# Retrieve KYC requests

Retrieves a list of KYC requests.

Endpoint: GET /kyc-requests
Version: latest
Security: SecretApiKey, JWT

## Security:

  - `SecretApiKey` (unknown)
    apiKey in header REB-APIKEY

  - `JWT` (unknown)
    http bearer JWT

## Query parameters:

  - `limit` (integer)
    Limit the number of collection items to be returned.
Use `0` to return an empty collection and still receive the count of matching items in `Pagination-Total`.

  - `offset` (integer)
    Specifies the starting point within the collection of items to be returned.

  - `filter` (string)
    Criteria for filtering collection items.
This field requires a special format.
Use `,` to specify multiple allowed values.
Use `;` to specify multiple fields.

For more information, see [Search filters](https://www.rebilly.com/docs/dev-docs/search-filters).

  - `sort` (array)
    Sorts and orders the collection of items. To sort in descending
order, prefix with `-`. Multiple fields can be sorted by separating each with `,`.

  - `expand` (string)
    Expands a request to include embedded objects within the `_embedded`
property of the response. This field accepts a comma-separated list of objects.

For more information, see
[Embedded resources](https://www.rebilly.com/docs/dev-docs/expand-embedded-resources).

## Response 200:

  - `200` (unknown)
    List of KYC requests retrieved.

## Response 200 fields (application/json):

  - `id` (string)
    ID of the KYC request.
    Example: kyc_req_0YV7JMJ3DBCGRBR7K9D4HVGPP5

  - `customerId` (string, required)
    ID of the customer resource.
    Example: cus_0YV7DDSDD1C8DA64KHH2W33CPF

  - `documents` (array, required)
    Documents to request from the customer.

  - `documents.type` (string, required)
    Enum: "identity-proof", "address-proof", "funds-proof", "purchase-proof", "credit-file-proof"

  - `documents.subtypes` (array | null)
    Permitted document subtype.

  - `documents.maxAttempts` (integer)
    Total number of allowed document upload attempts.
Use `0` to allow unlimited upload attempts.

  - `documents.faceProofRequired` (boolean)
    Specifies if the customer must upload a photo of their face (selfie) that matches a provided KYC document.

  - `documents.faceLivenessRequired` (boolean)
    Specifies if the customer must use the face liveness feature when uploading a selfie.
For more information, see [Facial recognition and identity verification](https://www.rebilly.com/docs/kyc-and-aml/kyc#facial-recognition-identity-verification).

  - `status` (string)
    Status of the request.
    Enum: "gathering", "attempted", "partial", "pending-review", "fulfilled", "failed", "abandoned", "expired"

  - `redirectUrl` (string | null)
    URL where the customer is redirected when a KYC document upload is complete.
When the customer is redirected,
Rebilly appends an `info` query parameter that has one of the following values:
- `back`: Customer clicked the `back to website` link.
- `token_expired`: Customer's token expired.
- `success`: Customer uploaded KYC documents that have been analyzed.
- `manual`: Customer uploaded KYC documents that require a manual review.
This is because the analyzer rejected the documents or could not process them.
- `partial`: Some of the customer's KYC documents have been analyzed,
but other documents have not.
For example, this may occur when a proof of address document is analyzed but proof of ID is not.

Example: `https://example.com?info=success`.

  - `reason` (string | null)
    Reason for uploading.
    Example: spend limit

  - `matchLevel` (integer)
    Document verification level.
    Enum: 1, 2, 3

  - `revision` (integer)
    Number of times the KYC request data has been modified.

Use this value when analyzing webhook data to determine if a change must take precedence over the current representation.

  - `expirationTime` (string)
    Date and time when the request expires.
The default value is one hour in the future.

  - `createdTime` (string)
    Date and time when the resource is created.
This value is set automatically when the resource is created.

  - `updatedTime` (string)
    Date and time when the resource is updated.
This value is set automatically when the resource is updated.

  - `_links` (array)
    Related links.

  - `_links.href` (string)
    Link URL.

  - `_links.rel` (string)
    Type of link.
    Enum: "self", "documents", "gatherer"

  - `_embedded` (object)
    Embedded objects that are requested by the `expand` query parameter.

  - `_embedded.documents` (array)

## Response 200 headers (application/json):

  - `Pagination-Total` (integer)
    Total number of items that match the request.
The value is independent of `limit`, including when `limit` is `0`.
    Example: 332

  - `Pagination-Limit` (integer)
    Maximum number of items per page.
    Example: 100

  - `Pagination-Offset` (integer)
    Specifies the starting point within the
collection of resource results. For example, a request with
`limit=20` retrieves and displays the first 20 results on a page. A
following request with `limit=20` and `offset=20`, retrieves the next
page of 20 results.
    Example: 2

## Response 401:

  - `401` (unknown)
    Unauthorized access.
Invalid credentials used.

## Response 401 fields (application/json):

  - `status` (integer)
    HTTP status code.

  - `type` (string)
    Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference.
It should provide human-readable documentation for the problem type.
When this member is not present, its value is assumed to be "about:blank".

  - `title` (string)
    Short, human-readable summary of the problem type.
Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.

  - `detail` (string)
    Human-readable explanation that is specific to this occurrence of the problem.

  - `instance` (string)
    URI reference that identifies the specific occurrence of the problem.
It may or may not yield further information if dereferenced.

## Response 403:

  - `403` (unknown)
    Access forbidden.
If the organization requires multi-factor authentication (MFA) and the session has not passed MFA, `error` is `mfa_required`.

## Response 403 fields (application/json):

  - `status` (integer)
    HTTP status code.

  - `error` (string)
    Message that describes why the request is forbidden.
Most responses use a descriptive message, such as `Not allowed to change security settings`.
If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`.
If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`.

  - `type` (string)
    Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference.
It should provide human-readable documentation for the problem type.
When this member is not present, its value is assumed to be "about:blank".

  - `title` (string)
    Short, human-readable summary of the problem type.
Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.

  - `detail` (string)
    Human-readable explanation that is specific to this occurrence of the problem.

  - `instance` (string)
    URI reference that identifies the specific occurrence of the problem.
It may or may not yield further information if dereferenced.