Create Verification
Starts a hosted verification session for an account or user, or returns the active session when one already exists; any fields you send prefill it. To skip the hosted session, send documents to verify the person from files in this request, share_token to reuse a verification another Sumsub account completed, or verification_id to reuse one the signed-in user completed on Whop. For a business, documents and owners add company formation documents and owners to the verification, and once everything is in this call sends the business for review — call it again after Update Verification to send it. Until then it stays pending and the hosted session collects anything left out. Once the account has an approved verification, every mode except verification_id is rejected — unlink it first to start a new one.
Authorizations
An Account API key, an account access token, or a user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************. See Auth & API keys for how to get each one.
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-10-15"
Query Parameters
Business account whose identity you want to verify, prefixed biz_. Provide this or user_id.
The caller's own user ID, prefixed user_, for a personal verification. Provide this or account_id.
Body
- CreateIndividualVerification
- CreateBusinessVerification
Request body for an individual (KYC) verification. Omit kind or set it to individual. KYC is required to pay out funds and is a prerequisite for Whop Card access. Accepting payments does not require verification until a business reaches $5000 in payments.
Add business_name and business_structure if the individual operates under a business entity — this enables payouts to be received by a business bank account. country is always the individual's own country, and the supported business_structure values vary by it — see Business structures.
Every value accepts null, so a form seeded from a previous response can round-trip unset fields unchanged.
Legal business name for a sole proprietor or single-member LLC.
"Shine Time Auto Detailing LLC"
Entity type for sole proprietors, such as single_member_llc. Supported values vary by country of incorporation — see Business structures.
"private_corporation"
The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
"12-3456789"
Business website URL. Whop store pages are not accepted.
"https://shinetime.example"
Two-letter ISO 3166-1 country code, for example US, DE, or GB.
"US"
Formatted as YYYY-MM-DD.
"2026-01-01"
Identity document being sent, when verifying with documents. Decides exactly which file slots to send: id_card → id_card_front + id_card_back + selfie; drivers → drivers_front + drivers_back + selfie; residence_permit → residence_permit_front + residence_permit_back + selfie; passport → passport_front + selfie. See Identity documents.
id_card, drivers, residence_permit, passport "residence_permit"
Identity document files, each value the file's raw bytes base64-encoded (JPEG, PNG, or PDF, up to 5MB per file before encoding). Sending this object verifies the person from the files in this request instead of a hosted session — individual verifications only, and the request must also carry document_type, first_name, last_name, date_of_birth, country, phone, tax_identification_number, and an address with line1, city, state, and postal_code. Send every slot for your document_type — a missing or rejected file fails the whole request and nothing is submitted; review starts automatically once every document is accepted. See Identity documents for a full walkthrough.
"Marcus"
Verification type. Defaults to individual.
individual "individual"
"Webb"
"+xxxxxxxxxxx"
Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns approved when it satisfies them, or pending with a session_url covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with documents or document_type.
"_act-sbx-jwt-eyJhbGciOiJub25l"
The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.
"123456789"
ID of an approved verification to reuse on this account instead of verifying the person again, for example idpf_XXXXXXXX. The verification becomes this account's current one for its kind — replacing whichever verification of that kind the account already has, and carrying its payout account across — and the response is that same verification, unchanged. Only the signed-in Whop user who started the original verification can reuse it: API keys, OAuth tokens, and onboarding links are refused. kind is the only other field it accepts, and must match the reused verification. An account whose verification was denied or is still under review cannot reuse one.
"idpf_xxxxxxxxxxxxxx"
Response
OK
Owners of the business and the progress of each one's own verification. Empty for individual verifications.
Address on the verification profile. null when no address is set.
Legal business name.
"Shine Time Auto Detailing, LLC"
Legal entity structure of the business, such as private_corporation or sole_proprietorship. Supported values vary by country of incorporation — see Business structures.
"sole_proprietorship"
Two-letter ISO 3166-1 country code, for example US, DE, or GB.
"US"
When the verification profile was created, as an ISO 8601 timestamp.
"2026-06-01T12:00:00.000Z"
Formatted as YYYY-MM-DD.
"1990-01-01"
Email address on the verification profile.
"marcus@shinetime.example"
"Marcus"
Verification profile ID, prefixed idpf_.
"idpf_xxxxxxxxxxxx"
individual, business "individual"
"Webb"
Phone number on the verification profile.
"+15551234567"
Number the business was registered under in its place of incorporation, such as a state file number in the US or a Company Number in the UK. Business verifications only; null until the business verification is approved.
"7654321"
What Whop still needs before review can continue — one requirement per entry. Answer with Update Verification; nothing from the response is echoed back. Keys that don't apply are omitted.
Documents for a document-upload verification and their progress. Present only on individual verifications created by sending documents. pending_upload documents were not accepted yet — send the full set again with another Create Verification call.
Hosted verification session URL for the user to complete identity checks. Expires 7 days after creation.
"https://sumsub.com/session/abc"
Current verification state. not_started before any session exists; pending while a session needs the user's input; processing while the provider's automated checks run on a fresh submission; action_required when requested_information needs answers; manual_review while information already sent is under review — an audit answer, or a document the payout provider holds — nothing to submit, usually done within 3 business days; approved on success; rejected on failure. Call Create Verification again to start a new session.
not_started, pending, processing, manual_review, approved, rejected, action_required "action_required"
When the verification profile was last updated, as an ISO 8601 timestamp.
"2026-06-02T12:00:00.000Z"