---
title: "Search capability requests (S2S only)"
method: POST
path: "/v1/internal/requests/search"
tags: ["Internal Capability Requests"]
---

# Search capability requests (S2S only)

`POST /v1/internal/requests/search`

## Request

- Base URL: `https://api.paymongo.com`
- URL: `https://api.paymongo.com/v1/internal/requests/search`
- Auth: HTTP bearer

Takes the same filters as `GET /v1/internal/requests`, as a JSON body instead of a query string, and returns the same response. For filters too long for a URL: prod sits behind a 2 KB query-string limit, which a few hundred `kam_ids` or pasted account IDs overrun. `include=audit_history` stays a query parameter. At most 500 `kam_ids` and 200 search terms.

## Query parameters

- `include` string

## Request body

- ListRequestsReqDTO
  - `assigned_at_from` string: Date range filters (format: ISO 8601/RFC 3339 or YYYY-MM-DD, inclusive) Examples: "2026-04-15T00:00:00Z", "2026-04-15T00:00:00+08:00", or "2026-04-15"
  - `assigned_at_to` string
  - `assignee_email` string: Assignee filter. Use include_unassigned=true OR the "none" sentinel in assignee_email / assignee_emails to include unassigned requests (assignee_email IS NULL). Examples: ?include_unassigned=true ?assignee_email=none ?assignee_emails=alice@example.com&assignee_emails=none ?include_unassigned=true&assignee_emails=alice@example.com
  - `assignee_emails` string[]: Multiple assignee emails filter; "none" also sets IncludeUnassigned
  - `completed_at_from` string
  - `completed_at_to` string
  - `cursor` string: base64 encoded cursor from previous response (opaque to clients)
  - `include_unassigned` boolean: Explicit flag to include requests with no assignee
  - `include_unassigned_kam` boolean: IncludeUnassignedKAM adds requests on accounts with no active KAM, ORed with kam_ids the same way include_unassigned is with assignee_emails: ?include_unassigned_kam=true&kam_ids=214685213
  - `kam_ids` string[]
  - `limit` integer
  - `parent_id` string
  - `processed_at_from` string
  - `processed_at_to` string
  - `product_code` string: Single product code filter (backward compatible)
  - `product_codes` string[]: Multiple product codes filter
  - `search` string: request ID or account ID; several account IDs separated by whitespace or commas
  - `sort_by` 'status' | 'product_code' | 'submitted_at' | 'assigned_to' | 'assigned_at' | 'pending_clarification_at' | 'under_review_at' | 'processed_at' | 'completed_at' | 'declined_at': Sorting SortBy: status, product_code, submitted_at, assigned_to, assigned_at, pending_clarification_at, under_review_at, processed_at, completed_at, declined_at
  - `sort_dir` 'asc' | 'desc'
  - `status` string: Single status filter (backward compatible)
  - `statuses` string[]: Multiple statuses filter
  - `submitted_at_from` string
  - `submitted_at_to` string
  - `under_review_at_from` string: UnderReviewAtFrom/To window the LATEST entry into under_review, not the first.
  - `under_review_at_to` string

## Response `200`

OK

- object: Standard response containing data and its metadata if any
  - `data` ListRequestsResDTO
    - `cursor` string
    - `data` RequestResDTO[]
      - `account_id` string: AccountID is the account the request belongs to. On create, a merchant key is locked to its own account and any value sent here is ignored; service-to-service callers have no bound account and must supply it.
      - `allowed_kyb_override_keys` string[]: AllowedKybOverrideKeys is the set of kyb_override keys this request's product accepts, sorted. Ops-only, and attached to the internal single-request responses only. It is served rather than documented because the admin dashboard was mirroring it by hand, transcribed out of a rejection message — a mirror that goes stale silently, and did: keys the API accepts stopped being offered, so a reviewer could no longer ask a merchant for certain documents.
      - `applied_kyb_override_keys` string[]: AppliedKybOverrideKeys is the subset of THIS call's kyb_overrides that was written to the merchant's account, sorted. Present on the internal PATCH response only. It exists because a partial save is not uniformly applied: account_update writes the armed profile fields immediately, but defers business_type (one-way — it flips has_selected_business_type, and a later decline could not walk that back) and files_* keys (promotion deletes the documents it supersedes, and the request is still under review). Without this list a reviewer would have to assume an armed key was written, which is the silent-no-op failure the whole contract exists to prevent.
      - `applied_to_account` boolean: AppliedToAccount says whether a kyb_override write on this product reaches the merchant's ACCOUNT, or only stages values on the request for a later approval to apply. Pointer so that false is serialised rather than dropped — false is the whole point of the field. account_update stages; the payment-method and activation flows write through. The caller should not have to hard-code which is which.
      - `assigned_at` string, date-time
      - `assignee_email` string
      - `audit_history` RequestAuditLogResDTO[]: Audit trail - populated when fetching single request details
        - `action_type` string: assigned, unassigned, reassigned, status_changed, field_updated
        - `actor` string: Who performed the action (from JWT admin_id)
        - `created_at` string
        - `field_name` string: Which field was changed
        - `id` string
        - `new_value` string: Value after change (empty for removal)
        - `note` string: Optional human-readable note
        - `previous_value` string: Value before change (empty for initial)
        - `request_id` string
      - `cancelled_at` string, date-time
      - `changes` object: Changes gives an old/new view per submitted kyb_data field for account_update requests: old is the organization's current value (fetched live from Core API), new is the submitted value. Populated on the internal detail endpoint only.
      - `completed_at` string, date-time
      - `created_at` string
      - `declined_at` string, date-time
      - `email_notifications_enabled` boolean: EmailNotificationsEnabled is false when ops have stopped the merchant-facing emails for this request. Webhooks still fire. Ops-only.
      - `id` string: ID is the unique identifier of this request.
      - `internal_note` string
      - `kam_ids` string[]
      - `kyb_data` object: KybData is the KYC/KYB details submitted for this request, as a JSON object.
      - `merchant_note` MerchantNoteDTO
        - `note` string
        - `requested_custom_files` string[]: RequestedCustomFiles are reviewer-typed names for documents outside the purpose list.
        - `requested_fields` string[]: RequestedFields are kyb_data field keys the merchant must resupply.
        - `requested_files` string[]: RequestedFiles are document purposes the merchant must re-upload, without the `files_` prefix.
        - `set_at` string
      - `organization_data` object
      - `pending_clarification_at` string, date-time
      - `processed_at` string, date-time
      - `product_code` 'prd_svc_paymongo_account_activation' | 'prd_svc_paymongo_card_visa_mastercard' | 'prd_svc_paymongo_ewallet_gcash' | 'prd_svc_paymongo_ewallet_grabpay' | 'prd_svc_paymongo_ewallet_maya' | 'prd_svc_paymongo_ewallet_shopeepay' | 'prd_svc_paymongo_std_wallet' | 'prd_svc_paymongo_tax_document' | 'prd_svc_paymongo_account_update': ProductCode identifies the product the request is for: account activation, one of the four e-wallets, card (Visa/Mastercard), Standard Wallet ("Enabled Wallet"), a tax document, or a business-profile update (account_update). All product behaviour keys off this field.
      - `request_type` 'account_update' | 'config_update' | 'onboarding' | 'product_request', required: RequestType classifies the request; it follows from product_code. Nothing branches on it.
      - `requester_id` string, required: RequesterID identifies who initiated the request. Caller-supplied. Required, but not validated for shape and not used for authorization.
      - `status` 'draft' | 'submitted' | 'under_review' | 'pending_clarification' | 'processing' | 'completed' | 'declined' | 'cancelled'
      - `submitted_at` string, date-time
      - `under_review_at` string, date-time
      - `updated_at` string
    - `has_more` boolean
    - `meta` ListRequestsMetaDTO
      - `total_requests` integer: Total requests matching the filter criteria
      - `total_unique_organizations` integer: Total unique organizations matching the filter criteria
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error
- `502`: parent_id could not be resolved to its child accounts, or kam_ids to the KAMs' accounts

---

[API](https://skmtc.dev/paymongo/apis/onboarding-api.md) - [All operations](https://skmtc.dev/paymongo/apis/onboarding-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/onboarding-api/revisions/36885f98768f?raw)