Submit a customer onboarding application
Send the fields and documents that Discover onboarding requirements lists for the customer’s subjectType and country: the country of registeredAddress for a business, or of the person’s address for an individual. The examples show one body for a business and one for an individual. A registeredAddress.country that onboarding does not support returns NOT_FOUND with supportedCountries, the alpha-3 codes it supports.
Authorizations
Headers
Caller-generated unique key that lets the server safely replay this request. The original response is returned for 30 days on any retry with the same key from the same organization, with the response header Idempotency-Replayed: true. Required on every state-changing money-moving or resource-creating POST.
1 - 128^[A-Za-z0-9_.:-]{1,128}$"01J7B3K2X9M8N5P6Q7R8S9T0V1"
Body
The application subject. business (the default when omitted) onboards an entity; individual onboards a natural person, whose data goes under ownership.persons[0] and activity.
business, individual Business-level data about the entity. Which leaves are required for a given country comes from GET /v2/onboarding/requirements.
Registered business address. country accepts ISO 3166-1 alpha-2 or alpha-3. Which leaves are required for a given country comes from GET /v2/onboarding/requirements.
Operating address when it differs from the registered one. Same leaves and country rules.
Legal-structure and industry classification. legalStructure and primaryIndustry are jurisdiction-specific; take their accepted values from GET /v2/onboarding/requirements.
Operating-activity descriptors. Which leaves are required for a given country comes from GET /v2/onboarding/requirements.
Compliance-programme attestations. Optional on customer onboarding: GET /v2/onboarding/requirements never lists these leaves, so send them only if they apply.
Regulatory and adverse-action history. Which leaves are required for a given country comes from GET /v2/onboarding/requirements.
Beneficial-owner and controlling-person disclosure under persons[]. Persons are natural people: disclose a corporate owner under relatedCompany and look through it to the individuals behind it. How many persons each role needs, and which per-person leaves they owe, comes from individualRequirements[] in GET /v2/onboarding/requirements. Each person also carries roles[] and documentIds[].
Related-company disclosure for affiliated entities — a parent, subsidiary, sister company or holding entity. Optional on customer onboarding: GET /v2/onboarding/requirements never lists these leaves, so send them only if they apply. It does not replace ownership.persons[], which still needs the natural persons behind any corporate owner.
Legal certifications the customer must affirm. A mustEqual: true marker in GET /v2/onboarding/requirements indicates an exact-value gate.
Account holder's activity and due-diligence descriptors on an individual application: occupation, employer, account purpose, source of funds, expected volumes and countries of activity. Individual applications only. The account holder's activity and due-diligence descriptors.
Answers to operator-defined questions, keyed by the key in the field's pointer. GET /v2/onboarding/requirements advertises each one as /customAnswers/<key> with the question as its label; send only the keys it lists.
Customer-level document IDs from POST /v2/documents to attach to this onboarding. Per-person documents go on ownership.persons[i].documentIds[].
1001Optional integrator-supplied identifier echoed back on the application record for cross-system correlation. 1-255 characters from A-Za-z, 0-9, underscore, hyphen, colon, and period — no spaces.
^[A-Za-z0-9_\-:.]{1,255}$"ext_customer_8421"
Response
The submitted onboarding application
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
Unique application identifier
^app_[0-9A-Za-z]{22}$Current lifecycle status of the application
pending, processing, approved, rejected, cancelled "pending"
Timestamp when the application was created
"2026-01-15T09:30:00.000Z"
Timestamp when the application was last modified
"2026-01-15T09:30:00.000Z"
customer_onboarding Client-provided identifier for cross-referencing. Omitted when the client did not supply one. 1-255 characters from A-Za-z, 0-9, underscore, hyphen, colon, and period — no spaces.
^[A-Za-z0-9_\-:.]{1,255}$"ext-12345"
Timestamp when the application was submitted for review. Omitted while still in progress.
"2026-01-15T09:30:00.000Z"
Machine-readable failure code on rejected applications. Omitted on non-rejected applications.
rejected_by_ops, compliance_denied Customer-facing failure message accompanying failureCode. Omitted on non-rejected applications.
Whether a corrected application will be considered. true: correct the data and submit a fresh application. false: the decision is final, do not resubmit. Omitted on non-rejected applications.
Where the review of a processing application stands. automated: Conduit's automated review is still running. operator: the automated review finished without a decision, or Conduit has an open request for information about the application. A Conduit operator owns the next step unless the request needs your answer. operator means no automated decision will come; expect a decision or a request for information from Conduit. Present only while status is processing.
automated, operator Customer this onboarding application produced. Omitted while the application is still being reviewed; present after approval persists the customer row.
^cus_[0-9A-Za-z]{22}$People declared on the submission, in submit order: the owners, controlling persons and legal representatives of a business, or the one account holder of an individual. Omitted before the application carries a submission.
Integrator guidance for the resubmission. Present only on a rejected application whose resubmittable is true. A fixed line — display or log it, do not parse it. Omitted on non-rejected applications and on final rejections.
Questions to address in the resubmission. Present only on a rejected application whose resubmittable is true when Conduit asks for more information. Omitted otherwise.