Merchant questionnaire · Social Matter Payments API

GET /

Redirects to the questionnaire (/apply/)

No auth

Host https://onboard.socialmatterspay.com

Responses

Status	Meaning
`302`	To /apply/

Example

The onboarding host's root sends you on to the questionnaire

GET /

curl https://onboard.socialmatterspay.com/

Response · 302

HTTP 302
Location: /apply/

GET /apply

Redirects to /apply/

No auth

Host https://onboard.socialmatterspay.com

Responses

Status	Meaning
`301`	To /apply/

Example

/apply without its slash

GET /apply

curl https://onboard.socialmatterspay.com/apply

Response · 301

HTTP 301
Location: /apply/

GET /apply/*

The questionnaire page and its files

No auth

Host https://onboard.socialmatterspay.com

Served with a strict Content-Security-Policy: this origin, plus Plaid Link for the bank step; the camera is allowed for ID photos and the selfie.

Responses

Status	Meaning
`200`	The page or file
`404`	Error — error shape and codes
`503`	Error — error shape and codes

Example

No captured example: the page's files are bound to the onboarding Worker as ASSETS when it is deployed; the capture runs it without them (503: "The questionnaire is not part of this deployment.").

GET /v1/applications/config

The lists the questionnaire offers: entity types, categories (and what SMP can’t accept), integrations, document types, states, the statement window, the biometric notice, and which bank and ID modes are live

No auth

Host https://onboard.socialmatterspay.com

Responses

Status	Meaning
`200`	Config

Fields of `data` (200)

Field Notes

entity_typesobject

Business types, each key mapped to the label shown for it.

5 child fields

`llc`string	—
`c_corporation`string	—
`s_corporation`string	—
`partnership`string	—
`nonprofit`string	—

categoriesarray of object

4 child fields

`key`string	The value to send as the category.
`label`string	—
`group`enum	one of `Business to business`, `Consumer`, `Only with a bank’s written approval`
`bank_approval_required`boolean	True when no merchant in the category goes live until a bank has approved the category in writing.

prohibitedarray of string Kinds of business that are never accepted. Shown on the questionnaire, not selectable.

integration_typesobject

The ways to connect, each key mapped to its label and a note.

6 child fields

woocommerceobject

2 child fields

`label`string	—
`note`string	—

apiobject

2 child fields

`label`string	—
`note`string	—

shopifyobject

2 child fields

`label`string	—
`note`string	—

checkoutobject

2 child fields

`label`string	—
`note`string	—

invoicesobject

2 child fields

`label`string	—
`note`string	—

not_sureobject

2 child fields

`label`string	—
`note`string	—

document_typesobject

The document types an upload can carry, each key mapped to the label shown for it.

12 child fields

`id_front`string	—
`id_back`string	—
`selfie`string	—
`ein_letter`string	—
`articles`string	—
`dba_certificate`string	—
`terms_page`string	—
`bank_statement`string	—
`voided_check`string	—
`bank_letter`string	—
`account_document`string	—
`other`string	—

name_link_proofsobject

The proofs that link the legal name to a different name on the website, each key mapped to its label.

4 child fields

`not_needed`string	—
`dba_certificate`string	—
`terms_page`string	—
`domain_email_ein_letter`string	—

statesarray of string Two-letter codes of the US states and territories the questionnaire accepts.

statement_windowarray of string The five months (YYYY-MM, this month first) a bank statement may cover.

biometric_consentobject

The biometric notice and the release for the face match, word for word. The person's name goes in the blank of the release.

6 child fields

versionstring Send this as version when agreeing; a changed notice is refused.

draft_stampstring The draft notice stamped on the document while counsel has not approved it.

sectionsarray of object

4 child fields

`heading`string	—
`paragraphs`array of string	The section's paragraphs, when it has any.
`bullets`array of string	The section's bullet points, when it has any.
`text`string	Appears only in the documentation's captured examples, where it stands in for paragraphs and bullets. The live answer carries paragraphs and bullets and no text.

textstring The release sentence, with name_blank where the person's full legal name goes.

name_blankstring The placeholder in text that the person's name replaces.

notice_sha256string SHA-256 of the notice as it stands, stored with every answer.

id_attemptsinteger How many automatic ID check attempts a person gets before a person at SMP takes over.

bank_modeenum How the payout account is proved here. plaid with Plaid keys, sandbox with Plaid's test account outside production, document_only with a voided check, bank letter or bank document. one of plaid, sandbox, document_only

idv_modeenum Who checks the owners' IDs. plaid is Plaid Identity Verification, sandbox is the built-in test provider, manual is a person at SMP. one of plaid, sandbox, manual

sandboxboolean True outside production.

Example

What the questionnaire asks for: the document types, the statement months, the release text

GET /v1/applications/config

curl https://onboard.socialmatterspay.com/v1/applications/config

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "entity_types": {
      "llc": "LLC",
      "c_corporation": "Corporation (C corp)",
      "s_corporation": "S corporation",
      "partnership": "Partnership (LP, LLP or general)",
      "nonprofit": "Nonprofit corporation"
    },
    "categories": [
      {
        "key": "b2b_supplies",
        "label": "Wholesale and business supplies",
        "group": "Business to business",
        "bank_approval_required": false
      },
      {
        "key": "professional_services",
        "label": "Professional services (accounting, legal, consulting, advisory)",
        "group": "Business to business",
        "bank_approval_required": false
      },
      … 14 more
    ],
    "prohibited": [
      "GLP-1 receptor agonists",
      "Controlled substances",
      … 2 more
    ],
    "integration_types": {
      "woocommerce": {
        "label": "WooCommerce",
        "note": "Our plugin for WordPress stores"
      },
      "api": {
        "label": "Direct API",
        "note": "Open to any approved merchant, no volume minimum"
      },
      "shopify": {
        "label": "Shopify",
        "note": "App pending Shopify’s approval"
      },
      "checkout": {
        "label": "Checkout on your own site",
        "note": "smp.js and hosted checkout"
      },
      "invoices": {
        "label": "Invoices",
        "note": "Bill customers by email, each invoice with its own account number"
      },
      "not_sure": {
        "label": "Not sure yet",
        "note": "We’ll help you choose"
      }
    },
    "document_types": {
      "id_front": "Government ID, front",
      "id_back": "Government ID, back",
      "selfie": "Selfie",
      "ein_letter": "IRS EIN letter (CP 575 or 147C)",
      "articles": "State registration (Articles of Organization or Incorporation)",
      "dba_certificate": "DBA certificate",
      "terms_page": "Website terms page",
      "bank_statement": "Bank statement",
      "voided_check": "Voided check",
      "bank_letter": "Bank letter",
      "account_document": "Bank document showing the business name, account and routing number",
      "other": "Other document"
    },
    "name_link_proofs": {
      "not_needed": "The legal name is the name on the website",
      "dba_certificate": "DBA (assumed or fictitious name) certificate",
      "terms_page": "The website’s terms page shows the legal name",
      "domain_email_ein_letter": "Verified email on the website’s domain + the IRS EIN letter"
    },
    "states": [
      "AL",
      "AK",
      … 54 more
    ],
    "statement_window": [
      "2026-10",
      "2026-09",
      … 3 more
    ],
    "biometric_consent": {
      "version": "biometric-notice-0.1-draft-2026-10-25",
      "draft_stamp": "DRAFT — not reviewed by counsel. Not in force. Social Matter Payments LLC · version 0.1 · 2026-10-25.",
      "sections": [
        {
          "heading": "1. When this applies",
          "text": "(1 paragraphs, shown in full on the page)"
        },
        {
          "heading": "2. What is collected and stored",
          "text": "(2 paragraphs, shown in full on the page)"
        },
        … 5 more
      ],
      "text": "I have read SMP's Biometric Notice. I consent to Social Matter Payments LLC and its identity-verification provider collecting, storing and using a scan of my face geometry from my selfie and my ID photo, only to verify my identity for this application, and to its destruction on the schedule in that notice. I sign this release electronically as [full legal name].",
      "name_blank": "[full legal name]",
      "notice_sha256": "24ff3e9daef75afb0c5635761d6b4392dfe3af3306b4f1f00f04c7c02f0fe6eb"
    },
    "id_attempts": 3,
    "bank_mode": "sandbox",
    "idv_mode": "sandbox",
    "sandbox": true
  }
}

POST /v1/applications/start

Start (or resume) an application: email and phone, then a 6-digit code goes to the email

No auth

Host https://onboard.socialmatterspay.com

An email with an open application resumes it. The answer is the same whether or not the email had an application.

Request body

Field	Notes
`email` requiredstring	—
`phone` requiredstring	A 10-digit US number
`name`string	—
`referral_code`string	From the partner link (?ref=); the smp_ref cookie is read too
`referral_claim`string	Who referred you? — a name or a code; a name waits for the CRM to confirm

Responses

Status	Meaning
`201`	A code was sent (the email is shown masked)
`400`	Error — error shape and codes
`429`	Error — error shape and codes

Fields of `data` (201)

Field	Notes
`object`string = "sign_in"	—
`code_sent_to`string	The email the six-digit code went to, with most of the name before the @ hidden.
`expires_minutes`integer	How long the code works, in minutes.

Example

Start an application: a code is emailed to confirm the address

POST /v1/applications/start

curl -X POST https://onboard.socialmatterspay.com/v1/applications/start \
  -H 'CF-Connecting-IP: 203.0.113.7' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "jen31@sunrise31.example",
  "phone": "(305) 555-0123",
  "name": "Jennifer Thompson"
}'

Response · 201

HTTP 201
Cache-Control: no-store

{
  "data": {
    "object": "sign_in",
    "code_sent_to": "j••••@sunrise31.example",
    "expires_minutes": 10
  }
}

POST /v1/applications/verify

Prove the email with its code; returns the applicant session token and the application

No auth

Host https://onboard.socialmatterspay.com

A code works for 10 minutes and allows 5 tries.

Request body

Field	Notes
`email` requiredstring	—
`code` requiredstring	pattern `^[0-9]{6}$`

Responses

Status	Meaning
`200`	Session token and application
`400`	Error — error shape and codes
`410`	Error — error shape and codes
`429`	Error — error shape and codes

Fields of `data` (200)

Field Notes

tokenstring The session token to send as a Bearer token on every later call. Valid for 7 days or until signed out. A random URL-safe string.

applicationobject

The application as its applicant sees it. An owner who opened their own emailed link gets a limited view, with only owner_scope, legal_name, that owner and the config; the other fields are for the applicant.

26 child fields

objectstring = "application" —

idstring —

referencestring The application's reference.

statusenum one of draft, submitted, info_requested, approved, declined

owner_scopeboolean = true Present and true only in the limited view an owner gets on their own link.

legal_namestring | null Present only in the limited owner view.

started_byenum Who started the application. one of applicant, partner, agent

info_request_messagestring | null What SMP asked for, while status is info_requested. Null otherwise.

contactobject

4 child fields

`name`string \| null	—
`email`string	—
`phone`string \| null	—
`email_verified`boolean	—

businessobject

12 child fields

legal_namestring | null —

dba_namestring | null —

entity_typeenum one of llc, c_corporation, s_corporation, partnership, nonprofit,

formation_statestring | null Two-letter state code.

formation_datestring | null (date) —

ein_last4string | null The last four digits of the EIN. The full number is never returned.

addressobject

5 child fields

`line1`string \| null	—
`line2`string \| null	—
`city`string \| null	—
`state`string \| null	—
`postal_code`string \| null	—

business_phonestring | null —

website_urlstring | null —

name_differsboolean | null Whether the legal name differs from the name on the website. Null until answered.

terms_page_urlstring | null —

name_link_proofenum The proof that links the legal name to the website name, as worked out from the answers and documents so far. one of not_needed, dba_certificate, terms_page, domain_email_ein_letter,

salesobject

10 child fields

`products_description`string \| null	—
`category`string \| null	A key from config.categories.
`monthly_volume_cents`integer \| null	—
`avg_ticket_cents`integer \| null	—
`max_ticket_cents`integer \| null	—
`refund_policy`string \| null	—
`current_processors`array of string	The processors the business uses today.
`integration_types`array of string	Keys from config.integration_types.
`is_startup`boolean \| null	True when the business has no three months of bank statements yet.
`statement_descriptor`string \| null	—

ownersarray of object

17 child fields

idstring —

full_namestring —

titlestring | null —

ownership_pctnumber Percent owned, 0 to 100, to two decimals.

is_control_personboolean —

is_applicantboolean True for the person marked "This is me".

dobstring (date) —

emailstring | null —

phonestring | null —

addressobject

5 child fields

`line1`string \| null	—
`line2`string \| null	—
`city`string \| null	—
`state`string \| null	—
`postal_code`string \| null	—

ssn_last4string —

id_statusenum one of not_started, pending, verified, failed, manual_review

biometric_consentboolean | null True when the person agreed to the face match, false when they declined, null when unanswered.

consentobject

The release for the face match as it stands.

7 child fields

`can_answer`boolean	Whether this session may answer for the person: the applicant for the owner marked "This is me", or an owner on their own link.
`by`enum	Who gave the answer. one of `applicant`, `owner`,
`at`string \| null (date-time)	—
`version`string \| null	The version of the notice agreed to or declined.
`sentence`string \| null	The release sentence with the person's name, when they agreed.
`sentence_sha256`string \| null	—
`locked`boolean	True once an ID check has run: the answer can no longer be changed here.

invite_sent_atstring | null (date-time) When the person was last emailed their own link.

documentsobject

3 child fields

`id_front`object \| null	The person's current photo of this kind. Null when none has been added.
`id_back`object \| null	The person's current photo of this kind. Null when none has been added.
`selfie`object \| null	The person's current photo of this kind. Null when none has been added.

verificationobject | null

The latest ID check of the person. Null when none has run.

12 child fields

`provider`enum	one of `plaid`, `sandbox`, `manual`
`status`enum	one of `pending`, `verified`, `failed`, `manual_review`
`provider_status`string \| null	Plaid's own status for the session, such as active or success. Null for sandbox and manual checks.
`sandbox`boolean	True when the built-in test provider ran the check.
`checks`object	What was checked and how it came out. No personal data.
`created_at`string (date-time)	—
`completed_at`string \| null (date-time)	—
`attempt`integer	Which Plaid attempt this is, from 1.
`retry_available`boolean	Plaid only: another try is allowed because the last attempt ended without a pass and fewer than the allowed attempts were made.
`attempts_left`integer \| null	Plaid only: attempts remaining. Null for other providers.
`reason`string \| null	Plaid only: why a failed attempt did not pass, in plain words. Null otherwise.
`fell_back`enum	When Plaid could not finish the job and a person at SMP has it, tries (the attempts were used up) or unreachable (the vendor or its setup failed). false otherwise. one of `tries`, `unreachable`, `false`

ownership_attestedboolean Whether the applicant confirmed the list of owners is complete.

documentsarray of object

The business's documents (those that belong to no person).

7 child fields

`id`string	—
`doc_type`string	A key from config.document_types.
`statement_month`string \| null	YYYY-MM, for a bank statement.
`filename`string	—
`content_type`string	—
`size_bytes`integer	—
`uploaded_at`string (date-time)	—

statement_monthsarray of string The months in the accepted window that the bank statements added so far cover, oldest first.

bankobject | null

The payout account. Null until one is connected.

9 child fields

`method`enum	one of `plaid`, `plaid_sandbox`, `manual`
`status`enum	one of `verified`, `name_mismatch`, `manual_review`, `rejected`
`institution_name`string \| null	—
`account_type`enum	one of `checking`, `savings`
`account_last4`string	—
`routing_number`string	The 9-digit routing number of the account.
`holder_name`string	—
`name_match`enum	How the names on the account compared with the business and its owners. one of `match`, `partial`, `mismatch`, `unavailable`
`sandbox`boolean	True when the account is Plaid's test account.

referralobject

5 child fields

`status`enum	one of `none`, `attributed`, `pending_review`, `invalid`, `withheld`, `rejected`
`source`enum	one of `link`, `code`, `partner_portal`, `claim`, `admin`,
`partner_name`string \| null	—
`agent_name`string \| null	—
`claim`string \| null	Who the applicant said referred them, as typed.

integrationobject | null

The one website or app the account will use the API on, its sandbox account and its review. Null until the first page names it.

18 child fields

kindenum one of website, app

domainstring The website's domain, or the domain an app's server uses.

app_namestring | null —

app_platformenum one of ios, android, web, desktop,

app_store_urlstring | null —

app_bundle_idstring | null —

methodenum How the business connects: the API, the WooCommerce plugin, or the hosted checkout and invoices. Only api runs the certification cases. one of api, plugin, hosted

labelstring Where the account is used, such as example.com or "Acme (iOS app) · api.example.com".

sandboxobject | null

The sandbox account. Never carries its key. Null until it is made.

3 child fields

`account_id`string	—
`key_prefix`string \| null	—
`issued_at`string \| null (date-time)	—

statusenum one of building, submitted, changes_requested, approved, switched_off

page_urlstring | null The page submitted for review.

applicant_notesstring | null —

submitted_atstring | null (date-time) —

due_atstring | null (date-time) When the review is answered by: 2 business days after submitting.

placeinteger | null Place in the review line while status is submitted, oldest first. Null otherwise.

decisionobject | null

The review's decision, once there is one (changes requested, approved or switched off).

3 child fields

`status`enum	one of `changes_requested`, `approved`, `switched_off`
`at`string \| null (date-time)	—
`reason`string \| null	—

casesarray of object

The certification cases the method runs. Empty unless method is api.

3 child fields

`id`string	—
`title`string	—
`how`string	How to make the case happen in the sandbox.

page_checksarray of object

What a person looks at on the submitted page.

3 child fields

`id`string	—
`title`string	—
`looks_at`string	—

pricingobject | null

The price a partner proposed. Null when no partner proposed one.

3 child fields

proposedobject

3 child fields

`bps`integer	—
`fixed_cents`integer	—
`cap_cents`integer \| null	—

proposed_textstring —

notestring —

agreementsarray of object

The documents to sign. Empty until a payout bank account is connected.

5 child fields

`key`string	—
`title`string	—
`box`enum	one of `agreements`, `consents`
`version`string	—
`draft`boolean	—

signaturesarray of object

One record per box signed.

4 child fields

idstring —

boxenum one of agreements, consents

submitted_atstring (date-time) —

documentsarray of object

3 child fields

`key`string	—
`title`string	—
`signed_sha256`string	SHA-256 of the signed PDF as stored.

signed_documentsarray of object

5 child fields

`key`string	—
`title`string	—
`box`enum	one of `agreements`, `consents`
`signed_at`string (date-time)	—
`signed_sha256`string	—

submitted_atstring | null (date-time) —

reviewobject | null

The business check while it waits. Null otherwise.

2 child fields

`due_at`string (date-time)	When the check is answered by: 2 business days after submitting.
`place`integer \| null	Place in the review line, oldest first.

problemsarray of object

What still stops the application from being submitted. Empty once it is submitted.

4 child fields

`step`enum	one of `contact`, `business`, `sales`, `owners`, `identity`, `bank`, `documents`, `sign`
`item`integer \| null	1 to 14 for an item of the merchant submission list; null for the rest of the business check.
`field`string	—
`message`string	—

configobject The lists and rules the questionnaire draws its choices from, so the browser hard-codes none of them. Its fields are listed under questionnaireConfig.

Example

Confirm the email with the code: an applicant session

POST /v1/applications/verify

curl -X POST https://onboard.socialmatterspay.com/v1/applications/verify \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "jen31@sunrise31.example",
  "code": "123456"
}'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "token": "applicant_session_token",
    "application": "(the application, as GET /v1/applications/current answers it)"
  }
}

POST /v1/applications/link

Open an emailed link (a partner-started draft, or an owner’s own ID step): spent on first use

No auth

Host https://onboard.socialmatterspay.com

Request body

Field	Notes
`token` requiredstring	—

Responses

Status	Meaning
`200`	Session token and application
`400`	Error — error shape and codes
`410`	Error — error shape and codes

Fields of `data` (200)

Field	Notes
`token`string	The session token to send as a Bearer token on every later call. Valid for 7 days or until signed out. A random URL-safe string.
`application`object	The application as its applicant sees it. An owner who opened their own emailed link gets a limited view, with only owner_scope, legal_name, that owner and the config; the other fields are for the applicant. Its fields are listed under `verifyApplicationEmail · application`.

Example

That owner opens the link: a session for their own ID step only

POST /v1/applications/link

curl -X POST https://onboard.socialmatterspay.com/v1/applications/link \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "one_time_link_token"
}'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "token": "applicant_session_token",
    "application": "(the application, as GET /v1/applications/current answers it)"
  }
}

POST /v1/applications/sign-out

End the applicant session

Applicant session

Host https://onboard.socialmatterspay.com

Responses

Status	Meaning
`200`	Signed out
`401`	Error — error shape and codes

Fields of `data` (200)

Field	Notes
`signed_out`boolean = true	—

Example

Sign out of the questionnaire

POST /v1/applications/sign-out

curl -X POST https://onboard.socialmatterspay.com/v1/applications/sign-out \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "signed_out": true
  }
}

GET /v1/applications/current

The application as the applicant sees it: answers, owners (SSN last 4 only), documents, bank (last 4), ID checks, agreements, signatures, and what is still missing (each problem with its step, its submission-list item and its exact sentence)

Applicant session

Host https://onboard.socialmatterspay.com

Responses

Status	Meaning
`200`	Application
`401`	Error — error shape and codes

Fields of `data` (200)

The same fields as under verifyApplicationEmail · application.

Example

The application so far

GET /v1/applications/current

curl https://onboard.socialmatterspay.com/v1/applications/current \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "object": "application",
    "id": "8f67c6ec-bbf9-4630-bbc3-9c95203955fe",
    "reference": "SMP-B94V-95JT",
    "status": "draft",
    "started_by": "applicant",
    "info_request_message": null,
    "contact": {
      "name": "Jennifer Thompson",
      "email": "jen31@sunrise31.example",
      "phone": "+13055550123",
      "email_verified": true
    },
    "business": {
      "legal_name": "Sunrise Wellness LLC",
      "dba_name": "Sunrise",
      "entity_type": "llc",
      "formation_state": "FL",
      "formation_date": "2019-04-02",
      "ein_last4": "0031",
      "address": {
        "line1": "1 Main St",
        "line2": "Suite 200",
        "city": "Tampa",
        "state": "FL",
        "postal_code": "33602"
      },
      "business_phone": null,
      "website_url": "https://sunrise31.example",
      "name_differs": true,
      "terms_page_url": null,
      "name_link_proof": null
    },
    "sales": {
      "products_description": "Yoga mats and studio gear",
      "category": "retail",
      "monthly_volume_cents": 2500000,
      "avg_ticket_cents": 8500,
      "max_ticket_cents": 60000,
      "refund_policy": "30 days, unused items",
      "current_processors": [
        "Stripe"
      ],
      "integration_types": [
        "woocommerce",
        "shopify"
      ],
      "is_startup": false,
      "statement_descriptor": "SUNRISE"
    },
    "owners": [],
    "ownership_attested": false,
    "documents": [],
    "statement_months": [],
    "bank": null,
    "referral": {
      "status": "none",
      "source": null,
      "partner_name": null,
      "agent_name": null,
      "claim": null
    },
    "integration": {
      "kind": "website",
      "domain": "sunrise31.example",
      "app_name": null,
      "app_platform": null,
      "app_store_url": null,
      "app_bundle_id": null,
      "method": "api",
      "label": "sunrise31.example",
      "sandbox": {
        "account_id": "4cad9448-209c-48b5-9a1f-95c8585a2db7",
        "key_prefix": "sk_sandbox_2ca1",
        "issued_at": "2026-10-28T00:23:30.468Z"
      },
      "status": "building",
      "page_url": null,
      "applicant_notes": null,
      "submitted_at": null,
      "due_at": null,
      "place": null,
      "decision": null,
      "cases": [
        {
          "id": "bank_linked",
          "title": "Link a bank",
          "how": "Link a payer’s bank with the sandbox bank link (any test bank)."
        },
        {
          "id": "payment_settled",
          "title": "A payment that settles",
          "how": "Make a WEB payment that carries the authorization words’ SHA-256, then move the sandbox clock until it settles."
        },
        … 7 more
      ],
      "page_checks": [
        {
          "id": "payer_name",
          "title": "The payer",
          "looks_at": "asks for the payer’s real name; no placeholder"
        },
        {
          "id": "authorization",
          "title": "The authorization",
          "looks_at": "SMP’s authorization words in full before the button, and a tick box that unlocks the button"
        },
        … 4 more
      ]
    },
    "pricing": null,
    "agreements": [],
    "signatures": [],
    "signed_documents": [],
    "submitted_at": null,
    "review": null,
    "problems": [
      {
        "step": "owners",
        "item": 7,
        "field": "owners",
        "message": "Add every owner of 25% or more, and one control person."
      },
      {
        "step": "bank",
        "item": 11,
        "field": "bank",
        "message": "Connect your payout bank account, or upload a voided check, a bank letter or a bank document with your account details."
      },
      … 4 more
    ],
    "config": {
      "entity_types": {
        "llc": "LLC",
        "c_corporation": "Corporation (C corp)",
        "s_corporation": "S corporation",
        "partnership": "Partnership (LP, LLP or general)",
        "nonprofit": "Nonprofit corporation"
      },
      "categories": [
        {
          "key": "b2b_supplies",
          "label": "Wholesale and business supplies",
          "group": "Business to business",
          "bank_approval_required": false
        },
        {
          "key": "professional_services",
          "label": "Professional services (accounting, legal, consulting, advisory)",
          "group": "Business to business",
          "bank_approval_required": false
        },
        … 14 more
      ],
      "prohibited": [
        "GLP-1 receptor agonists",
        "Controlled substances",
        … 2 more
      ],
      "integration_types": {
        "woocommerce": {
          "label": "WooCommerce",
          "note": "Our plugin for WordPress stores"
        },
        "api": {
          "label": "Direct API",
          "note": "Open to any approved merchant, no volume minimum"
        },
        "shopify": {
          "label": "Shopify",
          "note": "App pending Shopify’s approval"
        },
        "checkout": {
          "label": "Checkout on your own site",
          "note": "smp.js and hosted checkout"
        },
        "invoices": {
          "label": "Invoices",
          "note": "Bill customers by email, each invoice with its own account number"
        },
        "not_sure": {
          "label": "Not sure yet",
          "note": "We’ll help you choose"
        }
      },
      "document_types": {
        "id_front": "Government ID, front",
        "id_back": "Government ID, back",
        "selfie": "Selfie",
        "ein_letter": "IRS EIN letter (CP 575 or 147C)",
        "articles": "State registration (Articles of Organization or Incorporation)",
        "dba_certificate": "DBA certificate",
        "terms_page": "Website terms page",
        "bank_statement": "Bank statement",
        "voided_check": "Voided check",
        "bank_letter": "Bank letter",
        "account_document": "Bank document showing the business name, account and routing number",
        "other": "Other document"
      },
      "name_link_proofs": {
        "not_needed": "The legal name is the name on the website",
        "dba_certificate": "DBA (assumed or fictitious name) certificate",
        "terms_page": "The website’s terms page shows the legal name",
        "domain_email_ein_letter": "Verified email on the website’s domain + the IRS EIN letter"
      },
      "states": [
        "AL",
        "AK",
        … 54 more
      ],
      "statement_window": [
        "2026-10",
        "2026-09",
        … 3 more
      ],
      "biometric_consent": {
        "version": "biometric-notice-0.1-draft-2026-10-25",
        "draft_stamp": "DRAFT — not reviewed by counsel. Not in force. Social Matter Payments LLC · version 0.1 · 2026-10-25.",
        "sections": [
          {
            "heading": "1. When this applies",
            "text": "(1 paragraphs, shown in full on the page)"
          },
          {
            "heading": "2. What is collected and stored",
            "text": "(2 paragraphs, shown in full on the page)"
          },
          … 5 more
        ],
        "text": "I have read SMP's Biometric Notice. I consent to Social Matter Payments LLC and its identity-verification provider collecting, storing and using a scan of my face geometry from my selfie and my ID photo, only to verify my identity for this application, and to its destruction on the schedule in that notice. I sign this release electronically as [full legal name].",
        "name_blank": "[full legal name]",
        "notice_sha256": "24ff3e9daef75afb0c5635761d6b4392dfe3af3306b4f1f00f04c7c02f0fe6eb"
      },
      "id_attempts": 3,
      "bank_mode": "sandbox",
      "idv_mode": "sandbox",
      "sandbox": true
    }
  }
}

PATCH /v1/applications/current

Save one section (contact, business, sales, owners); with complete: true every required field of the section is checked

Applicant session

Host https://onboard.socialmatterspay.com

Every invalid field is reported at once: errors: [{ field, message }]. The EIN is sealed at once and its duplicate-check key taken.

Request body

Field	Notes
`section` requiredenum	one of `contact`, `business`, `sales`, `owners`
`complete`boolean	—
`legal_name`string	—
`dba_name`string	—
`entity_type`enum	one of `llc`, `c_corporation`, `s_corporation`, `partnership`, `nonprofit`
`formation_state`string	—
`formation_date`string (date)	—
`ein`string	—
`website_url`string	—
`name_differs`boolean	—
`terms_page_url`string	—
`products_description`string	—
`category`string	—
`monthly_volume_cents`integer	—
`avg_ticket_cents`integer	—
`max_ticket_cents`integer	—
`refund_policy`string	—
`current_processors`array of string	—
`integration_types`array of enum	one of `woocommerce`, `api`, `shopify`, `checkout`, `invoices`, `not_sure`
`is_startup`boolean	—
`statement_descriptor`string	—
`ownership_attested`boolean	—

Responses

Status	Meaning
`200`	Application
`400`	Error — error shape and codes
`401`	Error — error shape and codes
`409`	Error — error shape and codes

Fields of `data` (200)

The same fields as under verifyApplicationEmail · application.

Example

Save a page (the business)

PATCH /v1/applications/current

curl -X PATCH https://onboard.socialmatterspay.com/v1/applications/current \
  -H 'Authorization: Bearer applicant_session_token' \
  -H 'Content-Type: application/json' \
  -d '{
  "section": "business",
  "integration_kind": "website",
  "integration_domain": "sunrise31.example",
  "legal_name": "Sunrise Wellness LLC",
  "dba_name": "Sunrise",
  "entity_type": "llc",
  "formation_state": "FL",
  "formation_date": "2019-04-02",
  "ein": "12-4000031",
  "business_line1": "1 Main St",
  "business_line2": "Suite 200",
  "business_city": "Tampa",
  "business_state": "FL",
  "business_postal_code": "33602",
  "website_url": "https://sunrise31.example",
  "name_differs": true
}'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "object": "application",
    "id": "8f67c6ec-bbf9-4630-bbc3-9c95203955fe",
    "reference": "SMP-B94V-95JT",
    "status": "draft",
    "started_by": "applicant",
    "info_request_message": null,
    "contact": {
      "name": "Jennifer Thompson",
      "email": "jen31@sunrise31.example",
      "phone": "+13055550123",
      "email_verified": true
    },
    "business": {
      "legal_name": "Sunrise Wellness LLC",
      "dba_name": "Sunrise",
      "entity_type": "llc",
      "formation_state": "FL",
      "formation_date": "2019-04-02",
      "ein_last4": "0031",
      "address": {
        "line1": "1 Main St",
        "line2": "Suite 200",
        "city": "Tampa",
        "state": "FL",
        "postal_code": "33602"
      },
      "business_phone": null,
      "website_url": "https://sunrise31.example",
      "name_differs": true,
      "terms_page_url": null,
      "name_link_proof": null
    },
    "sales": {
      "products_description": null,
      "category": null,
      "monthly_volume_cents": null,
      "avg_ticket_cents": null,
      "max_ticket_cents": null,
      "refund_policy": null,
      "current_processors": null,
      "integration_types": null,
      "is_startup": null,
      "statement_descriptor": null
    },
    "owners": [],
    "ownership_attested": false,
    "documents": [],
    "statement_months": [],
    "bank": null,
    "referral": {
      "status": "none",
      "source": null,
      "partner_name": null,
      "agent_name": null,
      "claim": null
    },
    "integration": {
      "kind": "website",
      "domain": "sunrise31.example",
      "app_name": null,
      "app_platform": null,
      "app_store_url": null,
      "app_bundle_id": null,
      "method": "api",
      "label": "sunrise31.example",
      "sandbox": null,
      "status": "building",
      "page_url": null,
      "applicant_notes": null,
      "submitted_at": null,
      "due_at": null,
      "place": null,
      "decision": null,
      "cases": [
        {
          "id": "bank_linked",
          "title": "Link a bank",
          "how": "Link a payer’s bank with the sandbox bank link (any test bank)."
        },
        {
          "id": "payment_settled",
          "title": "A payment that settles",
          "how": "Make a WEB payment that carries the authorization words’ SHA-256, then move the sandbox clock until it settles."
        },
        … 7 more
      ],
      "page_checks": [
        {
          "id": "payer_name",
          "title": "The payer",
          "looks_at": "asks for the payer’s real name; no placeholder"
        },
        {
          "id": "authorization",
          "title": "The authorization",
          "looks_at": "SMP’s authorization words in full before the button, and a tick box that unlocks the button"
        },
        … 4 more
      ]
    },
    "pricing": null,
    "agreements": [],
    "signatures": [],
    "signed_documents": [],
    "submitted_at": null,
    "review": null,
    "problems": [
      {
        "step": "sales",
        "item": null,
        "field": "products_description",
        "message": "Describe what you sell."
      },
      {
        "step": "sales",
        "item": null,
        "field": "category",
        "message": "Choose the category that best fits what you sell."
      },
      … 13 more
    ],
    "config": "(the questionnaire's settings, as GET /v1/applications/config answers them)"
  }
}

Redirects to the questionnaire (/apply/)

Responses

Redirects to /apply/

Responses

The questionnaire page and its files

Responses

The lists the questionnaire offers: entity types, categories (and what SMP can’t accept), integrations, document types, states, the statement window, the biometric notice, and which bank and ID modes are live

Responses

Fields of data (200)

Start (or resume) an application: email and phone, then a 6-digit code goes to the email

Request body

Responses

Fields of data (201)

Prove the email with its code; returns the applicant session token and the application

Request body

Responses

Fields of data (200)

Open an emailed link (a partner-started draft, or an owner’s own ID step): spent on first use

Request body

Responses

Fields of data (200)

End the applicant session

Responses

Fields of data (200)

The application as the applicant sees it: answers, owners (SSN last 4 only), documents, bank (last 4), ID checks, agreements, signatures, and what is still missing (each problem with its step, its submission-list item and its exact sentence)

Responses

Fields of data (200)

Save one section (contact, business, sales, owners); with complete: true every required field of the section is checked

Request body

Responses

Fields of data (200)

Fields of `data` (200)

Fields of `data` (201)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (200)