Internal Capability Requests

Patch capability request data (S2S only)

Updates request KYB data and organization fields without changing request status. Only the fields provided in kyb_overrides will be updated. Returns 400 error if any key in kyb_overrides is not in the allowed list. This endpoint is for internal use only and requires S2S authentication.

patch/v1/internal/requests/{id}

Request

  • Base URL
    https://api.paymongo.com
  • URL
    https://api.paymongo.com/v1/internal/requests/{id}
  • Auth
    HTTP bearer

Path parameters

idstring required

Request ID

Request body

actorstring

Email of the person making the change (from JWT)

kyb_overridesstring required

KybOverrides allows updating specific KYB data values and organization fields Only the fields included in this map will be updated in both:

  1. Request KybData (stored in database)
  2. Core organization API

If nil: No updates will be performed If empty map {}: No updates (returns request as-is) If provided with fields: Updates only those specific fields

Accepted keys, per product:

E-Wallet / Card, Standard Wallet, Account Update — any key naming a real kyb_data PROFILE field. There is no curated list: a reviewer may correct anything the merchant submitted. A key that names no kyb_data field is rejected (400) rather than silently ignored.

Account Activation — account_type, business_type, is_one_person_corporation, business_trade_name, business_legal_name, business_dti_registered_name, business_description.

Tax Document — files_tax_exemption, files_tax_sworn_declaration, files_bir_2303.

DOCUMENT keys (files_<purpose>) are always gated to the purposes the product collects, even where profile fields are not: asking a merchant for a purpose the product does not accept produces a clarification they cannot satisfy. GET /v1/internal/requests/{id} returns the effective list for a request in allowed_kyb_override_keys.

Rejection is all-or-nothing: one invalid key fails the whole payload and nothing is written.

Not every accepted key has somewhere to land. ack_sd_requirement has no column in either core-api or accounts-api, and account_type is read-only in Core API. The response reports what was actually written in applied_kyb_override_keys, so an armed key that wrote nothing is visible instead of being reported as a successful save.

When the keys reach the merchant's account:

E-Wallet / Card, Standard Wallet, Account Activation — immediately, on this call.

Account Update — immediately, EXCEPT business_type and is_one_person_corporation, which are applied at approval (POST /process, or /complete when /process was skipped). Writing a business type sets has_selected_business_type and cannot be walked back by a later decline, so it is not applied mid-review.

applied_to_account on the response says whether this product writes through at all.

Example (e-wallet): {"business_type": "corporation", "business_legal_name": "Acme Corp", "business_website": "https://acme.com"} Example (account activation): {"business_trade_name": "Updated Name", "business_description": "Updated description"} Example (account update, One Person Corporation): {"business_type": "corporation", "is_one_person_corporation": true}

Example request

{
  "kyb_overrides": "{\"business_type\":\"corporation\",\"business_legal_name\":\"Acme Corp\"}"
}

Response

OK

has_moreboolean

Example response

{
  "data": {
    "account_id": "acct_01hzy8n3k2b5xq9m4p7r6t8w1v",
    "id": "req_01hzy8n3k2b5xq9m4p7r6t8w1v",
    "product_code": "prd_svc_paymongo_ewallet_gcash",
    "request_type": "onboarding",
    "requester_id": "org_01hzy8n3k2b5xq9m4p7r6t8w1v"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.