POST/simulate/kyc-status

Simulate KYC Status

Simulates a KYC status change for an individual and fires the corresponding webhook (kyc.missing, kyc.approved, or kyc.rejected).

Identified by IndividualId — the individual/UBO ID, not the Ondato verification ID. The simulator resolves the individual's latest KYC verification, sets its status, and fires the event.

Copy IndividualId from the Kyc[] action items returned by GET /application/detail/{id}.

Important. The applicant must complete the KYC process first (dummy / test values are fine). The system must conclude with an approved or rejected status. Only after that can you simulate KYC status with this endpoint, and only in the sandbox.

Blocked in production. Returns 400 when simulation is disabled.

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Request body

Field	Type	Required	Possible values	Description
`IndividualId`	string	Required	—	Individual/UBO ID. Copy from `Kyc[].IndividualId` in the application detail response.
`Status`	integer	Required	2 (missing) \| 3 (approved) \| 4 (rejected)	Target KYC status.
`Remark`	string	Optional	—	Optional remark. Shown on the action item from `GET /application/detail/{id}` when status is missing. Not included on the webhook body.

Example request

{
  "IndividualId": "6a47d37c7267551942868532",
  "Status": 3,
  "Remark": "Identity verified."
}

{
  "IndividualId": "6a47d37c7267551942868532",
  "Status": 3,
  "Remark": "Identity verified."
}

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	`KycId` — the KYC record updated. `Status` — the new status code.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "KycId": "6a47d37c7267551942868532",
    "Status": 3
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "KycId": "6a47d37c7267551942868532",
    "Status": 3
  }
}

A 400 with `record_not_found` is returned if the `IndividualId` does not exist or has no associated KYC verification.

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.