---
title: "Create Verification"
method: POST
path: "/verifications"
tags: ["Verifications"]
---

# Create Verification

`POST /verifications`

Starts a hosted verification session for an account or user, or returns the active session when one already exists. Any fields you include in the request body are used to prefill the session. Send `documents` (with `document_type`) to instead verify the person from identity documents included in this request — no hosted session involved. Send `share_token` to reuse a verification another Sumsub account has already completed for this person, instead of verifying them again. Send `verification_id` to reuse a verification the signed-in user already completed on Whop. Every mode except `verification_id` is rejected once the account has an `approved` verification — unlink it first to start a new one — while `verification_id` replaces whichever verification of that kind the account currently has.

## Query parameters

- `account_id` string
- `user_id` string

## Headers

- `Idempotency-Key` string

## Request body

- union
  - object — Request body for an individual (KYC) verification. Omit `kind` or set it to `individual`. KYC is required to pay out funds and is a prerequisite for Whop Card access. Accepting payments does not require verification until a business reaches $5000 in payments. Add `business_name` and `business_structure` if the individual operates under a business entity — this enables payouts to be received by a business bank account. `country` is always the individual's own country, and the supported `business_structure` values vary by it — see [Business structures](/developer/verification/business-structures).
    - `address` object — Every value accepts `null`, so a form seeded from a previous response can round-trip unset fields unchanged.
      - `city` string, nullable
      - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
      - `line1` string, nullable — First line of the street address.
      - `line2` string, nullable — Second line of the street address.
      - `postal_code` string, nullable — Postal or ZIP code.
      - `state` string, nullable — State, province, or region code, for example `CA`.
    - `business_name` string — Legal business name for a sole proprietor or single-member LLC.
    - `business_structure` string — Entity type for sole proprietors, such as `single_member_llc`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
    - `business_tax_identification_number` string — The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
    - `business_website` string — Business website URL. Whop store pages are not accepted.
    - `country` string — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
    - `date_of_birth` string — Formatted as `YYYY-MM-DD`.
    - `document_type` 'ID_CARD' | 'DRIVERS' | 'RESIDENCE_PERMIT' | 'PASSPORT' — Identity document being sent, when verifying with `documents`. Decides exactly which file slots to send: `ID_CARD` → `id_card_front` + `id_card_back` + `selfie`; `DRIVERS` → `drivers_front` + `drivers_back` + `selfie`; `RESIDENCE_PERMIT` → `residence_permit_front` + `residence_permit_back` + `selfie`; `PASSPORT` → `passport_front` + `selfie`. See [Identity documents](/developer/verification/identity-documents).
    - `documents` object — Identity document files, each value the file's raw bytes base64-encoded (JPEG, PNG, or PDF, up to 5MB per file before encoding). Sending this object verifies the person from the files in this request instead of a hosted session — individual verifications only, and the request must also carry `document_type`, `first_name`, `last_name`, `date_of_birth`, `country`, `phone`, `tax_identification_number`, and an `address` with `line1`, `city`, `state`, and `postal_code`. Send every slot for your `document_type` — a missing or rejected file fails the whole request and nothing is submitted; review starts automatically once every document is accepted. See [Identity documents](/developer/verification/identity-documents) for a full walkthrough.
      - `drivers_back` string — Back of the driver's license, base64-encoded. Required when `document_type` is `DRIVERS`.
      - `drivers_front` string — Front of the driver's license, base64-encoded. Required when `document_type` is `DRIVERS`.
      - `id_card_back` string — Back of the ID card, base64-encoded. Required when `document_type` is `ID_CARD`.
      - `id_card_front` string — Front of the ID card, base64-encoded. Required when `document_type` is `ID_CARD`.
      - `passport_front` string — Photo page of the passport, base64-encoded. Required when `document_type` is `PASSPORT`.
      - `residence_permit_back` string — Back of the residence permit, base64-encoded. Required when `document_type` is `RESIDENCE_PERMIT`.
      - `residence_permit_front` string — Front of the residence permit, base64-encoded. Required when `document_type` is `RESIDENCE_PERMIT`.
      - `selfie` string — Photo of the person's face, base64-encoded. Always required, with every document type. Must be JPEG or PNG.
    - `first_name` string
    - `kind` 'individual' — Verification type. Defaults to `individual`.
    - `last_name` string
    - `phone` string
    - `share_token` string — Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns `approved` when it satisfies them, or `pending` with a `session_url` covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with `documents` or `document_type`.
    - `tax_identification_number` string — The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.
    - `verification_id` string — ID of an `approved` verification to reuse on this account instead of verifying the person again, for example `idpf_XXXXXXXX`. The verification becomes this account's current one for its kind — replacing whichever verification of that kind the account already has, and carrying its payout account across — and the response is that same verification, unchanged. Only the signed-in Whop user who started the original verification can reuse it: API keys, OAuth tokens, and onboarding links are refused. `kind` is the only other field it accepts, and must match the reused verification. An account whose verification was denied or is still under review cannot reuse one.
  - object — Request body for a business entity (KYB) verification. Set `kind` to `business`. KYB includes everything KYC provides and additionally unlocks financing options for payments and business Whop Cards.
    - `address` object — Every value accepts `null`, so a form seeded from a previous response can round-trip unset fields unchanged.
      - `city` string, nullable
      - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
      - `line1` string, nullable — First line of the street address.
      - `line2` string, nullable — Second line of the street address.
      - `postal_code` string, nullable — Postal or ZIP code.
      - `state` string, nullable — State, province, or region code, for example `CA`.
    - `business_name` string — Legal business name.
    - `business_structure` string — Legal entity structure of the business, such as `private_corporation` or `sole_proprietorship`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
    - `business_tax_identification_number` string — The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
    - `business_website` string — Business website URL. Whop store pages are not accepted.
    - `country` string — Country of incorporation as a two-letter ISO 3166-1 country code.
    - `date_of_birth` string — Business representative's date of birth, formatted as `YYYY-MM-DD`.
    - `first_name` string — First name of the business representative, used to prefill the verification session.
    - `kind` 'business' — Must be `business` to start a KYB verification.
    - `last_name` string — Last name of the business representative, used to prefill the verification session.
    - `place_of_incorporation` string — State or region where the business is incorporated.
    - `share_token` string — Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns `approved` when it satisfies them, or `pending` with a `session_url` covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with `documents` or `document_type`.
    - `tax_identification_number` string — The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.
    - `verification_id` string — ID of an `approved` verification to reuse on this account instead of verifying the person again, for example `idpf_XXXXXXXX`. The verification becomes this account's current one for its kind — replacing whichever verification of that kind the account already has, and carrying its payout account across — and the response is that same verification, unchanged. Only the signed-in Whop user who started the original verification can reuse it: API keys, OAuth tokens, and onboarding links are refused. `kind` is the only other field it accepts, and must match the reused verification. An account whose verification was denied or is still under review cannot reuse one.

## Response `200`

OK

- object
  - `address` object, nullable — Address on the verification profile. `null` when no address is set.
    - `city` string, nullable
    - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
    - `line1` string — First line of the street address.
    - `line2` string, nullable — Second line of the street address.
    - `postal_code` string, nullable — Postal or ZIP code.
    - `state` string, nullable — State, province, or region code, for example `CA`.
  - `business_name` string, nullable — Legal business name.
  - `business_structure` string, nullable — Legal entity structure of the business, such as `private_corporation` or `sole_proprietorship`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
  - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
  - `created_at` string — When the verification profile was created, as an ISO 8601 timestamp.
  - `date_of_birth` string, nullable — Formatted as `YYYY-MM-DD`.
  - `email` string, nullable — Email address on the verification profile.
  - `first_name` string, nullable
  - `id` string — Verification profile ID, prefixed `idpf_`.
  - `kind` 'individual' | 'business'
  - `last_name` string, nullable
  - `phone` string, nullable — Phone number on the verification profile.
  - `requested_information` object[] — What Whop still needs before review can continue — one requirement per entry. Answer with Update Verification; nothing from the response is echoed back. Keys that don't apply are omitted.
    - `action_url` string — URL for a related action, such as completing liveness verification or viewing a payment. Absent when no action is available.
    - `details_label` string — Follow-up prompt shown with this requirement.
    - `details_required` boolean — Whether the follow-up response is required when visible.
    - `details_visible_for` string[] — Selected option values that make the follow-up prompt visible.
    - `errors` object[] — Present after a rejected submission.
      - `code` string — Stable error code.
      - `reason` string — Why it was rejected.
    - `id` string, required — Requested information item ID, prefixed `inrqi_`.
    - `label` string, required — Instruction to show the user. Carries the reviewer's note verbatim when there is one.
    - `optional` boolean — `true` when the item can be skipped.
    - `options` string[] — The values `value` may take on a `select` item. On an `id_document` item these are the ID types accepted, and the chosen one decides which `documents` slots to send. Absent when the item has no choice to make.
    - `requirement` string, required — What is needed: a document name such as `bank_statement`, or a field key such as `ssn` or `identity_document`. Handle unrecognized values by `type`.
    - `response_type` 'yes_no' | 'yes_no_na' | 'date' | 'url' | 'number' | 'tel' — Optional native input format for a text response.
    - `selection_mode` 'single' | 'multiple' — Whether a question with `options` accepts one value or multiple values.
    - `supporting_documents` File[] — Documents supplied with the requirement for context.
      - `content_type` string, nullable, required — The file's MIME type, e.g. `application/pdf`.
      - `created_at` string, required — When the file was created, as an ISO 8601 timestamp.
      - `filename` string, nullable, required — The original filename, including its extension.
      - `id` string, required — The file's ID, prefixed `file_`.
      - `multipart_chunk_size` integer, nullable — The byte size each part (except the last) must be. Present only on create, and only for multipart uploads.
      - `multipart_upload_id` string, nullable — The ID of the multipart upload, passed back to `complete`. Present only on create, and only for multipart uploads.
      - `multipart_upload_urls` FileMultipartUrl[], nullable
        - `part_number` integer, required — The 1-based index of this part within the multipart upload.
        - `url` string, required — The presigned URL to PUT this part's bytes to.
      - `object` string, required — The type of this object, always `file`.
      - `size` integer, nullable, required — The file size in bytes. `null` until the upload has finished.
      - `upload_headers` object — Headers to send with the upload PUT. Present only on create.
      - `upload_status` 'pending' | 'processing' | 'ready' | 'failed', required — Where the file is in its upload lifecycle.
      - `upload_url` string, nullable — Presigned URL to PUT the file's bytes to. Present only on create, and only for single-part uploads.
      - `url` string, nullable, required — A URL to download the file: a permanent CDN URL for public files, a signed expiring URL for private ones. `null` until the upload has finished.
      - `visibility` 'public' | 'private', required — `public` files are served via an unsigned CDN URL; `private` files via a signed, expiring URL.
    - `supporting_files_explanation_allowed` boolean — Whether a written explanation may replace required supporting files.
    - `supporting_files_required` boolean — Whether this requirement also needs supporting files.
    - `supporting_files_visible_for` string[] — Selected option values that make the supporting-file input visible.
    - `type` string, required — What to send as the answer, so you never have to infer it: `files` (a document, as a list of its pages), `id_document` (send `documents` with the slot keys for the ID you are uploading), `text`, `date`, `phone` or `select` (send `value`), `text_with_files` (send `value` and optional `files`), `address` (send `address`), or `liveness` (open `action_url`, then send `value` as `true` after completion).
  - `required_documents` object[] — Documents for a document-upload verification and their progress. Present only on verifications created by sending `documents`. `pending_upload` documents were not accepted yet — send the full set again with another Create Verification call.
    - `document` string — Document slot key, such as `id_card_front`, `id_card_back`, or `selfie`.
    - `rejection_reason` string, nullable — Why the previous submission was rejected, when the provider requested new documents or declined the verification.
    - `status` 'pending_upload' | 'submitted' — `pending_upload` until the document has been relayed for review; `submitted` afterwards.
  - `session_url` string, nullable — Hosted verification session URL for the user to complete identity checks. Expires 7 days after creation.
  - `status` 'not_started' | 'pending' | 'processing' | 'manual_review' | 'approved' | 'rejected' | 'action_required' — Current verification state. `not_started` before any session exists; `pending` while a session needs the user's input; `processing` while the provider's automated checks run on a fresh submission; `action_required` when `requested_information` needs answers; `manual_review` while information already sent is under review — an audit answer, or a document the payout provider holds — nothing to submit, usually done within 3 business days; `approved` on success; `rejected` on failure. Call Create Verification again to start a new session.
  - `updated_at` string — When the verification profile was last updated, as an ISO 8601 timestamp.

## Other responses

- `201` — verification created
- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found
- `409` — Conflict

## Changes

> 74 revisions in range; 1 not diffed.

- **2026-09-25** `c1dceb26e505` — 2 info
  - added the new optional `query` request parameter `user_id`
  - the `query` request parameter `account_id` became optional
- **2026-09-17** `ef86d14ef691` — 20 info
  - added the optional property `requested_information/items/action_url` to the response with the `200` status
  - added the optional property `requested_information/items/action_url` to the response with the `201` status
  - added the optional property `requested_information/items/details_label` to the response with the `200` status
  - added the optional property `requested_information/items/details_label` to the response with the `201` status
  - …16 more
- **2026-09-09** `5fa504e78695` — 2 info
  - added the new optional request property `oneOf[subschema #1: CreateIndividualVerification]/verification_id`
  - added the new optional request property `oneOf[subschema #2: CreateBusinessVerification]/verification_id`
- **2026-08-13** `48408451a1f0` — 15 info
  - added the new optional request property `oneOf[subschema #2: CreateBusinessVerification]/date_of_birth`
  - added the new optional request property `oneOf[subschema #2: CreateBusinessVerification]/first_name`
  - added the new optional request property `oneOf[subschema #2: CreateBusinessVerification]/last_name`
  - the request property `oneOf[subschema #1: CreateIndividualVerification]/address/city` became nullable
  - …11 more
- …earlier changes not shown

[Full history](https://skmtc.dev/whop/apis/whop-api/changes/verifications/post.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whop/apis/whop-api/revisions/78e1ed7366cd?raw)