---
title: "Create Verification"
method: POST
path: "/verifications"
tags: ["Verifications"]
---

# Create Verification

`POST /verifications`

Starts a hosted verification session for an account or user, or returns the active session when one already exists. Any fields you include in the request body are used to prefill the session. Send `documents` (with `document_type`) to instead verify the person from identity documents included in this request — no hosted session involved. Send `share_token` to reuse a verification another Sumsub account has already completed for this person, instead of verifying them again. If the account already has an `approved` verification the request is rejected; unlink it first to start a new one.

## Query parameters

- `account_id` string, required

## Headers

- `Idempotency-Key` string

## Request body

- union
  - object — Request body for an individual (KYC) verification. Omit `kind` or set it to `individual`. KYC is required to pay out funds and is a prerequisite for Whop Card access. Accepting payments does not require verification until a business reaches $5000 in payments. Add `business_name` and `business_structure` if the individual operates under a business entity — this enables payouts to be received by a business bank account. `country` is always the individual's own country, and the supported `business_structure` values vary by it — see [Business structures](/developer/verification/business-structures).
    - `address` object
      - `city` string
      - `country` string — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
      - `line1` string — First line of the street address.
      - `line2` string — Second line of the street address.
      - `postal_code` string — Postal or ZIP code.
      - `state` string — State, province, or region code, for example `CA`.
    - `business_name` string — Legal business name for a sole proprietor or single-member LLC.
    - `business_structure` string — Entity type for sole proprietors, such as `single_member_llc`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
    - `business_tax_identification_number` string — The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
    - `business_website` string — Business website URL. Whop store pages are not accepted.
    - `country` string — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
    - `date_of_birth` string — Formatted as `YYYY-MM-DD`.
    - `document_type` 'ID_CARD' | 'DRIVERS' | 'RESIDENCE_PERMIT' | 'PASSPORT' — Identity document being sent, when verifying with `documents`. Decides exactly which file slots to send: `ID_CARD` → `id_card_front` + `id_card_back` + `selfie`; `DRIVERS` → `drivers_front` + `drivers_back` + `selfie`; `RESIDENCE_PERMIT` → `residence_permit_front` + `residence_permit_back` + `selfie`; `PASSPORT` → `passport_front` + `selfie`. See [Identity documents](/developer/verification/identity-documents).
    - `documents` object — Identity document files, each value the file's raw bytes base64-encoded (JPEG, PNG, or PDF, up to 5MB per file before encoding). Sending this object verifies the person from the files in this request instead of a hosted session — individual verifications only, and the request must also carry `document_type`, `first_name`, `last_name`, `date_of_birth`, `country`, `phone`, `tax_identification_number`, and an `address` with `line1`, `city`, `state`, and `postal_code`. Send every slot for your `document_type` — a missing or rejected file fails the whole request and nothing is submitted; review starts automatically once every document is accepted. See [Identity documents](/developer/verification/identity-documents) for a full walkthrough.
      - `drivers_back` string — Back of the driver's license, base64-encoded. Required when `document_type` is `DRIVERS`.
      - `drivers_front` string — Front of the driver's license, base64-encoded. Required when `document_type` is `DRIVERS`.
      - `id_card_back` string — Back of the ID card, base64-encoded. Required when `document_type` is `ID_CARD`.
      - `id_card_front` string — Front of the ID card, base64-encoded. Required when `document_type` is `ID_CARD`.
      - `passport_front` string — Photo page of the passport, base64-encoded. Required when `document_type` is `PASSPORT`.
      - `residence_permit_back` string — Back of the residence permit, base64-encoded. Required when `document_type` is `RESIDENCE_PERMIT`.
      - `residence_permit_front` string — Front of the residence permit, base64-encoded. Required when `document_type` is `RESIDENCE_PERMIT`.
      - `selfie` string — Photo of the person's face, base64-encoded. Always required, with every document type. Must be JPEG or PNG.
    - `first_name` string
    - `kind` 'individual' — Verification type. Defaults to `individual`.
    - `last_name` string
    - `phone` string
    - `share_token` string — Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns `approved` when it satisfies them, or `pending` with a `session_url` covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with `documents` or `document_type`.
    - `tax_identification_number` string — The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.
  - object — Request body for a business entity (KYB) verification. Set `kind` to `business`. KYB includes everything KYC provides and additionally unlocks financing options for payments and business Whop Cards.
    - `address` object
      - `city` string
      - `country` string — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
      - `line1` string — First line of the street address.
      - `line2` string — Second line of the street address.
      - `postal_code` string — Postal or ZIP code.
      - `state` string — State, province, or region code, for example `CA`.
    - `business_name` string — Legal business name.
    - `business_structure` string — Legal entity structure of the business, such as `private_corporation` or `sole_proprietorship`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
    - `business_tax_identification_number` string — The business ID number of the company, as appropriate for the company's country. Examples are an Employer Identification Number (EIN) in the US, a Business Number in Canada, or a Company Number in the UK.
    - `business_website` string — Business website URL. Whop store pages are not accepted.
    - `country` string — Country of incorporation as a two-letter ISO 3166-1 country code.
    - `kind` 'business' — Must be `business` to start a KYB verification.
    - `place_of_incorporation` string — State or region where the business is incorporated.
    - `share_token` string — Sumsub share token for a person a partner has already verified, generated by their Sumsub account for Whop's client ID. Reuses that verification instead of collecting anything: Whop imports the shared identity, rechecks it against its own requirements, and returns `approved` when it satisfies them, or `pending` with a `session_url` covering only what is still missing. Requires a Reusable KYC agreement between the partner's Sumsub account and Whop's. Each token works once, and cannot be combined with `documents` or `document_type`.
    - `tax_identification_number` string — The government-issued ID number of the person being verified — the individual for a KYC verification, or the business representative for a KYB verification — as appropriate for their country. Examples are a Social Security Number (SSN) in the US, or a Social Insurance Number in Canada.

## Response `200`

OK

- object
  - `address` object, nullable — Address on the verification profile. `null` when no address is set.
    - `city` string, nullable
    - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
    - `line1` string — First line of the street address.
    - `line2` string, nullable — Second line of the street address.
    - `postal_code` string, nullable — Postal or ZIP code.
    - `state` string, nullable — State, province, or region code, for example `CA`.
  - `business_name` string, nullable — Legal business name.
  - `business_structure` string, nullable — Legal entity structure of the business, such as `private_corporation` or `sole_proprietorship`. Supported values vary by country of incorporation — see [Business structures](/developer/verification/business-structures).
  - `country` string, nullable — Two-letter ISO 3166-1 country code, for example `US`, `DE`, or `GB`.
  - `created_at` string — When the verification profile was created, as an ISO 8601 timestamp.
  - `date_of_birth` string, nullable — Formatted as `YYYY-MM-DD`.
  - `first_name` string, nullable
  - `id` string — Verification profile ID, prefixed `idpf_`.
  - `kind` 'individual' | 'business'
  - `last_name` string, nullable
  - `requested_information` object[] — What Whop still needs before review can continue — one requirement per entry. Answer with Update Verification; nothing from the response is echoed back. Keys that don't apply are omitted.
    - `errors` object[] — Present after a rejected submission.
      - `code` string — Stable error code.
      - `reason` string — Why it was rejected.
    - `id` string, required — Requested information item ID, prefixed `inrqi_`.
    - `label` string, required — Instruction to show the user. Carries the reviewer's note verbatim when there is one.
    - `optional` boolean — `true` when the item can be skipped.
    - `options` string[] — The values `value` may take on a `select` item. On an `id_document` item these are the ID types accepted, and the chosen one decides which `documents` slots to send. Absent when the item has no choice to make.
    - `requirement` string, required — What is needed: a document name such as `bank_statement`, or a field key such as `ssn` or `identity_document`. Handle unrecognized values by `type`.
    - `type` string, required — What to send as the answer, so you never have to infer it: `files` (a document, as a list of its pages), `id_document` (send `documents` with the slot keys for the ID you are uploading), `text`, `date`, `phone` or `select` (send `value`), or `address` (send `address`).
  - `required_documents` object[] — Documents for a document-upload verification and their progress. Present only on verifications created by sending `documents`. `pending_upload` documents were not accepted yet — send the full set again with another Create Verification call.
    - `document` string — Document slot key, such as `id_card_front`, `id_card_back`, or `selfie`.
    - `rejection_reason` string, nullable — Why the previous submission was rejected, when the provider requested new documents or declined the verification.
    - `status` 'pending_upload' | 'submitted' — `pending_upload` until the document has been relayed for review; `submitted` afterwards.
  - `session_url` string, nullable — Hosted verification session URL for the user to complete identity checks. Expires 7 days after creation.
  - `status` 'not_started' | 'pending' | 'processing' | 'manual_review' | 'approved' | 'rejected' | 'action_required' — Current verification state. `not_started` before any session exists; `pending` while a session needs the user's input; `processing` while the provider reviews documents; `action_required` when `requested_information` needs answers; `manual_review` during a manual compliance review — nothing to submit, usually done within 3 business days; `approved` on success; `rejected` on failure. Call Create Verification again to start a new session.
  - `updated_at` string — When the verification profile was last updated, as an ISO 8601 timestamp.

## Other responses

- `201` — verification created
- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Resource not found

---

[API](https://skmtc.net/whop/apis/whop-api.md) · [All operations](https://skmtc.net/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whop/whop-api/versions/866821546d67/schema)