Simulate the compliance verdict on a sandbox application
Drives an in-flight sandbox application to a deterministic compliance verdict. outcome: "approved" flips the application to APPROVED, activates the resource it produces (customer, organization, virtual account, wallet), and fires the matching *.approved event. outcome: "rejected" flips the application to REJECTED and fires the matching *.rejected event. The application response then carries failureMessage, failureCode (“compliance_denied” when the application carries a failed compliance verdict, otherwise “rejected_by_ops”), resubmittable (false only on a compliance denial), and, on a resubmittable customer onboarding rejection, resubmissionGuidance — the same fields production emits, except reviewQuestions, which only a Conduit review can attach, so either rejection branch can be exercised end to end here. On rejected, the optional body shapes the rejection: free-text { reason } surfaces verbatim as the application’s failureMessage, unless the application carries a failed compliance verdict, in which case the reason is suppressed and replaced with a generic contact-support message; structured { category, field? } selects a canonical user-facing summary that appears on failureMessage. Categories: document_mismatch (optional field: tax_id, date_of_incorporation, business_name, business_entity_id, and for an individual application’s own fields account_holder_birth_date, account_holder_address, account_holder_tax_id); data_sourcing_mismatch (optional field: business_entity_id, ubo_first_name, ubo_last_name, ubo_phone, ubo_email, ownership_list; on an individual application the ubo_* fields point at the account holder); compliance; generic (accepts an optional free-text reason). The category value is not case-sensitive. category is only applicable to KYB-pipeline applications; other application types yield 422 REJECTION_CATEGORY_NOT_APPLICABLE. An undecided application cancels on its own after 14 days. This call still decides it, including a CANCELLED one. The same outcome on an application that already carries it returns 200 with the application unchanged, so a call made after an automatic decision still succeeds. A call that overlaps the decision can return 409 APPLICATION_INVALID_STATUS. A different outcome on an APPROVED or REJECTED application returns 409 APPLICATION_ALREADY_DECIDED. The response is the application resource at its new state. Caller’s API key must own the application.
Authorizations
Path Parameters
"app_1A2b3C4d5E6f7G8h9I0jKl"
Body
Decision to force onto the application. approved activates the resource it produces; rejected records a rejection.
approved, rejected Free-text rejection reason. Valid on the free-text branch ({ outcome: "rejected", reason }) and on category: generic. Persisted verbatim to rejectionReason.
500Structured rejection category, not case-sensitive. Selects a specific user-facing summary. Mutually exclusive with a bare reason on non-generic branches.
document_mismatch, data_sourcing_mismatch, compliance, generic Optional field hint. Requires category; sending field without category yields 400 VALIDATION_ERROR. Accepted by document_mismatch (tax_id / date_of_incorporation / business_name / business_entity_id, and for an individual application's own fields account_holder_birth_date / account_holder_address / account_holder_tax_id) and data_sourcing_mismatch (business_entity_id / ubo_first_name / ubo_last_name / ubo_phone / ubo_email / ownership_list; on an individual application the ubo_* fields point at the account holder). Rejected on other categories and on the free-text branch.
Response
The application at its new terminal state
- Option 1
- Option 2
- Option 3
- Option 4
Unique application identifier
^app_[0-9A-Za-z]{22}$Current lifecycle status of the application
pending, processing, approved, rejected, cancelled "pending"
Timestamp when the application was created
"2026-01-15T09:30:00.000Z"
Timestamp when the application was last modified
"2026-01-15T09:30:00.000Z"
customer_onboarding Client-provided identifier for cross-referencing. Omitted when the client did not supply one. 1-255 characters from A-Za-z, 0-9, underscore, hyphen, colon, and period — no spaces.
^[A-Za-z0-9_\-:.]{1,255}$"ext-12345"
Timestamp when the application was submitted for review. Omitted while still in progress.
"2026-01-15T09:30:00.000Z"
Machine-readable failure code on rejected applications. Omitted on non-rejected applications.
rejected_by_ops, compliance_denied Customer-facing failure message accompanying failureCode. Omitted on non-rejected applications.
Whether a corrected application will be considered. true: correct the data and submit a fresh application. false: the decision is final, do not resubmit. Omitted on non-rejected applications.
Where the review of a processing application stands. automated: Conduit's automated review is still running. operator: the automated review finished without a decision, or Conduit has an open request for information about the application. A Conduit operator owns the next step unless the request needs your answer. operator means no automated decision will come; expect a decision or a request for information from Conduit. Present only while status is processing.
automated, operator Customer this onboarding application produced. Omitted while the application is still being reviewed; present after approval persists the customer row.
^cus_[0-9A-Za-z]{22}$People declared on the submission, in submit order: the owners, controlling persons and legal representatives of a business, or the one account holder of an individual. Omitted before the application carries a submission.
Integrator guidance for the resubmission. Present only on a rejected application whose resubmittable is true. A fixed line — display or log it, do not parse it. Omitted on non-rejected applications and on final rejections.
Questions to address in the resubmission. Present only on a rejected application whose resubmittable is true when Conduit asks for more information. Omitted otherwise.