KYC through the API

Users without KYC have limits on how much they can buy or sell. A user lifts them by verifying their identity. They can do it on RekberPay themselves, or you can submit it for them through the API. RekberPay's team reviews every submission either way.

You can submit KYC only for an account you created that the person has not claimed yet. A claimed or linked account belongs to the person (409 USER_MANAGED_BY_OWNER): they verify on RekberPay, and you still get the result by webhook. You need the kyc and write scopes.

1. Submit the KYC

Send multipart/form-data with the same fields the RekberPay form asks for, plus two photos: front (the ID card) and selfie (the person holding it).

curl -X POST "https://api.rekberpay.com/v1/enterprise/platform/users/seller-2001/kyc" \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY" \
  -H "Idempotency-Key: $(uuidgen | tr 'A-Z' 'a-z')" \
  -F "kyc_id_type=ktp" \
  -F "kyc_full_name_ktp=Budi Santoso" \
  -F "kyc_nik=3171014501900000" \
  -F "kyc_whatsapp=081234567890" \
  -F "kyc_province=DKI Jakarta" \
  -F "kyc_city=Jakarta Selatan" \
  -F "kyc_district=Kebayoran Baru" \
  -F "kyc_subdistrict=Senayan" \
  -F "kyc_street_address=Jl. Asia Afrika No. 8" \
  -F "kyc_bank_name=bca" \
  -F "kyc_account_number=1234567890" \
  -F "[email protected]" \
  -F "[email protected]"

202 Accepted

{ "success": true, "data": { "partner_user_ref": "seller-2001", "kyc_status": "pending" } }

Field	Rule
kyc_id_type	ktp, sim or passport
kyc_full_name_ktp	The name on the ID, up to 120 characters
kyc_nik	The 16 digit NIK. RekberPay checks its region and birth date parts
kyc_entity_name	Optional, a foundation or company name, up to 180 characters
kyc_whatsapp	08... or +62..., 8 to 20 characters
kyc_province	One of the 38 province names, for example DKI Jakarta or Jawa Barat
kyc_city, kyc_district, kyc_subdistrict	Up to 120 characters each
kyc_street_address	Up to 500 characters
kyc_bank_name	A bank or e-wallet code: bca, mandiri, bni, bri, btn, cimb_niaga, permata, danamon, maybank, panin, ocbc_nisp, mega, bsi, jago, blu, seabank, allo_bank, gopay, ovo, dana, shopeepay or linkaja
kyc_account_number	4 to 40 digits
front, selfie	JPG, PNG or WebP, up to 10 MB each

Good to know:

• A KYC that is pending or verified cannot be sent again (409 KYC_LOCKED). A rejected one can.
• One NIK verifies one RekberPay account (409 NIK_IN_USE). Submissions are rationed per person and per partner (429 KYC_SUBMIT_LIMITED).
• If the user's name is locked (a partner balance or a paid order with any partner, or a bank account with you), kyc_full_name_ktp must match it (422 NAME_MISMATCH). See the name lock.
• The photos are stored in the person's private KYC folder, re-encoded and readable only by them and RekberPay staff. RekberPay never logs the NIK or the photos, and you cannot read them back.
• Use a new Idempotency-Key for every submission. The key is bound to the person, not to the form, so a reused key replays the first answer and the new form is not processed.

2. Read the result

curl "https://api.rekberpay.com/v1/enterprise/platform/users/seller-2001/kyc" \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY"

{
    "success": true,
    "data": {
        "kyc_status": "rejected",
        "submitted_at": "2026-10-21T08:00:00.000Z",
        "reviewed_at": "2026-10-21T10:15:00.000Z",
        "rejection_reason": "The selfie is blurred."
    }
}

kyc_status is none, pending, verified or rejected. rejection_reason is shown only for an account you manage. The answer never carries the NIK, the name, the address or the photos.

Every change also comes as platform.user.kyc_updated, to every partner the person is linked to.

What approval changes

• The non-KYC limits no longer apply (limits.capped is false on GET /v1/enterprise/platform/users/:ref).
• The KTP name becomes the payout name every bank account is checked against, and you can no longer rename the user.

In the sandbox

The sandbox takes test data only:

• kyc_nik must be a test NIK that ends in 0000, for example 3171014501900000 (422 SANDBOX_TEST_NIK_REQUIRED). Never send a real KTP photo; any small test image works.
• No RekberPay staff review a sandbox KYC and no email is sent. Settle it yourself:

curl -X POST "https://api.rekberpay.com/v1/enterprise/platform/users/seller-2001/kyc/simulate" \
  -H "Authorization: Bearer $REKBERPAY_WORKSPACE_KEY" \
  -H "Idempotency-Key: $(uuidgen | tr 'A-Z' 'a-z')" \
  -H "Content-Type: application/json" \
  -d '{ "result": "approved" }'

result is approved or rejected, with an optional reason (3 to 500 characters) for a rejection. Only a pending KYC can be settled (409 KYC_NOT_PENDING). The call answers 404 in live mode.

A sandbox KYC is a simulation of your test user and nothing more. The photos are checked but never stored, and the result is kept apart from the RekberPay account: GET /users/:ref/kyc, kyc_status and limits on the user, and platform.user.kyc_updated all follow the simulation, but the account itself never becomes KYC verified on RekberPay and an approval never renames it. A sandbox test account can never sign in to RekberPay either, so nothing you do in the sandbox can create a usable, verified account.

Checklist

• Submit KYC for active sellers early. Unverified sellers hit their limits.
• Ask the seller for their exact KTP name before their first sale.
• Use test data, and only test data, in the sandbox.

Next steps

• Balances and withdrawals
• KYC reference