorization header: Authorization: Bearer <api-key>. Identifies the caller and determines organization scope. Invalid or revoked keys return 401 with error type authentication_error.

X-Signature
string
header
required

Ed25519 or RSA-SHA256 asymmetric signature over the request payload (ADR-0015). Provides request integrity and non-repudiation. The signature covers the HTTP method, path, query string, request body, and timestamp. Invalid signatures return 401 with error type authentication_error.

X-Timestamp
string
header
required

Unix timestamp (seconds) of when the request was signed. Server rejects requests where the timestamp drifts beyond +/-60 seconds from server time to prevent replay attacks. Must match the timestamp used in the signature computation.

Headers

Idempotency-Key
string
required

Idempotency key for this request. UUID v4 recommended. Max 128 characters. 24-hour retention. Same key + same body replays original response with Idempotency-Replayed: true. Same key + different body returns 409 (code: duplicate_idempotency_key). Same key while the original request is still processing returns 409 with a Retry-After header (code: idempotency_key_in_flight).

Maximum string length: 128
Example:

"550e8400-e29b-41d4-a716-446655440000"

Body

application/json

Orchestrated onboarding request. Combines entity creation, document attachment, relationship linking, and customer enrollment into a single call. Provide individual-specific or business-specific fields based on entityType.

entityType
enum<string>
required

The type of legal entity.

Available options:
individual,
business
fullName
string

Full legal name (required when entityType is individual).

dateOfBirth
string<date>

Date of birth (required when entityType is individual).

Pattern: ^[0-9]{4}-[0-9]{2}-[0-9]{2}$
Example:

"1985-03-15"

nationality
string

Nationality (required when entityType is individual).

Pattern: ^[A-Z]{2}$
Example:

"US"

governmentId
object

Government-issued ID (when entityType is individual).

Legal business name (required when entityType is business).

tradingName
string

Trading or DBA name (when entityType is business).

registrationNumber
string

Business registration number (when entityType is business).

jurisdiction
string

Country of incorporation (when entityType is business).

Pattern: ^[A-Z]{2}$
Example:

"US"

incorporationDate
string<date>

Date of incorporation (when entityType is business).

Pattern: ^[0-9]{4}-[0-9]{2}-[0-9]{2}$
Example:

"1985-03-15"

businessStructure
enum<string>

Legal structure (when entityType is business).

Available options:
corporation,
llc,
llp,
partnership,
sole_proprietorship,
trust,
non_profit,
government_entity
industryCode
enum<string>

Industry classification (when entityType is business).

Available options:
money_services,
banking,
fintech,
crypto_exchange,
payments,
remittance,
insurance,
lending,
real_estate,
import_export,
professional_services,
technology,
gambling,
precious_metals,
consulting,
legal_services,
ecommerce,
manufacturing,
other
email
string<email>

Email address per RFC 5322.

Example:

"user@example.com"

phone
string

Phone number in E.164 format.

Pattern: ^\+[1-9]\d{1,14}$
Example:

"+14155551234"

address
object

Physical or mailing address. Used on Entity and Counterparty.

relationships
object[]

Entity relationships to create (beneficial owners, directors, etc.). Each references an existing individual entity.

documentIds
string[]

Pre-uploaded document IDs to attach to the entity.

Document resource identifier.

Pattern: ^doc_[A-Za-z0-9]+$
autoSubmit
boolean
default:false

If true, automatically submits the customer for KYB review after creation.

metadata
object

Consumer-defined key-value store. Available on all primary resources. Max 50 keys. Keys must match ^[a-zA-Z0-9_]{1,40}$. Values are strings (max 500 chars) or null.

Response

Onboarding created.

Orchestrated onboarding result. Wraps the entity, customer, and relationship creation into a single trackable resource. The onboarding progresses through pendingprocessingcompleted (or failed).

id
string
required

Onboarding resource identifier.

Pattern: ^onb_[A-Za-z0-9]+$
Example:

"onb_01953e1a5f4b7800"

status
enum<string>
required

Status of an orchestrated onboarding request.

Available options:
pending,
processing,
completed,
failed
entityId
string
required

Entity resource identifier.

Pattern: ^ent_[A-Za-z0-9]+$
Example:

"ent_01953e1a5f4b7100"

customerId
string
required

Customer resource identifier.

Pattern: ^cus_[A-Za-z0-9]+$
Example:

"cus_01953e1a5f4b7000"

createdAt
string<date-time>
required

UTC timestamp in RFC 3339 / ISO 8601 format.

Example:

"2026-02-23T12:00:00Z"

relationshipIds
string[]

IDs of entity relationships created during onboarding (beneficial owners, directors, etc.).

Entity relationship resource identifier.

Pattern: ^erel_[A-Za-z0-9]+$
kybStatus
enum<string>

Know Your Business verification status.

Available options:
not_started,
pending,
approved,
rejected,
requires_info
updatedAt
string<date-time>

UTC timestamp in RFC 3339 / ISO 8601 format.

Example:

"2026-02-23T12:00:00Z"