Submit KYC data for compliance screening

Submits a client’s identity data for sanctions screening (COAF, OFAC, UN), PEP checks, and wallet risk scoring via Sumsub. Returns a KYC token used in subsequent transaction calls.

Request

string

required

Your LaaS API key.

string

required

Brazilian CPF in any format: 123.456.789-09 or 12345678909.

string

required

SHA-256 hash of the biometric data collected during your onboarding flow. Format: sha256:<hex>.

string

default:"PF"

"PF" (individual) or "PJ" (legal entity / CNPJ holder).

string

Only for Model 2 (client via partner). Pass your own KYC token; Mippo runs independent screening on top.

Request

{
  "cpf": "123.456.789-09",
  "biometricHash": "sha256:abc123def456",
  "personType": "PF",
  "partnerKycToken": "your_vendor_token"
}

Response

boolean

Always true on 2xx.

string

KYC token. Pass this to POST /v1/laas/transactions/initiate. Valid for 24 hours.

string

APPROVED | PENDING | REJECTED

string

STANDARD | HIGH | PEP — determines which auth challenge is returned on transaction initiation.

string

ISO 8601 timestamp when the KYC token expires.

Response (200)

{
  "success": true,
  "data": {
    "token": "kyc_1719000000_abc123",
    "status": "APPROVED",
    "riskTier": "STANDARD",
    "expiresAt": "2026-07-24T00:00:00.000Z"
  }
}

Response (422 — rejected)

{
  "success": false,
  "error": {
    "code": "KYC_REJECTED",
    "message": "Client failed compliance screening.",
    "details": { "reason": "SANCTIONS_HIT" }
  }
}

Even in Model 2, Mippo runs its own independent sanctions screening. Passing a partnerKycToken does not bypass Mippo’s checks.

Overview

KYC

Transactions

Partner

Submit KYC data for compliance screening

Request

Response

​Request

​Response

Request

Response