---
title: "Create or resume hosted verification for the session customer"
method: POST
path: "/compliance/verification"
tags: ["Compliance"]
---

# Create or resume hosted verification for the session customer

`POST /compliance/verification`

## Request

- Base URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor`
- URL: `https://v1.orchestrator.rhinestone.dev/deposit-processor/compliance/verification`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/docs/compliance/verification/post.ts> (a function with typed inputs; its response is checked against the schema)

Browser route. Starts or resumes the provider-hosted verification flow for the compliance customer named by the session bearer. A `pending` result with `nextAction` must be presented in an iframe; `pending` without it means the provider is reviewing and status updates arrive via webhook. The hosted URL is short-lived and is never stored — call again to mint a fresh one.

## Request body

- ComplianceVerificationRequestBody
  - `currency` 'EUR' | 'USD': Ignored. The customer is verified for both currencies; the residence they declare decides the account's (EUR inside SEPA, USD elsewhere).

## Response `200`

Hosted verification session

- ComplianceVerificationSession
  - `id` string, uuid, required
  - `status` 'pending' | 'completed' | 'failed', required: pending: present nextAction or await review; completed: already verified; failed: provider rejected. Interaction status only, never settlement.
  - `expiresAt` string, date-time, required
  - `nextAction` object
    - `type` 'hosted', required
    - `url` string, uri, required
    - `presentation` 'iframe', required

## Other responses

- `400`: Invalid request
- `401`: Missing, malformed, or expired session token
- `403`: Session does not match the resolved customer, READ_ONLY_SESSION: the bearer came from a `resumeOnly` session, or PROVIDER_FORBIDDEN: the provider refuses verification for this customer
- `404`: Bank transfer by virtual account is not provisioned for this project
- `500`: Failed to create the verification session
- `502`: PROVIDER_UNAVAILABLE: the verification provider did not answer; or PROVIDER_REJECTED: it refused the request (`providerError`)
- `503`: Verification provider not configured, or sessions paused

## Changes

- **2026-11-06** `aa1767d704fa`: 12 warning, 2 info
  - removed the optional property `details` from the response with the `403` status
  - removed the optional property `details` from the response with the `502` status
  - added the new `PROVIDER_FORBIDDEN` enum value to the `code` response property for the response status `403`
  - added the new `PROVIDER_FORBIDDEN` enum value to the `code` response property for the response status `502`
  - …10 more
- **2026-10-07** `8b74181ef9e2`: 2 info
  - the request property `currency` became optional
  - request property `currency` deprecated
- **2026-09-30** `a6fd693c3d5f`: 1 info
  - added the non-success response with the status `404`
- **2026-09-17** `676300ac19ff`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/changes/compliance/verification/post.md)

---

[API](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api.md) - [All operations](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/rhinestonewtf/apis/deposit-service-api/revisions/aa1767d704fa?raw)