# Resolve document subtype restrictions

Resolves document subtype restrictions for a website.
When `documents` are provided, the response contains restrictions that match the document types, subtypes, and face proof requirements.

Endpoint: POST /kyc-settings/resolve-scoped-settings
Version: latest
Security: SecretApiKey, JWT

## Request fields

- `websiteId` (string, required)
  ID of the website. A website is where an organization obtains a customer. For more information, see [Obtain an organization ID and website ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
  Example: web_0YV7DE4Z26DQSA1AC92FBJ7SEG
- `documents` (array)
  KYC document settings to evaluate for subtype restrictions. If omitted or empty, the response contains only unconditional restrictions for all configured document types.
- `documents.type` (string, required)
  Enum: "identity-proof", "address-proof", "funds-proof", "purchase-proof", "credit-file-proof"
- `documents.subtypes` (array)
  Document subtypes to evaluate for restrictions. If omitted, all configured restrictions for the document type are evaluated.
- `documents.faceProofRequired` (boolean)
  Specifies if the customer must provide proof of their face with the KYC document.

## Response 200 fields

- `subtypeRestrictions` (object, required)
  Document subtypes that are prohibited for `identityProof`, `addressProof`, `fundsProof`, and `purchaseProof`. This object does not include `credit-file-proof` because it has no subtypes.
  Example: {"identityProof":["driver-license","public-health-card"]}
- `subtypeRestrictions.identityProof` (array)
  Prohibited subtypes of proof of identity.
- `subtypeRestrictions.addressProof` (array)
  Prohibited subtypes of proof of address.
- `subtypeRestrictions.fundsProof` (array)
  Prohibited subtypes of proof of funds.
- `subtypeRestrictions.purchaseProof` (array)
  Prohibited subtypes of proof of purchase.

## Response 401 fields

- `status` (integer)
  HTTP status code.
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

## Response 403 fields

- `status` (integer)
  HTTP status code.
- `error` (string)
  Message that describes why the request is forbidden. Most responses use a descriptive message, such as `Not allowed to change security settings`. If the organization requires multi-factor authentication (MFA) and MFA verification has not been completed for the session, this value is `mfa_required`. If the request sets `requireMfa` to `true` and MFA verification has not been completed for the session, this value is `mfa_required_for_caller`. If the organization restricts access to a list of IP addresses and the request comes from an IP address that is not in the list, this value is `ip_not_allowed`.
- `organizationId` (string)
  Unique organization identifier. An organization is an entity that represents a company. For more information, see [Obtain an organization ID](https://www.rebilly.com/docs/settings/organizations-and-websites/#obtain-your-organization-id-and-website-id).
  Example: org_0YVDM8RC7GDADADSBSMW124JA8
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

## Response 404 fields

- `status` (integer)
  HTTP status code.
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

## Response 422 fields

- `status` (integer)
  HTTP status code.
- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.
- `invalidFields` (array)
  Invalid field details.
  Example: [{"field":"field1","message":"field1 is invalid"},{"field":"subObject.field2","message":"field2 is invalid"},{"field":"subObject.field2","message":"another error in the field2"}]
- `invalidFields.field` (string)
  Name of the field. Dot notation is used for nested object field names.
- `invalidFields.message` (string)
  Message field.

## Response 429 fields

- `type` (string)
  Problem type in the form of a [URI](https://tools.ietf.org/html/rfc3986) reference. It should provide human-readable documentation for the problem type. When this member is not present, its value is assumed to be "about:blank".
  Example: about:blank
- `title` (string)
  Short, human-readable summary of the problem type. Other than for the purposes of localization, this should not change from occurrence to occurrence of the problem.
  Example: Rate Limit Exceeded
- `status` (integer)
  HTTP status code.
- `detail` (string)
  Human-readable explanation that is specific to this occurrence of the problem.
  Example: A request cannot be executed because the user has sent too many requests within a certain period of time
- `instance` (string)
  URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.