API 参考

请求体

响应

Advisory only. Nothing is reserved: the chain is the authority and /v1/accounts/free re-checks, so a name can still be lost between this call and create.

参数

响应

响应

参数

响应

Person-first by default: omit `accountDid` to create a Person before any chain account (required when the organization gates free-create on KYC). Identity checks are document + face via Shufti Pro — BoundIdentity does not enable Shufti phone OTP for KYC. On sandbox, complete `verificationUrl` with a Shufti test ID (free on the test account).

请求体

响应

参数

响应

响应

响应

响应

响应

响应

响应

响应

参数

响应

响应

响应

响应

响应

响应

响应

响应

响应

The membership roster decides who may sign in to the admin console and what they may do there. Roles, weakest first: `viewer`, `operator`, `compliance_officer`, `admin`, `owner`. Re-adding an existing address updates its role and reactivates it, so a returning colleague does not collide with their old row. While an organization has no members at all, the console accepts any address with the correct password and treats it as an `owner` — adding the first member closes that path.

请求体

响应

参数

请求体

响应

Deactivates rather than deletes. The address remains the recorded actor on every audit entry the member produced, and removing the row that explains who they were would leave those entries unresolvable.

参数

响应

响应

响应

响应

响应

请求体

响应

参数

响应

响应

响应

响应

响应

响应

响应

参数

响应

Diagnostics for a receiver that is rejecting events: status, attempt count, and the last error per delivery. Scoped to your own webhooks.

参数

响应

Re-queues a `failed` or `dead` delivery and resets its attempt counter, for use once the receiving system has been repaired. The signed body is stored with the delivery, so the replay carries the original payload and signature inputs rather than a regenerated approximation. Deliveries that already succeeded are refused — deduplicate on `X-BI-Delivery-Id` if you need to reprocess one.

参数

响应

响应

Enforced when binding a person to an account: a country on `blockedCountries`, or absent from a non-empty `allowedCountries`, is refused. The blocklist takes precedence. When either list is non-empty a subject whose country is unknown is also refused, so the control cannot be bypassed by an unresolvable jurisdiction. Empty lists mean no restriction. Omit a field to leave it unchanged.

请求体

响应

请求体

响应

Compliance-officer action. Requires `compliance_export`. By default this resets `pepFlag`, `sanctionsFlag`, and `riskScore` immediately, closes any open AML case for the subject as `cleared`, and writes an `aml.cleared` audit entry with the reason. When the organization's policy sets `requireSecondApprovalToClearAml` (four eyes), this call only *proposes* the clear: the case moves to `pending_approval`, the flags stay up, and the response carries `pendingApproval: true` with the `caseId`. A different person then calls `/v1/aml/cases/{caseId}/approve-clear`, which is what lifts the flags. If the subject has no open case, one is opened by hand so the proposal has somewhere to live.

请求体

响应

Cases with status `open` or `pending_approval`, ordered by priority (set from match severity) then age. Requires `compliance_export`.

响应

The second pair of eyes. Lifts the subject's flags and closes the case as `cleared`, in one transaction. Refused when the approver is the identity that proposed it: a tenant-minted API key counts as one person, and the console derives the operator from the signed session. Requires `compliance_export`.

参数

请求体

响应

One person may always make things stricter. Closes the case as `confirmed`; the flags stay up. Requires `compliance_export`.

参数

请求体

响应

Verifies a transfer to the treasury carrying this checkout's memo, then provisions the organization. A transaction id can only ever pay for one checkout. Returns 425 while the transfer is still reversible — retry shortly rather than treating it as a rejection.

请求体

响应

参数

响应

Rate limited per phone and per client IP. Requires `accounts_write`. On hosted sandbox and production the code is delivered by SMS only — it is never returned in the response body.

请求体

响应

Capped at 5 attempts per challenge. The returned `phoneProofToken` is accepted by `POST /v1/accounts/free` for 4 hours.

请求体

响应

Confirming an email never creates or promotes a Person. Email is a contact channel; KYC remains the only identity authority.

请求体

响应

请求体

响应

参数

响应

Contact changes are authorized by the account key, not by the session — whoever can change the address controls where account notices go. The nonce is single-use and consumed by the matching start call.

请求体

响应

Nothing is unbound until the code is confirmed.

请求体

响应

Detach and attach run in one transaction, so the account is never left without a verified email. The previous address is notified.

请求体

响应

请求体

响应

请求体

响应

Publishes the Ed25519 `assertionMethod` key used to sign issued credentials. A relying party needs only this document to verify a credential offline.

响应

参数

响应

参数

响应

响应

Returns the address tenant IP allowlists are compared against. Call it from the server that will hold your API key before configuring an allowlist: NAT and egress gateways mean the address we see is often not the one you expect, and an allowlist that does not match fails closed — every request returns 403. Unauthenticated, and returns nothing beyond your own address.

响应

响应

Requires `read` scope.

响应

响应

响应

Required before POST /v1/billing/checkout. Proves control of the mailbox that will own the organization. Unauthenticated. Rate-limited per IP and per address. In non-production mock mode the response may include `devCode`; production never echoes the code.

响应

Spend the emailed code. The returned `emailProofToken` is accepted once by POST /v1/billing/checkout for the same address.

响应

Requires `emailProofToken` from POST /v1/billing/email/otp/confirm. Builder mints a full-access API key only after that proof is spent.

响应

响应

响应

响应

响应

响应

响应