---
title: "Rotate the hosted KYC link"
method: POST
path: "/v0/customers/{id}/kyc-link/rotate"
tags: ["Customers"]
---

# Rotate the hosted KYC link

`POST /v0/customers/{id}/kyc-link/rotate`

## Request

- Base URL: `https://orchestration.seismic.systems/api`
- URL: `https://orchestration.seismic.systems/api/v0/customers/{id}/kyc-link/rotate`
- Auth: API key in header `Api-Key`

Overwrite the customer's hosted-link token in place — the old URL stops working immediately. Use after a suspected leak.

## Path parameters

- `id` string, uuid, required

## Response `200`

The fresh link.

- HostedKycLink: Hosted KYC link surfaced inline on every customer payload. The partner emails `url` to their customer; the customer clicks through to the standalone `/kyc-link/<token>` page and fills in the hosted verification form. `token` is the same plaintext embedded in the URL — exposed so partners can build their own URLs against a different frontend host. Rotation: `POST /v0/customers/:id/kyc-link/rotate` overwrites the token in place and returns the new pair. There is no expiry or revocation.
  - `token` string, required
  - `url` string, required: Absolute URL the partner emails to their customer — origin + optional base path + `/kyc-link/<kind>/<token>`. The origin is Seismic's hosted origin for the environment (`https://orchestration.seismic.systems` in production, `https://orchestration.seismictest.net` in sandbox). Partners embedding the link in their own branded frontend can ignore this and rebuild the URL against their own host using `token`.

## Other responses

- `401`: Missing or invalid API key.
- `404`: Customer not found.

---

[API](https://skmtc.dev/seismic/apis/seismic-orchestration-api.md) - [All operations](https://skmtc.dev/seismic/apis/seismic-orchestration-api/llms.txt) - [OpenAPI document](https://skmtc.dev/seismic/apis/seismic-orchestration-api/revisions/08ada1f159fa?raw)