Create Verification
Starts a hosted verification session for an account or user, or returns the active session when one already exists. Any fields you include in the request body are used to prefill the session. Send documents (with document_type) to instead verify the person from identity documents included in this request — no hosted session involved. Send share_token to reuse a verification another Sumsub account has already completed for this person, instead of verifying them again. Send verification_id to reuse a verification the signed-in user already completed on Whop. Every mode except verification_id is rejected once the account has an approved verification — unlink it first to start a new one — while verification_id replaces whichever verification of that kind the account currently has.
Authorizations
An Account API key, an account access token, or a user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************. See Auth & API keys for how to get each one.
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-09-25"
Query Parameters
Business account whose identity you want to verify, prefixed biz_. Provide this or user_id.
The caller's own user ID, prefixed user_, for a personal verification. Provide this or account_id.
Body
- CreateIndividualVerification
- CreateBusinessVerification
Request body for an individual (KYC) verification. Omit kind or set it to individual. KYC is required to pay out funds and is a prerequisite for Whop Card access. Accepting payments does not require verification until a business reaches $5000 in payments.
Add business_name and business_structure if the individual operates under a business entity — this enables payouts to be received by a business bank account. country is always the individual's own country, and the supported business_structure values vary by it — see Business structures.
Every value accepts null, so a form seeded from a previous response can round-trip unset fields unchanged.
Legal business name for a sole proprietor or single-member LLC.
"Shine Time Auto Detailing LLC"
Entity type for sole proprietors, such as single_member_llc. Supported values vary by country of incorporation — see Business structures.
"private_corporation"
The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
"12-3456789"
Business website URL. Whop store pages are not accepted.
"https://shinetime.example"
Two-letter ISO 3166-1 country code, for example US, DE, or GB.
"US"
Formatted as YYYY-MM-DD.
"2026-01-01"
Identity document being sent, when verifying with documents. Decides exactly which file slots to send: ID_CARD → id_card_front + id_card_back + selfie; DRIVERS → drivers_front + drivers_back + selfie; RESIDENCE_PERMIT → residence_permit_front + residence_permit_back + selfie; PASSPORT → passport_front + selfie. See Identity documents.
ID_CARD, DRIVERS, RESIDENCE_PERMIT, PASSPORT "RESIDENCE_PERMIT"
Identity document files, each value the file's raw bytes base64-encoded (JPEG, PNG, or PDF, up to 5MB per file before encoding). Sending this object verifies the person from the files in this request instead of a hosted session — individual verifications only, and the request must also carry document_type, first_name, last_name, date_of_birth, country, phone, tax_identification_number, and an address with line1, city, state, and postal_code. Send every slot for your document_type — a missing or rejected file fails the whole request and nothing is submitted; review starts automatically once every document is accepted. See Identity documents for a full walkthrough.
"Marcus"
Verification type. Defaults to individual.
individual "individual"
"Webb"
"+xxxxxxxxxxx"
Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns approved when it satisfies them, or pending with a session_url covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with documents or document_type.
"_act-sbx-jwt-eyJhbGciOiJub25l"
The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.
"123456789"
ID of an approved verification to reuse on this account instead of verifying the person again, for example idpf_XXXXXXXX. The verification becomes this account's current one for its kind — replacing whichever verification of that kind the account already has, and carrying its payout account across — and the response is that same verification, unchanged. Only the signed-in Whop user who started the original verification can reuse it: API keys, OAuth tokens, and onboarding links are refused. kind is the only other field it accepts, and must match the reused verification. An account whose verification was denied or is still under review cannot reuse one.
"idpf_xxxxxxxxxxxxxx"
Response
OK
Address on the verification profile. null when no address is set.
Legal business name.
"Shine Time Auto Detailing, LLC"
Legal entity structure of the business, such as private_corporation or sole_proprietorship. Supported values vary by country of incorporation — see Business structures.
"sole_proprietorship"
Two-letter ISO 3166-1 country code, for example US, DE, or GB.
"US"
When the verification profile was created, as an ISO 8601 timestamp.
"2026-06-01T12:00:00.000Z"
Formatted as YYYY-MM-DD.
"1990-01-01"
Email address on the verification profile.
"marcus@shinetime.example"
"Marcus"
Verification profile ID, prefixed idpf_.
"idpf_xxxxxxxxxxxx"
individual, business "individual"
"Webb"
Phone number on the verification profile.
"+15551234567"
What Whop still needs before review can continue — one requirement per entry. Answer with Update Verification; nothing from the response is echoed back. Keys that don't apply are omitted.
Documents for a document-upload verification and their progress. Present only on verifications created by sending documents. pending_upload documents were not accepted yet — send the full set again with another Create Verification call.
Hosted verification session URL for the user to complete identity checks. Expires 7 days after creation.
"https://sumsub.com/session/abc"
Current verification state. not_started before any session exists; pending while a session needs the user's input; processing while the provider's automated checks run on a fresh submission; action_required when requested_information needs answers; manual_review while information already sent is under review — an audit answer, or a document the payout provider holds — nothing to submit, usually done within 3 business days; approved on success; rejected on failure. Call Create Verification again to start a new session.
not_started, pending, processing, manual_review, approved, rejected, action_required "action_required"
When the verification profile was last updated, as an ISO 8601 timestamp.
"2026-06-02T12:00:00.000Z"