Questionnaire: identity and signing · Social Matter Payments API

POST /v1/applications/current/owners/{ownerId}/biometric-consent

The person’s own release for the face match: agree (SMP’s notice, its version, SHA-256 and the release sentence with their name recorded), decline (a person then reviews the ID photos) or withdraw before any check has run

Applicant session

Host https://onboard.socialmatterspay.com

One release per individual, given by that individual: the applicant answers for the owner marked “This is me”, every other owner through their own emailed link; anyone else’s answer is refused with 403 consent_is_personal. Recorded per §5.3: the name, the notice version and the SHA-256 of the notice and of the release sentence, the time, IP address and browser, and which session gave it. After an ID check has run the answer is locked (409 consent_locked). A selfie taken on a release that is declined or withdrawn is set aside.

Parameters

Field	Notes
`ownerId` requiredpath · string	—

Request body

Field	Notes
`consent` requiredboolean \| null	true: agree · false: decline · null: withdraw (before any check)
`version`string	The notice version shown (config.biometric_consent.version); required when consent is true

Responses

Status	Meaning
`200`	Application
`400`	Error — error shape and codes
`401`	Error — error shape and codes
`403`	Error — error shape and codes
`404`	Error — error shape and codes
`409`	Error — error shape and codes

Fields of `data` (200)

Field Notes

objectstring = "application" —

idstring —

referencestring The application's reference.

statusenum one of draft, submitted, info_requested, approved, declined

owner_scopeboolean = true Present and true only in the limited view an owner gets on their own link.

legal_namestring | null Present only in the limited owner view.

started_byenum Who started the application. one of applicant, partner, agent

info_request_messagestring | null What SMP asked for, while status is info_requested. Null otherwise.

contactobject

4 child fields

`name`string \| null	—
`email`string	—
`phone`string \| null	—
`email_verified`boolean	—

businessobject

12 child fields

legal_namestring | null —

dba_namestring | null —

entity_typeenum one of llc, c_corporation, s_corporation, partnership, nonprofit,

formation_statestring | null Two-letter state code.

formation_datestring | null (date) —

ein_last4string | null The last four digits of the EIN. The full number is never returned.

addressobject

5 child fields

`line1`string \| null	—
`line2`string \| null	—
`city`string \| null	—
`state`string \| null	—
`postal_code`string \| null	—

business_phonestring | null —

website_urlstring | null —

name_differsboolean | null Whether the legal name differs from the name on the website. Null until answered.

terms_page_urlstring | null —

name_link_proofenum The proof that links the legal name to the website name, as worked out from the answers and documents so far. one of not_needed, dba_certificate, terms_page, domain_email_ein_letter,

salesobject

10 child fields

`products_description`string \| null	—
`category`string \| null	A key from config.categories.
`monthly_volume_cents`integer \| null	—
`avg_ticket_cents`integer \| null	—
`max_ticket_cents`integer \| null	—
`refund_policy`string \| null	—
`current_processors`array of string	The processors the business uses today.
`integration_types`array of string	Keys from config.integration_types.
`is_startup`boolean \| null	True when the business has no three months of bank statements yet.
`statement_descriptor`string \| null	—

ownersarray of object

17 child fields

idstring —

full_namestring —

titlestring | null —

ownership_pctnumber Percent owned, 0 to 100, to two decimals.

is_control_personboolean —

is_applicantboolean True for the person marked "This is me".

dobstring (date) —

emailstring | null —

phonestring | null —

addressobject

5 child fields

`line1`string \| null	—
`line2`string \| null	—
`city`string \| null	—
`state`string \| null	—
`postal_code`string \| null	—

ssn_last4string —

id_statusenum one of not_started, pending, verified, failed, manual_review

biometric_consentboolean | null True when the person agreed to the face match, false when they declined, null when unanswered.

consentobject

The release for the face match as it stands.

7 child fields

`can_answer`boolean	Whether this session may answer for the person: the applicant for the owner marked "This is me", or an owner on their own link.
`by`enum	Who gave the answer. one of `applicant`, `owner`,
`at`string \| null (date-time)	—
`version`string \| null	The version of the notice agreed to or declined.
`sentence`string \| null	The release sentence with the person's name, when they agreed.
`sentence_sha256`string \| null	—
`locked`boolean	True once an ID check has run: the answer can no longer be changed here.

invite_sent_atstring | null (date-time) When the person was last emailed their own link.

documentsobject

3 child fields

id_frontobject | null

The person's current photo of this kind. Null when none has been added.

6 child fields

`id`string	—
`filename`string	—
`content_type`string	—
`size_bytes`integer	—
`source`enum	upload is a file the person chose, camera a photo taken in the questionnaire, provider a photo copied from the ID verification provider. one of `upload`, `camera`, `provider`
`uploaded_at`string (date-time)	—

id_backobject | null

The person's current photo of this kind. Null when none has been added.

6 child fields

`id`string	—
`filename`string	—
`content_type`string	—
`size_bytes`integer	—
`source`enum	upload is a file the person chose, camera a photo taken in the questionnaire, provider a photo copied from the ID verification provider. one of `upload`, `camera`, `provider`
`uploaded_at`string (date-time)	—

selfieobject | null

The person's current photo of this kind. Null when none has been added.

6 child fields

`id`string	—
`filename`string	—
`content_type`string	—
`size_bytes`integer	—
`source`enum	upload is a file the person chose, camera a photo taken in the questionnaire, provider a photo copied from the ID verification provider. one of `upload`, `camera`, `provider`
`uploaded_at`string (date-time)	—

verificationobject | null

The latest ID check of the person. Null when none has run.

12 child fields

providerenum one of plaid, sandbox, manual

statusenum one of pending, verified, failed, manual_review

provider_statusstring | null Plaid's own status for the session, such as active or success. Null for sandbox and manual checks.

sandboxboolean True when the built-in test provider ran the check.

checksobject

What was checked and how it came out. No personal data.

2 child fields

`sandbox`boolean	—
`checks`array of object	—

created_atstring (date-time) —

completed_atstring | null (date-time) —

attemptinteger Which Plaid attempt this is, from 1.

retry_availableboolean Plaid only: another try is allowed because the last attempt ended without a pass and fewer than the allowed attempts were made.

attempts_leftinteger | null Plaid only: attempts remaining. Null for other providers.

reasonstring | null Plaid only: why a failed attempt did not pass, in plain words. Null otherwise.

fell_backenum When Plaid could not finish the job and a person at SMP has it, tries (the attempts were used up) or unreachable (the vendor or its setup failed). false otherwise. one of tries, unreachable, false

ownership_attestedboolean Whether the applicant confirmed the list of owners is complete.

documentsarray of object

The business's documents (those that belong to no person).

7 child fields

`id`string	—
`doc_type`string	A key from config.document_types.
`statement_month`string \| null	YYYY-MM, for a bank statement.
`filename`string	—
`content_type`string	—
`size_bytes`integer	—
`uploaded_at`string (date-time)	—

statement_monthsarray of string The months in the accepted window that the bank statements added so far cover, oldest first.

bankobject | null

The payout account. Null until one is connected.

9 child fields

`method`enum	one of `plaid`, `plaid_sandbox`, `manual`
`status`enum	one of `verified`, `name_mismatch`, `manual_review`, `rejected`
`institution_name`string \| null	—
`account_type`enum	one of `checking`, `savings`
`account_last4`string	—
`routing_number`string	The 9-digit routing number of the account.
`holder_name`string	—
`name_match`enum	How the names on the account compared with the business and its owners. one of `match`, `partial`, `mismatch`, `unavailable`
`sandbox`boolean	True when the account is Plaid's test account.

referralobject

5 child fields

`status`enum	one of `none`, `attributed`, `pending_review`, `invalid`, `withheld`, `rejected`
`source`enum	one of `link`, `code`, `partner_portal`, `claim`, `admin`,
`partner_name`string \| null	—
`agent_name`string \| null	—
`claim`string \| null	Who the applicant said referred them, as typed.

integrationobject | null

The one website or app the account will use the API on, its sandbox account and its review. Null until the first page names it.

18 child fields

kindenum one of website, app

domainstring The website's domain, or the domain an app's server uses.

app_namestring | null —

app_platformenum one of ios, android, web, desktop,

app_store_urlstring | null —

app_bundle_idstring | null —

methodenum How the business connects: the API, the WooCommerce plugin, or the hosted checkout and invoices. Only api runs the certification cases. one of api, plugin, hosted

labelstring Where the account is used, such as example.com or "Acme (iOS app) · api.example.com".

sandboxobject | null

The sandbox account. Never carries its key. Null until it is made.

3 child fields

`account_id`string	—
`key_prefix`string \| null	—
`issued_at`string \| null (date-time)	—

statusenum one of building, submitted, changes_requested, approved, switched_off

page_urlstring | null The page submitted for review.

applicant_notesstring | null —

submitted_atstring | null (date-time) —

due_atstring | null (date-time) When the review is answered by: 2 business days after submitting.

placeinteger | null Place in the review line while status is submitted, oldest first. Null otherwise.

decisionobject | null

The review's decision, once there is one (changes requested, approved or switched off).

3 child fields

`status`enum	one of `changes_requested`, `approved`, `switched_off`
`at`string \| null (date-time)	—
`reason`string \| null	—

casesarray of object

The certification cases the method runs. Empty unless method is api.

3 child fields

`id`string	—
`title`string	—
`how`string	How to make the case happen in the sandbox.

page_checksarray of object

What a person looks at on the submitted page.

3 child fields

`id`string	—
`title`string	—
`looks_at`string	—

pricingobject | null

The price a partner proposed. Null when no partner proposed one.

3 child fields

proposedobject

3 child fields

`bps`integer	—
`fixed_cents`integer	—
`cap_cents`integer \| null	—

proposed_textstring —

notestring —

agreementsarray of object

The documents to sign. Empty until a payout bank account is connected.

5 child fields

`key`string	—
`title`string	—
`box`enum	one of `agreements`, `consents`
`version`string	—
`draft`boolean	—

signaturesarray of object

One record per box signed.

4 child fields

idstring —

boxenum one of agreements, consents

submitted_atstring (date-time) —

documentsarray of object

3 child fields

`key`string	—
`title`string	—
`signed_sha256`string	SHA-256 of the signed PDF as stored.

signed_documentsarray of object

5 child fields

`key`string	—
`title`string	—
`box`enum	one of `agreements`, `consents`
`signed_at`string (date-time)	—
`signed_sha256`string	—

submitted_atstring | null (date-time) —

reviewobject | null

The business check while it waits. Null otherwise.

2 child fields

`due_at`string (date-time)	When the check is answered by: 2 business days after submitting.
`place`integer \| null	Place in the review line, oldest first.

problemsarray of object

What still stops the application from being submitted. Empty once it is submitted.

4 child fields

`step`enum	one of `contact`, `business`, `sales`, `owners`, `identity`, `bank`, `documents`, `sign`
`item`integer \| null	1 to 14 for an item of the merchant submission list; null for the rest of the business check.
`field`string	—
`message`string	—

configobject

The lists and rules the questionnaire draws its choices from, so the browser hard-codes none of them.

13 child fields

entity_typesobject

Business types, each key mapped to the label shown for it.

5 child fields

`llc`string	—
`c_corporation`string	—
`s_corporation`string	—
`partnership`string	—
`nonprofit`string	—

categoriesarray of object

4 child fields

`key`string	The value to send as the category.
`label`string	—
`group`enum	one of `Business to business`, `Consumer`, `Only with a bank’s written approval`
`bank_approval_required`boolean	True when no merchant in the category goes live until a bank has approved the category in writing.

prohibitedarray of string Kinds of business that are never accepted. Shown on the questionnaire, not selectable.

integration_typesobject

The ways to connect, each key mapped to its label and a note.

6 child fields

woocommerceobject

2 child fields

`label`string	—
`note`string	—

apiobject

2 child fields

`label`string	—
`note`string	—

shopifyobject

2 child fields

`label`string	—
`note`string	—

checkoutobject

2 child fields

`label`string	—
`note`string	—

invoicesobject

2 child fields

`label`string	—
`note`string	—

not_sureobject

2 child fields

`label`string	—
`note`string	—

document_typesobject

The document types an upload can carry, each key mapped to the label shown for it.

12 child fields

`id_front`string	—
`id_back`string	—
`selfie`string	—
`ein_letter`string	—
`articles`string	—
`dba_certificate`string	—
`terms_page`string	—
`bank_statement`string	—
`voided_check`string	—
`bank_letter`string	—
`account_document`string	—
`other`string	—

name_link_proofsobject

The proofs that link the legal name to a different name on the website, each key mapped to its label.

4 child fields

`not_needed`string	—
`dba_certificate`string	—
`terms_page`string	—
`domain_email_ein_letter`string	—

statesarray of string Two-letter codes of the US states and territories the questionnaire accepts.

statement_windowarray of string The five months (YYYY-MM, this month first) a bank statement may cover.

biometric_consentobject

The biometric notice and the release for the face match, word for word. The person's name goes in the blank of the release.

6 child fields

versionstring Send this as version when agreeing; a changed notice is refused.

draft_stampstring The draft notice stamped on the document while counsel has not approved it.

sectionsarray of object

4 child fields

`heading`string	—
`paragraphs`array of string	The section's paragraphs, when it has any.
`bullets`array of string	The section's bullet points, when it has any.
`text`string	Appears only in the documentation's captured examples, where it stands in for paragraphs and bullets. The live answer carries paragraphs and bullets and no text.

textstring The release sentence, with name_blank where the person's full legal name goes.

name_blankstring The placeholder in text that the person's name replaces.

notice_sha256string SHA-256 of the notice as it stands, stored with every answer.

id_attemptsinteger How many automatic ID check attempts a person gets before a person at SMP takes over.

bank_modeenum How the payout account is proved here. plaid with Plaid keys, sandbox with Plaid's test account outside production, document_only with a voided check, bank letter or bank document. one of plaid, sandbox, document_only

idv_modeenum Who checks the owners' IDs. plaid is Plaid Identity Verification, sandbox is the built-in test provider, manual is a person at SMP. one of plaid, sandbox, manual

sandboxboolean True outside production.

Example

An owner's own release for the face match

POST /v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/biometric-consent

curl -X POST https://onboard.socialmatterspay.com/v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/biometric-consent \
  -H 'CF-Connecting-IP: 203.0.113.7' \
  -H 'User-Agent: e2e applicant browser' \
  -H 'Authorization: Bearer applicant_session_token' \
  -H 'Content-Type: application/json' \
  -d '{
  "consent": true,
  "version": "biometric-notice-0.1-draft-2026-10-25"
}'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "object": "application",
    "id": "8f67c6ec-bbf9-4630-bbc3-9c95203955fe",
    "reference": "SMP-B94V-95JT",
    "status": "draft",
    "started_by": "applicant",
    "info_request_message": null,
    "contact": {
      "name": "Jennifer Thompson",
      "email": "jen31@sunrise31.example",
      "phone": "+13055550123",
      "email_verified": true
    },
    "business": {
      "legal_name": "Sunrise Wellness LLC",
      "dba_name": "Sunrise",
      "entity_type": "llc",
      "formation_state": "FL",
      "formation_date": "2019-04-02",
      "ein_last4": "0031",
      "address": {
        "line1": "1 Main St",
        "line2": "Suite 200",
        "city": "Tampa",
        "state": "FL",
        "postal_code": "33602"
      },
      "business_phone": null,
      "website_url": "https://sunrise31.example",
      "name_differs": true,
      "terms_page_url": null,
      "name_link_proof": "dba_certificate"
    },
    "sales": {
      "products_description": "Yoga mats and studio gear",
      "category": "retail",
      "monthly_volume_cents": 2500000,
      "avg_ticket_cents": 8500,
      "max_ticket_cents": 60000,
      "refund_policy": "30 days, unused items",
      "current_processors": [
        "Stripe"
      ],
      "integration_types": [
        "woocommerce",
        "shopify"
      ],
      "is_startup": false,
      "statement_descriptor": "SUNRISE"
    },
    "owners": [
      {
        "id": "937483ec-19aa-4b69-9293-fb067752edf8",
        "full_name": "Jennifer Thompson",
        "title": "Managing Member",
        "ownership_pct": 60,
        "is_control_person": true,
        "is_applicant": true,
        "dob": "1980-01-01",
        "email": "jen31@sunrise31.example",
        "phone": null,
        "address": {
          "line1": "9 Bay Rd",
          "line2": null,
          "city": "Tampa",
          "state": "FL",
          "postal_code": "33606"
        },
        "ssn_last4": "1031",
        "id_status": "not_started",
        "biometric_consent": true,
        "consent": {
          "can_answer": true,
          "by": "applicant",
          "at": "2026-10-28T00:23:30.542Z",
          "version": "biometric-notice-0.1-draft-2026-10-25",
          "sentence": "I have read SMP's Biometric Notice. I consent to Social Matter Payments LLC and its identity-verification provider collecting, storing and using a scan of my face geometry from my selfie and my ID photo, only to verify my identity for this application, and to its destruction on the schedule in that notice. I sign this release electronically as Jennifer Thompson.",
          "sentence_sha256": "cc28518cd8c709a6187e7c7038497f9931898501b3d049737ed65637575e9666",
          "locked": false
        },
        "invite_sent_at": null,
        "documents": {
          "id_front": null,
          "id_back": null,
          "selfie": null
        },
        "verification": null
      },
      {
        "id": "7ef70922-1eea-4cef-8b4f-b732c2ffe370",
        "full_name": "Marcus Lee",
        "title": "Member",
        "ownership_pct": 40,
        "is_control_person": false,
        "is_applicant": false,
        "dob": "1982-03-04",
        "email": "marcus31@sunrise31.example",
        "phone": null,
        "address": {
          "line1": "9 Bay Rd",
          "line2": null,
          "city": "Tampa",
          "state": "FL",
          "postal_code": "33606"
        },
        "ssn_last4": "2031",
        "id_status": "not_started",
        "biometric_consent": null,
        "consent": {
          "can_answer": false,
          "by": null,
          "at": null,
          "version": null,
          "sentence": null,
          "sentence_sha256": null,
          "locked": false
        },
        "invite_sent_at": null,
        "documents": {
          "id_front": null,
          "id_back": null,
          "selfie": null
        },
        "verification": null
      }
    ],
    "ownership_attested": true,
    "documents": [
      {
        "id": "632da260-a3b9-4f3c-a97e-a214a6b66845",
        "doc_type": "ein_letter",
        "statement_month": null,
        "filename": "ein_letter.pdf",
        "content_type": "application/pdf",
        "size_bytes": 33,
        "uploaded_at": "2026-10-28T00:23:30.509Z"
      },
      {
        "id": "b235a72b-a193-42e9-b28e-cc9353e9e46b",
        "doc_type": "articles",
        "statement_month": null,
        "filename": "articles.pdf",
        "content_type": "application/pdf",
        "size_bytes": 39,
        "uploaded_at": "2026-10-28T00:23:30.516Z"
      },
      … 4 more
    ],
    "statement_months": [
      "2026-07",
      "2026-08",
      "2026-09"
    ],
    "bank": null,
    "referral": {
      "status": "none",
      "source": null,
      "partner_name": null,
      "agent_name": null,
      "claim": null
    },
    "integration": {
      "kind": "website",
      "domain": "sunrise31.example",
      "app_name": null,
      "app_platform": null,
      "app_store_url": null,
      "app_bundle_id": null,
      "method": "api",
      "label": "sunrise31.example",
      "sandbox": {
        "account_id": "4cad9448-209c-48b5-9a1f-95c8585a2db7",
        "key_prefix": "sk_sandbox_2ca1",
        "issued_at": "2026-10-28T00:23:30.468Z"
      },
      "status": "building",
      "page_url": null,
      "applicant_notes": null,
      "submitted_at": null,
      "due_at": null,
      "place": null,
      "decision": null,
      "cases": [
        {
          "id": "bank_linked",
          "title": "Link a bank",
          "how": "Link a payer’s bank with the sandbox bank link (any test bank)."
        },
        {
          "id": "payment_settled",
          "title": "A payment that settles",
          "how": "Make a WEB payment that carries the authorization words’ SHA-256, then move the sandbox clock until it settles."
        },
        … 7 more
      ],
      "page_checks": [
        {
          "id": "payer_name",
          "title": "The payer",
          "looks_at": "asks for the payer’s real name; no placeholder"
        },
        {
          "id": "authorization",
          "title": "The authorization",
          "looks_at": "SMP’s authorization words in full before the button, and a tick box that unlocks the button"
        },
        … 4 more
      ]
    },
    "pricing": null,
    "agreements": [],
    "signatures": [],
    "signed_documents": [],
    "submitted_at": null,
    "review": null,
    "problems": [
      {
        "step": "identity",
        "item": 9,
        "field": "owner:937483ec-19aa-4b69-9293-fb067752edf8:id_front",
        "message": "Add a photo of the front of Jennifer Thompson’s ID."
      },
      {
        "step": "identity",
        "item": 9,
        "field": "owner:937483ec-19aa-4b69-9293-fb067752edf8:id_back",
        "message": "Add a photo of the back of Jennifer Thompson’s ID."
      },
      … 4 more
    ],
    "config": "(the questionnaire's settings, as GET /v1/applications/config answers them)"
  }
}

POST /v1/applications/current/owners/{ownerId}/verify

Check this person’s ID: Plaid Identity Verification (returns its hosted link), the built-in sandbox check, or a person (no vendor, Plaid unreachable, three tries used, the face match declined, or an owner who has not answered)

Applicant session

Host https://onboard.socialmatterspay.com

Plaid opens only for a person who agreed to the face match. An attempt that ended without a pass (failed, expired or canceled) is started again with {"retry": true} (Plaid’s /identity_verification/retry, strategy reset); three attempts are allowed, then a person at SMP reviews. Plaid not answering (a refused connection, a 5xx or a 429) is never a pass: the person goes to review and the reason is recorded.

Parameters

Field	Notes
`ownerId` requiredpath · string	—

Request body

Field	Notes
`retry`boolean	Start another Plaid attempt after one that ended without a pass

Responses

Status	Meaning
`200`	mode: hosted (with url, Plaid’s link), captured (the built-in check ran), manual_fallback (with message), ended (with retry_available, attempts_used, attempts_left) or done; and the application
`400`	Error — error shape and codes
`401`	Error — error shape and codes
`403`	Error — error shape and codes
`404`	Error — error shape and codes
`409`	Error — error shape and codes

Fields of `data` (200)

Field	Notes
`mode`enum	captured: the photos were checked here. hosted: continue at url. done: Plaid already has the result. ended: the Plaid attempt ended without a pass. manual_fallback: Plaid could not do it and a person at SMP reviews the photos. one of `captured`, `hosted`, `done`, `ended`, `manual_fallback`
`provider`string = "plaid"	Only when mode is hosted.
`url`string	Plaid's hosted ID and selfie flow for the person. Only when mode is hosted.
`message`string	Only when mode is manual_fallback: why, and to add photos of the ID.
`retry_available`boolean	Only when mode is ended or done after a Plaid attempt: whether another try is allowed.
`attempts_used`integer	Only when mode is ended or done after a Plaid attempt.
`attempts_left`integer	Only when mode is ended or done after a Plaid attempt.
`application`object	The application as its applicant sees it. An owner who opened their own emailed link gets a limited view, with only owner_scope, legal_name, that owner and the config; the other fields are for the applicant. Its fields are listed under `answerBiometricConsent`.

Example

Check an owner's ID and selfie

POST /v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/verify

curl -X POST https://onboard.socialmatterspay.com/v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/verify \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "mode": "captured",
    "application": "(the application, as GET /v1/applications/current answers it)"
  }
}

GET /v1/applications/current/owners/{ownerId}/verification

This person’s latest ID check, read again from Plaid while its session is open (Plaid not answering sends the person to review: mode manual_fallback)

Applicant session

Host https://onboard.socialmatterspay.com

Parameters

Field	Notes
`ownerId` requiredpath · string	—

Responses

Status	Meaning
`200`	url (the hosted link, if still open), mode (open, manual_fallback or null) and the application
`401`	Error — error shape and codes
`403`	Error — error shape and codes
`404`	Error — error shape and codes

Fields of `data` (200)

Field	Notes
`url`string \| null	Plaid's hosted flow, while a session is open. Null otherwise.
`mode`enum	open while a Plaid session is waiting on the person; manual_fallback when Plaid could not be read and a person at SMP takes over; null when no Plaid session is waiting. one of `open`, `manual_fallback`,
`message`string	Only when mode is manual_fallback.
`application`object	The application as its applicant sees it. An owner who opened their own emailed link gets a limited view, with only owner_scope, legal_name, that owner and the config; the other fields are for the applicant. Its fields are listed under `answerBiometricConsent`.

Example

An owner's ID check: its status and what it found

GET /v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/verification

curl https://onboard.socialmatterspay.com/v1/applications/current/owners/937483ec-19aa-4b69-9293-fb067752edf8/verification \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "url": null,
    "mode": null,
    "application": "(the application, as GET /v1/applications/current answers it)"
  }
}

POST /v1/webhooks/plaid/identity-verification

Plaid’s STATUS_UPDATED, STEP_UPDATED and RETRIED webhooks: signed by Plaid, and even then SMP reads the person’s sessions from Plaid; nothing in the body is trusted

No auth

Host https://onboard.socialmatterspay.com

With Plaid configured, the Plaid-Verification header must carry a JWT signed ES256 by a key from /webhook_verification_key/get, issued within the last 5 minutes, whose request_body_sha256 is the SHA-256 of this exact body (plaid.com/docs/api/webhooks/webhook-verification); otherwise 401 unverified_webhook. If Plaid’s key cannot be fetched the answer is 503 so Plaid sends it again. Plaid delivers these in no guaranteed order, so SMP lists the person’s attempts (/identity_verification/list) and brings every one up to date. The URL is set once in the Plaid Dashboard (a webhook set through /link/token/create is not used for Identity Verification).

Request body

Field	Notes
`webhook_type` requiredenum	one of `IDENTITY_VERIFICATION`
`webhook_code` requiredenum	one of `STATUS_UPDATED`, `STEP_UPDATED`, `RETRIED`
`identity_verification_id` requiredstring	—
`environment`string	—

Responses

Status	Meaning
`200`	Received
`400`	Error — error shape and codes
`401`	Error — error shape and codes
`503`	Error — error shape and codes

Fields of the response (200)

Field	Notes
`received`boolean = true	—
`matched`boolean	Whether the session named in the webhook is one SMP holds.
`refreshed`boolean	Present when matched is true: whether SMP re-read the session from Plaid. False when Plaid is not configured or answered with an error.

Example

No captured example: Plaid signs this request with its own key (Plaid-Verification), which a test can't produce.

GET /v1/applications/current/agreements

The two signing boxes and the ten documents they cover, every word, each with the SHA-256 of its exact words and of its unsigned PDF

Applicant session

Host https://onboard.socialmatterspay.com

Box 1 (agreements): Merchant Agreement, Schedules A–E, Terms of Service, Acceptable Use Policy, API and Developer Terms, Data Processing Addendum. Box 2 (consents): E-SIGN Consent (Part A), the Fee Debit Authorization for the payout account (the engine's own words), the certification, the Privacy Policy. Each box carries its sentence as parts (text, the linked word that opens the panel, and where the signer's name and title go). signing.open is false in production while the documents are drafts, unless SMP set SIGN_DRAFT_AGREEMENTS=allow on the deployment; signing.notice is then the sentence to show. 409 bank_first until the payout account is connected.

Responses

Status	Meaning
`200`	The boxes and their documents (blocks: headings, paragraphs, lists, tables, quotes; blanks kept as blanks; end notes; the signature block)
`401`	Error — error shape and codes
`409`	Error — error shape and codes

Fields of `data` (200)

Field Notes

signingobject

2 child fields

`open`boolean	Whether the documents can be signed here. In production they cannot while any is still a draft, unless SMP has allowed signing drafts.
`notice`string \| null	Why signing is closed. Null when it is open.

renderer_versioninteger The version of the PDF renderer that made the unsigned PDFs.

businessstring The business's legal name.

signer_candidatesarray of object

3 child fields

`full_name`string	—
`title`string \| null	—
`is_applicant`boolean	—

boxesarray of object

The two boxes to tick, with the sentence beside each.

6 child fields

boxenum one of agreements, consents

wordstring The linked word in the sentence that opens the box's documents.

documentsarray of string Keys of the documents the box covers, in the order shown.

sentence_partsarray of object

The sentence in pieces, in order.

3 child fields

`t`enum	text is plain words, link is the word that opens the documents, signer is where the signer's name and title go. one of `text`, `link`, `signer`
`text`string	The words, for text and link.
`box`enum	The box a link opens. one of `agreements`, `consents`

sentence_templatestring The sentence with the business and the account filled in and the signer left as [full legal name], [title].

sentence_template_sha256string —

documentsarray of object

15 child fields

keystring —

boxenum one of agreements, consents

positioninteger Order shown, from 0.

titlestring —

also_calledstring | null Another name the document goes by.

versionstring —

effectivestring | null The date the version takes effect.

draftboolean True until counsel approves the version; a draft is stamped on every page.

signature_labelstring The line above the signature block.

bannerany The draft banner under the title. The live answer gives a list of rich-text lines, each a list of runs (plain text, or a pair of text and style). The documentation's captured example summarizes it as text.

blocksany The document's words as a list of blocks, each with a type t (h, p, ul, ol, table, quote, rule or sig) and its content. The documentation's captured example summarizes it as text.

notesany The document's numbered notes, each with a number n and rich text c. The documentation's captured example summarizes it as text.

originobject

Where the words come from.

5 child fields

`kind`enum	one of `legal`, `engine`, `spec`
`file`string	The source file, when kind is legal or spec.
`sha256`string	SHA-256 of the source file, when kind is legal.
`function`string	The engine function that produces the words, when kind is engine.
`section`string	The section of the signature specification, when kind is spec.

text_sha256string SHA-256 of the words. The signed box records the hash the signer saw.

unsigned_pdf_sha256string SHA-256 of the unsigned PDF as stored.

Example

The agreements to sign, each with the SHA-256 of its exact words

GET /v1/applications/current/agreements

curl https://onboard.socialmatterspay.com/v1/applications/current/agreements \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "signing": {
      "open": true,
      "notice": null
    },
    "renderer_version": 2,
    "business": "Sunrise Wellness LLC",
    "signer_candidates": [
      {
        "full_name": "Jennifer Thompson",
        "title": "Managing Member",
        "is_applicant": true
      },
      {
        "full_name": "Marcus Lee",
        "title": "Member, operations",
        "is_applicant": false
      }
    ],
    "boxes": [
      {
        "box": "agreements",
        "word": "agreements",
        "documents": [
          "merchant-agreement",
          "merchant-schedules",
          … 4 more
        ],
        "sentence_parts": [
          {
            "t": "text",
            "text": "I have read the "
          },
          {
            "t": "link",
            "text": "agreements",
            "box": "agreements"
          },
          … 3 more
        ],
        "sentence_template": "I have read the agreements, I am authorized to sign them for Sunrise Wellness LLC, and I sign them electronically as [full legal name], [title].",
        "sentence_template_sha256": "278f8a0cb01c15134b0ae5bd6280222d6fca0956e415391d34bd311e897ac1cd"
      },
      {
        "box": "consents",
        "word": "consents",
        "documents": [
          "esign-consent",
          "fee-debit-authorization",
          … 2 more
        ],
        "sentence_parts": [
          {
            "t": "text",
            "text": "I give the "
          },
          {
            "t": "link",
            "text": "consents",
            "box": "consents"
          },
          {
            "t": "text",
            "text": ": I agree to electronic records and signatures, I sign the Account Debit Authorization for the account ending 9606, I certify that everything in this application, including its owners and control person, is true and complete, and I have read the Privacy Policy."
          }
        ],
        "sentence_template": "I give the consents: I agree to electronic records and signatures, I sign the Account Debit Authorization for the account ending 9606, I certify that everything in this application, including its owners and control person, is true and complete, and I have read the Privacy Policy.",
        "sentence_template_sha256": "b0b81cb3fbbf3d9f156009e5e31127ebef57f38274a54aa7031a59c9503f660e"
      }
    ],
    "documents": [
      {
        "key": "merchant-agreement",
        "box": "agreements",
        "position": 0,
        "title": "Merchant Agreement",
        "also_called": null,
        "version": "0.1",
        "effective": "2026-10-25",
        "draft": true,
        "signature_label": "Signed for the Merchant",
        "banner": "(the draft notice)",
        "blocks": "(the agreement's text: 123 blocks, shown in full on the page and in its PDF)",
        "notes": "(9 notes)",
        "origin": {
          "kind": "legal"
        },
        "text_sha256": "c54773be429f11af19ba9c80718d01d6533fcf4571db75843bdae0358f1bf109",
        "unsigned_pdf_sha256": "8ede8e3edf53fb10c1cc05a17b7b928ad6248d78b3eb1eef0e058a3a6c8901a3"
      },
      {
        "key": "merchant-schedules",
        "box": "agreements",
        "position": 1,
        "title": "Merchant Agreement — Schedules A to E",
        "also_called": null,
        "version": "0.1",
        "effective": "2026-10-25",
        "draft": true,
        "signature_label": "Signed for the Merchant",
        "banner": "(the draft notice)",
        "blocks": "(the agreement's text: 48 blocks, shown in full on the page and in its PDF)",
        "notes": "(6 notes)",
        "origin": {
          "kind": "legal"
        },
        "text_sha256": "7fe78d1333dff06716632aed1074b32219a882ebee9f7b479228f474f175b444",
        "unsigned_pdf_sha256": "86b267bcccd58e16c82a01a0d2de04b1f3364071330b59edfc712de28841e9e5"
      },
      … 8 more
    ]
  }
}

GET /v1/applications/current/agreements/{key}/pdf

One document, unsigned, as a PDF: the same words as the panel, the same bytes every time (the SHA-256 is in X-Content-SHA256 and in the agreements list)

Applicant session

Host https://onboard.socialmatterspay.com

Parameters

Field	Notes
`key` requiredpath · string	—

Responses

Status	Meaning
`200`	PDF
`401`	Error — error shape and codes
`404`	Error — error shape and codes

Example

One agreement as a PDF

GET /v1/applications/current/agreements/merchant-agreement/pdf

curl https://onboard.socialmatterspay.com/v1/applications/current/agreements/merchant-agreement/pdf \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Content-Type: application/pdf
Cache-Control: private, max-age=3600

(application/pdf, 255,022 bytes)

GET /v1/applications/current/signed/{key}/pdf

A signed copy, exactly as stored

Applicant session

Host https://onboard.socialmatterspay.com

Parameters

Field	Notes
`key` requiredpath · string	—

Responses

Status	Meaning
`200`	PDF
`401`	Error — error shape and codes
`404`	Error — error shape and codes

Example

A signed agreement as a PDF, with its signature page

GET /v1/applications/current/signed/merchant-agreement/pdf

curl https://onboard.socialmatterspay.com/v1/applications/current/signed/merchant-agreement/pdf \
  -H 'Authorization: Bearer applicant_session_token'

Response · 200

HTTP 200
Content-Type: application/pdf
Cache-Control: no-store

(application/pdf, 263,147 bytes)

POST /v1/applications/current/tick-events

Record a tick or untick of a signing box as it happens, with the browser's time; the server adds its own time of receipt

Applicant session

Host https://onboard.socialmatterspay.com

Append-only. Signing refuses (409 tick_not_recorded) a box whose last recorded event is not a tick. 400 for a box that isn't agreements or consents, a non-boolean ticked, or a client_at that isn't a time; 429 after 400 events on one application.

Request body

Field	Notes
`box` requiredenum	one of `agreements`, `consents`
`ticked` requiredboolean	—
`client_at` requiredstring (date-time)	The time on the signer's device

Responses

Status	Meaning
`201`	Recorded
`400`	Error — error shape and codes
`401`	Error — error shape and codes
`409`	Error — error shape and codes
`429`	Error — error shape and codes

Fields of `data` (201)

Field	Notes
`recorded`boolean = true	—
`box`enum	one of `agreements`, `consents`
`ticked`boolean	—
`client_at`string (date-time)	The time on the applicant's device, as sent, in UTC.
`received_at`string (date-time)	The time the server recorded it.

Example

A box ticked, recorded as it happens

POST /v1/applications/current/tick-events

curl -X POST https://onboard.socialmatterspay.com/v1/applications/current/tick-events \
  -H 'CF-Connecting-IP: 203.0.113.7' \
  -H 'User-Agent: e2e applicant browser' \
  -H 'Authorization: Bearer applicant_session_token' \
  -H 'Content-Type: application/json' \
  -d '{
  "box": "agreements",
  "ticked": true,
  "client_at": "2026-10-28T00:23:32.801Z"
}'

Response · 201

HTTP 201
Cache-Control: no-store

{
  "data": {
    "recorded": true,
    "box": "agreements",
    "ticked": true,
    "client_at": "2026-10-28T00:23:32.801Z",
    "received_at": "2026-10-28T00:23:32.803Z"
  }
}

POST /v1/applications/current/submit

Sign and submit: the typed legal name of an owner or the control person, both boxes, and the SHA-256 of each document shown

Applicant session

Host https://onboard.socialmatterspay.com

Refused (422) while anything is missing, with problems: [{ step, item, field, message }] — the first problem is the message. Refused 409 agreements_changed when the words changed since they were shown (changed: the document keys), 409 tick_not_recorded when a box's last recorded tick event is not a tick, 409 agreements_not_final in production while the documents are drafts. Signing writes one record per box (the sentence beside it and its SHA-256, the signer, the tick events as recorded, time, IP, browser, session) and one signed PDF per document (written once to R2, each with its SHA-256 and that of its unsigned twin); the business and every owner are screened against OFAC; the same business applying twice is flagged; the ten signed PDFs are emailed. agreements_consent is the agreements box, esign_consent the consents box.

Request body

Field Notes

signer_name requiredstring —

signer_titlestring —

agreements_consent requiredboolean —

esign_consent requiredboolean —

agreements requiredarray of object

2 child fields

`key` requiredstring	—
`text_sha256` requiredstring	—

Responses

Status	Meaning
`200`	The submitted application
`401`	Error — error shape and codes
`409`	Error — error shape and codes
`422`	Error — error shape and codes

Fields of `data` (200)

The same fields as under answerBiometricConsent.

Example

Sign and submit

POST /v1/applications/current/submit

curl -X POST https://onboard.socialmatterspay.com/v1/applications/current/submit \
  -H 'CF-Connecting-IP: 203.0.113.7' \
  -H 'User-Agent: e2e applicant browser' \
  -H 'Authorization: Bearer applicant_session_token' \
  -H 'Content-Type: application/json' \
  -d '{
  "signer_name": "Jennifer Thompson",
  "signer_title": "Managing Member",
  "agreements_consent": true,
  "esign_consent": true,
  "agreements": [
    {
      "key": "merchant-agreement",
      "text_sha256": "c54773be429f11af19ba9c80718d01d6533fcf4571db75843bdae0358f1bf109"
    },
    {
      "key": "merchant-schedules",
      "text_sha256": "7fe78d1333dff06716632aed1074b32219a882ebee9f7b479228f474f175b444"
    },
    {
      "key": "terms-of-service",
      "text_sha256": "741c52a9a6db62b9fe3bdf84e85a29f223c6e5711d48cd66075f929fbc5de402"
    },
    {
      "key": "acceptable-use-policy",
      "text_sha256": "af8d97c71392e00b280ccef26e775e631776a0d62655c42645b1425ed197872b"
    },
    {
      "key": "api-developer-terms",
      "text_sha256": "4cc41d1cb274788a99b4fee18c3e74942ab5f555199ad543fdfd15dac2443d5b"
    },
    {
      "key": "data-processing-addendum",
      "text_sha256": "b082b5c9dfb431c4a2c3ed13b6490795bede298dbcd4b473312532dccbd6e840"
    },
    {
      "key": "esign-consent",
      "text_sha256": "ad59be2c37eb05c2b8c9a68aeb736c2a68d7e6bb5e5898740356a928d1115334"
    },
    {
      "key": "fee-debit-authorization",
      "text_sha256": "4b002434a95c57b9f3e07927268c0c488848556f9790b03f68237b52fdbfb6e0"
    },
    {
      "key": "application-certification",
      "text_sha256": "354912db9e4937ad0bc6143c834e0281502dccaf24733e179e11b1f817bda316"
    },
    {
      "key": "privacy-policy",
      "text_sha256": "d0d587510bc607c464f26c25100bc7415c73c9cc70fe14f13c0aad85fe11b468"
    }
  ]
}'

Response · 200

HTTP 200
Cache-Control: no-store

{
  "data": {
    "object": "application",
    "id": "8f67c6ec-bbf9-4630-bbc3-9c95203955fe",
    "reference": "SMP-B94V-95JT",
    "status": "submitted",
    "started_by": "applicant",
    "info_request_message": null,
    "contact": {
      "name": "Jennifer Thompson",
      "email": "jen31@sunrise31.example",
      "phone": "+13055550123",
      "email_verified": true
    },
    "business": {
      "legal_name": "Sunrise Wellness LLC",
      "dba_name": "Sunrise",
      "entity_type": "llc",
      "formation_state": "FL",
      "formation_date": "2019-04-02",
      "ein_last4": "0031",
      "address": {
        "line1": "1 Main St",
        "line2": "Suite 200",
        "city": "Tampa",
        "state": "FL",
        "postal_code": "33602"
      },
      "business_phone": null,
      "website_url": "https://sunrise31.example",
      "name_differs": true,
      "terms_page_url": null,
      "name_link_proof": "dba_certificate"
    },
    "sales": {
      "products_description": "Yoga mats and studio gear",
      "category": "retail",
      "monthly_volume_cents": 2500000,
      "avg_ticket_cents": 8500,
      "max_ticket_cents": 60000,
      "refund_policy": "30 days, unused items",
      "current_processors": [
        "Stripe"
      ],
      "integration_types": [
        "woocommerce",
        "shopify"
      ],
      "is_startup": false,
      "statement_descriptor": "SUNRISE"
    },
    "owners": [
      {
        "id": "937483ec-19aa-4b69-9293-fb067752edf8",
        "full_name": "Jennifer Thompson",
        "title": "Managing Member",
        "ownership_pct": 60,
        "is_control_person": true,
        "is_applicant": true,
        "dob": "1980-01-01",
        "email": "jen31@sunrise31.example",
        "phone": null,
        "address": {
          "line1": "9 Bay Rd",
          "line2": null,
          "city": "Tampa",
          "state": "FL",
          "postal_code": "33606"
        },
        "ssn_last4": "1031",
        "id_status": "verified",
        "biometric_consent": true,
        "consent": {
          "can_answer": true,
          "by": "applicant",
          "at": "2026-10-28T00:23:30.542Z",
          "version": "biometric-notice-0.1-draft-2026-10-25",
          "sentence": "I have read SMP's Biometric Notice. I consent to Social Matter Payments LLC and its identity-verification provider collecting, storing and using a scan of my face geometry from my selfie and my ID photo, only to verify my identity for this application, and to its destruction on the schedule in that notice. I sign this release electronically as Jennifer Thompson.",
          "sentence_sha256": "cc28518cd8c709a6187e7c7038497f9931898501b3d049737ed65637575e9666",
          "locked": true
        },
        "invite_sent_at": null,
        "documents": {
          "id_front": {
            "id": "1dfa6649-42ba-417d-884c-3e38f7606169",
            "filename": "id_front.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.548Z"
          },
          "id_back": {
            "id": "51f8f430-b2a2-42b9-b98f-f3d53a5f9e89",
            "filename": "id_back.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.556Z"
          },
          "selfie": {
            "id": "d9941f1e-7bc9-4355-990b-2ceb54a11a77",
            "filename": "selfie.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.562Z"
          }
        },
        "verification": {
          "provider": "sandbox",
          "status": "verified",
          "provider_status": null,
          "sandbox": true,
          "checks": {
            "sandbox": true,
            "checks": [
              {
                "name": "image_format",
                "result": "pass",
                "detail": "ID front: png; ID back: png; selfie: png"
              },
              {
                "name": "resolution",
                "result": "pass",
                "detail": "ID front 1600×1200; ID back 1600×1200; selfie 1600×1200"
              },
              … 4 more
            ]
          },
          "created_at": "2026-10-28T00:23:30.568Z",
          "completed_at": "2026-10-28T00:23:30.568Z",
          "attempt": 1,
          "retry_available": false,
          "attempts_left": null,
          "reason": null,
          "fell_back": false
        }
      },
      {
        "id": "7ef70922-1eea-4cef-8b4f-b732c2ffe370",
        "full_name": "Marcus Lee",
        "title": "Member, operations",
        "ownership_pct": 40,
        "is_control_person": false,
        "is_applicant": false,
        "dob": "1982-03-04",
        "email": "marcus31@sunrise31.example",
        "phone": null,
        "address": {
          "line1": "9 Bay Rd",
          "line2": null,
          "city": "Tampa",
          "state": "FL",
          "postal_code": "33606"
        },
        "ssn_last4": "2031",
        "id_status": "verified",
        "biometric_consent": true,
        "consent": {
          "can_answer": false,
          "by": "owner",
          "at": "2026-10-28T00:23:30.586Z",
          "version": "biometric-notice-0.1-draft-2026-10-25",
          "sentence": "I have read SMP's Biometric Notice. I consent to Social Matter Payments LLC and its identity-verification provider collecting, storing and using a scan of my face geometry from my selfie and my ID photo, only to verify my identity for this application, and to its destruction on the schedule in that notice. I sign this release electronically as Marcus Lee.",
          "sentence_sha256": "d5830b920749ec3575bbb142dc76619e8057bfc9555432029d754a9bc4d4e6e1",
          "locked": true
        },
        "invite_sent_at": "2026-10-28T00:23:30.573Z",
        "documents": {
          "id_front": {
            "id": "0ce2b563-24dc-49ba-884a-2bf36c7a39cb",
            "filename": "id_front.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.593Z"
          },
          "id_back": {
            "id": "8112032a-d7c7-4af3-bc3c-1fc3787c55ba",
            "filename": "id_back.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.600Z"
          },
          "selfie": {
            "id": "7b1a22c2-5400-4115-ab66-0c7436814371",
            "filename": "selfie.png",
            "content_type": "image/png",
            "size_bytes": 2048,
            "source": "camera",
            "uploaded_at": "2026-10-28T00:23:30.605Z"
          }
        },
        "verification": {
          "provider": "sandbox",
          "status": "verified",
          "provider_status": null,
          "sandbox": true,
          "checks": {
            "sandbox": true,
            "checks": [
              {
                "name": "image_format",
                "result": "pass",
                "detail": "ID front: png; ID back: png; selfie: png"
              },
              {
                "name": "resolution",
                "result": "pass",
                "detail": "ID front 1600×1200; ID back 1600×1200; selfie 1600×1200"
              },
              … 4 more
            ]
          },
          "created_at": "2026-10-28T00:23:30.610Z",
          "completed_at": "2026-10-28T00:23:30.610Z",
          "attempt": 1,
          "retry_available": false,
          "attempts_left": null,
          "reason": null,
          "fell_back": false
        }
      }
    ],
    "ownership_attested": true,
    "documents": [
      {
        "id": "632da260-a3b9-4f3c-a97e-a214a6b66845",
        "doc_type": "ein_letter",
        "statement_month": null,
        "filename": "ein_letter.pdf",
        "content_type": "application/pdf",
        "size_bytes": 33,
        "uploaded_at": "2026-10-28T00:23:30.509Z"
      },
      {
        "id": "b235a72b-a193-42e9-b28e-cc9353e9e46b",
        "doc_type": "articles",
        "statement_month": null,
        "filename": "articles.pdf",
        "content_type": "application/pdf",
        "size_bytes": 39,
        "uploaded_at": "2026-10-28T00:23:30.516Z"
      },
      … 5 more
    ],
    "statement_months": [
      "2026-07",
      "2026-08",
      "2026-09"
    ],
    "bank": {
      "method": "plaid_sandbox",
      "status": "verified",
      "institution_name": "Plaid Sandbox: First Platypus Bank (simulated)",
      "account_type": "checking",
      "account_last4": "9606",
      "routing_number": "011401533",
      "holder_name": "Sunrise Wellness LLC",
      "name_match": "match",
      "sandbox": true
    },
    "referral": {
      "status": "none",
      "source": null,
      "partner_name": null,
      "agent_name": null,
      "claim": null
    },
    "integration": {
      "kind": "website",
      "domain": "sunrise31.example",
      "app_name": null,
      "app_platform": null,
      "app_store_url": null,
      "app_bundle_id": null,
      "method": "api",
      "label": "sunrise31.example",
      "sandbox": {
        "account_id": "4cad9448-209c-48b5-9a1f-95c8585a2db7",
        "key_prefix": "sk_sandbox_2ca1",
        "issued_at": "2026-10-28T00:23:30.468Z"
      },
      "status": "submitted",
      "page_url": "https://sunrise31.example/checkout",
      "applicant_notes": "The authorization words sit above the Pay by bank button.",
      "submitted_at": "2026-10-28T00:23:31.750Z",
      "due_at": "2026-10-30T00:23:31.750Z",
      "place": 1,
      "decision": null,
      "cases": [
        {
          "id": "bank_linked",
          "title": "Link a bank",
          "how": "Link a payer’s bank with the sandbox bank link (any test bank)."
        },
        {
          "id": "payment_settled",
          "title": "A payment that settles",
          "how": "Make a WEB payment that carries the authorization words’ SHA-256, then move the sandbox clock until it settles."
        },
        … 7 more
      ],
      "page_checks": [
        {
          "id": "payer_name",
          "title": "The payer",
          "looks_at": "asks for the payer’s real name; no placeholder"
        },
        {
          "id": "authorization",
          "title": "The authorization",
          "looks_at": "SMP’s authorization words in full before the button, and a tick box that unlocks the button"
        },
        … 4 more
      ]
    },
    "pricing": null,
    "agreements": [
      {
        "key": "merchant-agreement",
        "title": "Merchant Agreement",
        "box": "agreements",
        "version": "0.1",
        "draft": true
      },
      {
        "key": "merchant-schedules",
        "title": "Merchant Agreement — Schedules A to E",
        "box": "agreements",
        "version": "0.1",
        "draft": true
      },
      … 8 more
    ],
    "signatures": [
      {
        "id": "sig_bd0d857f-1501-48d3-b899-5b5882150949",
        "box": "agreements",
        "submitted_at": "2026-10-28T00:23:32.822Z",
        "documents": [
          {
            "key": "merchant-agreement",
            "title": "Merchant Agreement",
            "signed_sha256": "094c1dfb4e09d6720541d7aba0eb1f30d35d984f195bb17780f4f98bafc438b4"
          },
          {
            "key": "merchant-schedules",
            "title": "Merchant Agreement — Schedules A to E",
            "signed_sha256": "cec6ab195caefa47fecbe0b30f30c9bb80fa9e80a0723d4b28c78ba57bc9f83f"
          },
          … 4 more
        ]
      },
      {
        "id": "sig_35be7769-d4f6-47b3-8968-b4d6fb791530",
        "box": "consents",
        "submitted_at": "2026-10-28T00:23:32.822Z",
        "documents": [
          {
            "key": "esign-consent",
            "title": "Consent to Electronic Records and Signatures (E-SIGN Consent)",
            "signed_sha256": "cf48aab5d0f7be9c131ece019150c77d0249b5fc78b2654169beee3666760611"
          },
          {
            "key": "fee-debit-authorization",
            "title": "Fee Debit Authorization",
            "signed_sha256": "4619a7e0a6a486bb15f0deaa53e336a58d13949b6249bf66cad36ca2597fed62"
          },
          … 2 more
        ]
      }
    ],
    "signed_documents": [
      {
        "key": "merchant-agreement",
        "title": "Merchant Agreement",
        "box": "agreements",
        "signed_at": "2026-10-28T00:23:32.822Z",
        "signed_sha256": "094c1dfb4e09d6720541d7aba0eb1f30d35d984f195bb17780f4f98bafc438b4"
      },
      {
        "key": "merchant-schedules",
        "title": "Merchant Agreement — Schedules A to E",
        "box": "agreements",
        "signed_at": "2026-10-28T00:23:32.822Z",
        "signed_sha256": "cec6ab195caefa47fecbe0b30f30c9bb80fa9e80a0723d4b28c78ba57bc9f83f"
      },
      … 8 more
    ],
    "submitted_at": "2026-10-28T00:23:32.822Z",
    "review": {
      "due_at": "2026-10-30T00:23:32.822Z",
      "place": 2
    },
    "problems": [],
    "config": "(the questionnaire's settings, as GET /v1/applications/config answers them)"
  }
}

The person’s own release for the face match: agree (SMP’s notice, its version, SHA-256 and the release sentence with their name recorded), decline (a person then reviews the ID photos) or withdraw before any check has run

Parameters

Request body

Responses

Fields of data (200)

Check this person’s ID: Plaid Identity Verification (returns its hosted link), the built-in sandbox check, or a person (no vendor, Plaid unreachable, three tries used, the face match declined, or an owner who has not answered)

Parameters

Request body

Responses

Fields of data (200)

This person’s latest ID check, read again from Plaid while its session is open (Plaid not answering sends the person to review: mode manual_fallback)

Parameters

Responses

Fields of data (200)

Plaid’s STATUS_UPDATED, STEP_UPDATED and RETRIED webhooks: signed by Plaid, and even then SMP reads the person’s sessions from Plaid; nothing in the body is trusted

Request body

Responses

Fields of the response (200)

The two signing boxes and the ten documents they cover, every word, each with the SHA-256 of its exact words and of its unsigned PDF

Responses

Fields of data (200)

One document, unsigned, as a PDF: the same words as the panel, the same bytes every time (the SHA-256 is in X-Content-SHA256 and in the agreements list)

Parameters

Responses

A signed copy, exactly as stored

Parameters

Responses

Record a tick or untick of a signing box as it happens, with the browser's time; the server adds its own time of receipt

Request body

Responses

Fields of data (201)

Sign and submit: the typed legal name of an owner or the control person, both boxes, and the SHA-256 of each document shown

Request body

Responses

Fields of data (200)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (200)

Fields of `data` (201)

Fields of `data` (200)