Skip to main content
POST
JavaScript

Authorizations

​
Authorization
string
header
required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

​
Idempotency-Key
string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255
Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

​
Api-Version-Date
string

Pins the request to a dated API version.

Example:

"2026-08-13"

Query Parameters

​
account_id
string
required

Account or user ID whose identity you want to verify. Use a biz_ account ID for account verifications, or the caller's user_ ID for personal verification.

Body

application/json

Request body for an individual (KYC) verification. Omit kind or set it to individual. KYC is required to pay out funds and is a prerequisite for Whop Card access. Accepting payments does not require verification until a business reaches $5000 in payments.

Add business_name and business_structure if the individual operates under a business entity — this enables payouts to be received by a business bank account. country is always the individual's own country, and the supported business_structure values vary by it — see Business structures.

​
address
object

Every value accepts null, so a form seeded from a previous response can round-trip unset fields unchanged.

​
business_name
string

Legal business name for a sole proprietor or single-member LLC.

Example:

"Shine Time Auto Detailing LLC"

​
business_structure
string

Entity type for sole proprietors, such as single_member_llc. Supported values vary by country of incorporation — see Business structures.

Example:

"private_corporation"

​
business_tax_identification_number
string

The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.

Example:

"12-3456789"

​
business_website
string

Business website URL. Whop store pages are not accepted.

Example:

"https://shinetime.example"

​
country
string

Two-letter ISO 3166-1 country code, for example US, DE, or GB.

Example:

"US"

​
date_of_birth
string

Formatted as YYYY-MM-DD.

Example:

"2026-01-01"

​
document_type
enum<string>

Identity document being sent, when verifying with documents. Decides exactly which file slots to send: ID_CARD → id_card_front + id_card_back + selfie; DRIVERS → drivers_front + drivers_back + selfie; RESIDENCE_PERMIT → residence_permit_front + residence_permit_back + selfie; PASSPORT → passport_front + selfie. See Identity documents.

Available options:
ID_CARD,
DRIVERS,
RESIDENCE_PERMIT,
PASSPORT
Example:

"RESIDENCE_PERMIT"

​
documents
object

Identity document files, each value the file's raw bytes base64-encoded (JPEG, PNG, or PDF, up to 5MB per file before encoding). Sending this object verifies the person from the files in this request instead of a hosted session — individual verifications only, and the request must also carry document_type, first_name, last_name, date_of_birth, country, phone, tax_identification_number, and an address with line1, city, state, and postal_code. Send every slot for your document_type — a missing or rejected file fails the whole request and nothing is submitted; review starts automatically once every document is accepted. See Identity documents for a full walkthrough.

​
first_name
string
Example:

"Marcus"

​
kind
enum<string>

Verification type. Defaults to individual.

Available options:
individual
Example:

"individual"

​
last_name
string
Example:

"Webb"

​
phone
string
Example:

"+xxxxxxxxxxx"

​
share_token
string

Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns approved when it satisfies them, or pending with a session_url covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with documents or document_type.

Example:

"_act-sbx-jwt-eyJhbGciOiJub25l"

​
tax_identification_number
string

The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.

Example:

"123456789"

Response

OK

​
address
object | null

Address on the verification profile. null when no address is set.

​
business_name
string | null

Legal business name.

Example:

"Shine Time Auto Detailing, LLC"

​
business_structure
string | null

Legal entity structure of the business, such as private_corporation or sole_proprietorship. Supported values vary by country of incorporation — see Business structures.

Example:

"sole_proprietorship"

​
country
string | null

Two-letter ISO 3166-1 country code, for example US, DE, or GB.

Example:

"US"

​
created_at
string

When the verification profile was created, as an ISO 8601 timestamp.

Example:

"2026-06-01T12:00:00.000Z"

​
date_of_birth
string | null

Formatted as YYYY-MM-DD.

Example:

"1990-01-01"

​
email
string | null

Email address on the verification profile.

Example:

"marcus@shinetime.example"

​
first_name
string | null
Example:

"Marcus"

​
id
string

Verification profile ID, prefixed idpf_.

Example:

"idpf_xxxxxxxxxxxx"

​
kind
enum<string>
Available options:
individual,
business
Example:

"individual"

​
last_name
string | null
Example:

"Webb"

​
phone
string | null

Phone number on the verification profile.

Example:

"+15551234567"

​
requested_information
object[]

What Whop still needs before review can continue — one requirement per entry. Answer with Update Verification; nothing from the response is echoed back. Keys that don't apply are omitted.

​
required_documents
object[]

Documents for a document-upload verification and their progress. Present only on verifications created by sending documents. pending_upload documents were not accepted yet — send the full set again with another Create Verification call.

​
session_url
string | null

Hosted verification session URL for the user to complete identity checks. Expires 7 days after creation.

Example:

"https://sumsub.com/session/abc"

​
status
enum<string>

Current verification state. not_started before any session exists; pending while a session needs the user's input; processing while the provider's automated checks run on a fresh submission; action_required when requested_information needs answers; manual_review while information already sent is under review — an audit answer, or a document the payout provider holds — nothing to submit, usually done within 3 business days; approved on success; rejected on failure. Call Create Verification again to start a new session.

Available options:
not_started,
pending,
processing,
manual_review,
approved,
rejected,
action_required
Example:

"action_required"

​
updated_at
string

When the verification profile was last updated, as an ISO 8601 timestamp.

Example:

"2026-06-02T12:00:00.000Z"