> ## Documentation Index
> Fetch the complete documentation index at: https://laas.mippo.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit KYC data for compliance screening

> Send end-user KYC and PEP data to run AML screening and sanctions checks on a client before enabling Pix to stablecoin transactions.

Submits a client's identity data for sanctions screening (COAF, OFAC, UN), PEP checks, and wallet risk scoring via Sumsub. Returns a KYC token used in subsequent transaction calls.

## Request

<ParamField header="X-Mippo-API-Key" type="string" required>
  Your LaaS API key.
</ParamField>

<ParamField body="cpf" type="string" required>
  Brazilian CPF in any format: `123.456.789-09` or `12345678909`.
</ParamField>

<ParamField body="biometricHash" type="string" required>
  SHA-256 hash of the biometric data collected during your onboarding flow. Format: `sha256:<hex>`.
</ParamField>

<ParamField body="personType" type="string" default="PF">
  `"PF"` (individual) or `"PJ"` (legal entity / CNPJ holder).
</ParamField>

<ParamField body="partnerKycToken" type="string">
  Only for **Model 2** (client via partner). Pass your own KYC token; Mippo runs independent screening on top.
</ParamField>

```json Request theme={null}
{
  "cpf": "123.456.789-09",
  "biometricHash": "sha256:abc123def456",
  "personType": "PF",
  "partnerKycToken": "your_vendor_token"
}
```

## Response

<ResponseField name="success" type="boolean">
  Always `true` on 2xx.
</ResponseField>

<ResponseField name="data.token" type="string">
  KYC token. Pass this to `POST /v1/laas/transactions/initiate`. Valid for **24 hours**.
</ResponseField>

<ResponseField name="data.status" type="string">
  `APPROVED` | `PENDING` | `REJECTED`
</ResponseField>

<ResponseField name="data.riskTier" type="string">
  `STANDARD` | `HIGH` | `PEP` — determines which auth challenge is returned on transaction initiation.
</ResponseField>

<ResponseField name="data.expiresAt" type="string">
  ISO 8601 timestamp when the KYC token expires.
</ResponseField>

```json Response (200) theme={null}
{
  "success": true,
  "data": {
    "token": "kyc_1719000000_abc123",
    "status": "APPROVED",
    "riskTier": "STANDARD",
    "expiresAt": "2026-07-24T00:00:00.000Z"
  }
}
```

```json Response (422 — rejected) theme={null}
{
  "success": false,
  "error": {
    "code": "KYC_REJECTED",
    "message": "Client failed compliance screening.",
    "details": { "reason": "SANCTIONS_HIT" }
  }
}
```

<Note>
  Even in **Model 2**, Mippo runs its own independent sanctions screening. Passing a `partnerKycToken` does not bypass Mippo's checks.
</Note>