---
title: "Create a Sumsub access token"
method: POST
path: "/api/fma/v1/kyc/sumsub-access-token"
tags: ["Managed Custody KYC"]
---

# Create a Sumsub access token

`POST /api/fma/v1/kyc/sumsub-access-token`

Issues a short-lived Sumsub access token bound to UR's Sumsub tenant, with a fixed 20 minute TTL. Call this after create-account on the SDK path and relay the token to the Sumsub mobile or web SDK on the user device; re-issue a token bound to the same applicant if the user pauses. Requires an active onboarding session on the SDK data channel; X-Ur-Id must be present.

## Headers

- `X-Ur-Id` string, required
- `X-External-User-Id` string
- `X-Api-Signature` string, required
- `X-Api-Deadline` string, required
- `X-Api-PublicKey` string, required

## Request body

- KycSumsubAccessTokenRequest — Empty body by design. UR reads urId from the X-Ur-Id header and resolves the active onboarding session server-side.

## Response `200`

Business result envelope. code 0 means success; business rejections return HTTP 200 with a non-zero code.

- KycSumsubAccessTokenResponse
  - `code` integer — Business result code. 0 means success; business rejections return HTTP 200 with a non-zero code.
  - `message` string — Human-readable diagnostic for non-zero codes.
  - `data` object
    - `token` string — Sumsub access token with a 20 minute TTL. Pass this string to the Sumsub SDK constructor on the user device.

---

[API](https://skmtc.net/ur/apis/ur-api.md) · [All operations](https://skmtc.net/ur/apis/ur-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ur/ur-api/revisions/087dcf516ce2/schema)