Onboarding

KYC / KYB

Hosted onboarding plus a sandbox KYB provider. Status and reference ids only — ID images are not stored in the JSON ledger. Not a licensed bureau check. Not live acquiring.

Production move and settlement stay gated until KYB is Approved. That flag is a sandbox record. It is not a licence and not PCI Level 1.

Merchant panel

GET/POST /pgui/jsp/onboard — screens, save, documents
POST /pgui/jsp/kycSubmit — submit the pack and start a live sandbox check
POST /pgui/jsp/kycStartCheck — re-run the provider (session cookie; platform admin may pass appId and scenario)
GET /pgui/jsp/kycPdf — compiled PDF summary; ?html=1 printable HTML

There is no HASH’d public “start KYC” payment-services URL. Unknown /pgui/services/… paths still return 327.

When account status is Complete, the onboarding chrome hides Save and continue later.

Status you will see

Pack status	Account label
Draft / incomplete	Restricted — items currently due
Submitted / Under review	Under review
Approved	Complete — eligible for the production flag
Rejected	Restricted — more information due

The pack also stores providerId, providerStatus, providerApplicantId, providerCheckId, and providerReason.

Platform KYC check

When a platform KYC sandbox API key and workflow ID are configured, submit and kycStartCheck create a verification session. Platform keys live on Acquirers; a merchant may paste an override on My Profile. If keys are missing, the sandbox stub below runs. Sandbox applications accept sandbox_scenario (approve, decline_*, review_*). This is not a licensed bureau check and not PCI certified. Rail onboarding on the banking / cards adapter is separate and does not replace platform KYC.

Env: DIDIT_API_KEY, DIDIT_WORKFLOW_ID, optional DIDIT_WEBHOOK_SECRET / DIDIT_SANDBOX_SCENARIO. Set KYC_PROVIDER=sandbox to force the stub even when keys exist.

Sandbox provider

KYC_PROVIDER defaults to the stub when platform KYC keys are absent. Optional KYC_FILE_KEY (32-byte hex or base64) encrypts on-disk uploads. Stub decision order:

Explicit scenario on kycStartCheck (admin)
KYC_SANDBOX_DECISION env (approved / rejected / pending)
Hints in legal name or uploaded file names (approve, reject, pending)
Otherwise pending — complete via the KYC webhook

Inbound webhook

POST /pgui/jsp/kycWebhook or POST /pgui/services/kyc/webhook. Sandbox stub body { "applicantId", "status" } with optional KYC_WEBHOOK_SECRET + x-kyc-signature. Live platform KYC events use session_id + status and optional X-Signature-V2. Details on Webhooks.