API Reference
KYC

Send a verification for review

POST
/v1/kyc/profiles/{id}/submit

Sends the details and documents for review by Sautikit. The owner gets an email saying we've received them, and another when the review is done. We aim to finish within one working day; the workspace keeps its current limits until then.

The request body is the evidence to send (the same shape as the draft's evidence). What's required:

  • Individual: id_number, birth_month, and an id_front upload.
  • Business: a CR12 upload, the KRA PIN or registration number, and the director's id_number, birth_month and director_on_cr12, with their id_front and id_back uploads.
  • Reseller: as a business, plus the reseller_agreement upload.

Authorization

personalKeyAuth
AuthorizationBearer <token>

Your personal API key, sent as Authorization: Bearer <key>. Generate it in the SautiKit console under Account > API key. It acts as you, not as a workspace, so it reaches what belongs to you as a person: your KYC verification. Workspace API keys don't work here.

In: header

Path Parameters

id*string

The KYC profile id.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

The details typed into a verification. For a business or reseller, full_name, id_type, id_number and birth_month are a director's, who must be named on the CR12. Only Kenya is supported for now.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/kyc/profiles/497f6eca-6276-4993-bfeb-53cbbbba6f08/submit" \  -H "Content-Type: application/json" \  -d '{}'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "kind": "individual",  "display_name": "string",  "level": "none",  "status": "draft",  "requested_level": "individual",  "phone_e164": "+254712345678",  "phone_verified_at": "2019-08-24T14:15:22Z",  "review_note": "string",  "daily_limit": 100,  "number_limit": 20,  "numbers_owned": 3,  "used_today": 4,  "workspace_count": 1,  "suspended_at": "2019-08-24T14:15:22Z",  "suspension_reason": "string",  "created_at": "2019-08-24T14:15:22Z"}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ],    "resolution": "string",    "reason": "invalid_characters",    "suggested_e164": "+254727524723"  }}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ],    "resolution": "string",    "reason": "invalid_characters",    "suggested_e164": "+254727524723"  }}

Download a document GET

Returns the uploaded file itself, for example the signed reseller agreement.

Exchange a connection code for a device credential POST

Unauthenticated by design: the connection code IS the credential, which is what lets the agent app have no sign-in screen at all. Returns a long-lived per-device secret, shown ONCE, which the device then presents to mint short-lived WebRTC tokens and to heartbeat presence. Every failure except a full line answers `devices.code_invalid` without saying why — distinguishing expired from unknown from already-used would turn this into an oracle for whether six digits ever existed.