API 參考

請求主體

回應

Advisory only. Nothing is reserved: the chain is the authority and /v1/accounts/free re-checks, so a name can still be lost between this call and create.

參數

回應

回應

參數

回應

Person-first by default: omit `accountDid` to create a Person before any chain account (required when the organization gates free-create on KYC). Identity checks are document + face via Shufti Pro — BoundIdentity does not enable Shufti phone OTP for KYC. On sandbox, complete `verificationUrl` with a Shufti test ID (free on the test account).

請求主體

回應

參數

回應

回應

回應

回應

回應

回應

回應

回應

參數

回應

回應

回應

回應

回應

回應

回應

回應

回應

The membership roster decides who may sign in to the admin console and what they may do there. Roles, weakest first: `viewer`, `operator`, `compliance_officer`, `admin`, `owner`. Re-adding an existing address updates its role and reactivates it, so a returning colleague does not collide with their old row. While an organization has no members at all, the console accepts any address with the correct password and treats it as an `owner` — adding the first member closes that path.

請求主體

回應

參數

請求主體

回應

Deactivates rather than deletes. The address remains the recorded actor on every audit entry the member produced, and removing the row that explains who they were would leave those entries unresolvable.

參數

回應

回應

回應

回應

回應

請求主體

回應

參數

回應

回應

回應

回應

回應

回應

回應

參數

回應

Diagnostics for a receiver that is rejecting events: status, attempt count, and the last error per delivery. Scoped to your own webhooks.

參數

回應

Re-queues a `failed` or `dead` delivery and resets its attempt counter, for use once the receiving system has been repaired. The signed body is stored with the delivery, so the replay carries the original payload and signature inputs rather than a regenerated approximation. Deliveries that already succeeded are refused — deduplicate on `X-BI-Delivery-Id` if you need to reprocess one.

參數

回應

回應

Enforced when binding a person to an account: a country on `blockedCountries`, or absent from a non-empty `allowedCountries`, is refused. The blocklist takes precedence. When either list is non-empty a subject whose country is unknown is also refused, so the control cannot be bypassed by an unresolvable jurisdiction. Empty lists mean no restriction. Omit a field to leave it unchanged.

請求主體

回應

請求主體

回應

Compliance-officer action. Requires `compliance_export`. By default this resets `pepFlag`, `sanctionsFlag`, and `riskScore` immediately, closes any open AML case for the subject as `cleared`, and writes an `aml.cleared` audit entry with the reason. When the organization's policy sets `requireSecondApprovalToClearAml` (four eyes), this call only *proposes* the clear: the case moves to `pending_approval`, the flags stay up, and the response carries `pendingApproval: true` with the `caseId`. A different person then calls `/v1/aml/cases/{caseId}/approve-clear`, which is what lifts the flags. If the subject has no open case, one is opened by hand so the proposal has somewhere to live.

請求主體

回應

Cases with status `open` or `pending_approval`, ordered by priority (set from match severity) then age. Requires `compliance_export`.

回應

The second pair of eyes. Lifts the subject's flags and closes the case as `cleared`, in one transaction. Refused when the approver is the identity that proposed it: a tenant-minted API key counts as one person, and the console derives the operator from the signed session. Requires `compliance_export`.

參數

請求主體

回應

One person may always make things stricter. Closes the case as `confirmed`; the flags stay up. Requires `compliance_export`.

參數

請求主體

回應

Verifies a transfer to the treasury carrying this checkout's memo, then provisions the organization. A transaction id can only ever pay for one checkout. Returns 425 while the transfer is still reversible — retry shortly rather than treating it as a rejection.

請求主體

回應

參數

回應

Rate limited per phone and per client IP. Requires `accounts_write`. On hosted sandbox and production the code is delivered by SMS only — it is never returned in the response body.

請求主體

回應

Capped at 5 attempts per challenge. The returned `phoneProofToken` is accepted by `POST /v1/accounts/free` for 4 hours.

請求主體

回應

Confirming an email never creates or promotes a Person. Email is a contact channel; KYC remains the only identity authority.

請求主體

回應

請求主體

回應

參數

回應

Contact changes are authorized by the account key, not by the session — whoever can change the address controls where account notices go. The nonce is single-use and consumed by the matching start call.

請求主體

回應

Nothing is unbound until the code is confirmed.

請求主體

回應

Detach and attach run in one transaction, so the account is never left without a verified email. The previous address is notified.

請求主體

回應

請求主體

回應

請求主體

回應

Publishes the Ed25519 `assertionMethod` key used to sign issued credentials. A relying party needs only this document to verify a credential offline.

回應

參數

回應

參數

回應

回應

Returns the address tenant IP allowlists are compared against. Call it from the server that will hold your API key before configuring an allowlist: NAT and egress gateways mean the address we see is often not the one you expect, and an allowlist that does not match fails closed — every request returns 403. Unauthenticated, and returns nothing beyond your own address.

回應

回應

Requires `read` scope.

回應

回應

回應

Required before POST /v1/billing/checkout. Proves control of the mailbox that will own the organization. Unauthenticated. Rate-limited per IP and per address. In non-production mock mode the response may include `devCode`; production never echoes the code.

回應

Spend the emailed code. The returned `emailProofToken` is accepted once by POST /v1/billing/checkout for the same address.

回應

Requires `emailProofToken` from POST /v1/billing/email/otp/confirm. Builder mints a full-access API key only after that proof is spent.

回應

回應

回應

回應

回應

回應

回應