Update a Pending Card Processing Application
curl --request PUT \
--url https://api-sandbox.finogates.com/v1/platform/merchant-onboarding \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form 'payload=<string>' \
--form 'voided_check=<string>' \
--form 'bank_statements=<string>' \
--form 'processing_statements=<string>' \
--form voided_check.0='@example-file' \
--form bank_statements.0='@example-file' \
--form processing_statements.0='@example-file'import requests
url = "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding"
files = {
"voided_check.0": ("example-file", open("example-file", "rb")),
"bank_statements.0": ("example-file", open("example-file", "rb")),
"processing_statements.0": ("example-file", open("example-file", "rb"))
}
payload = {
"payload": "<string>",
"voided_check": "<string>",
"bank_statements": "<string>",
"processing_statements": "<string>"
}
headers = {"Authorization": "Bearer <token>"}
response = requests.put(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('payload', '<string>');
form.append('voided_check', '<string>');
form.append('bank_statements', '<string>');
form.append('processing_statements', '<string>');
form.append('voided_check.0', '{
"fileName": "example-file"
}');
form.append('bank_statements.0', '{
"fileName": "example-file"
}');
form.append('processing_statements.0', '{
"fileName": "example-file"
}');
const options = {method: 'PUT', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api-sandbox.finogates.com/v1/platform/merchant-onboarding', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api-sandbox.finogates.com/v1/platform/merchant-onboarding")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.finogates.com/v1/platform/merchant-onboarding")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"status_code": 200,
"data": {
"user_id": "228e4b03-6831-4b63-ad8e-2250d01f6d64",
"kyb_id": "69b336da-331c-4ddf-8ac5-0a0557c7f279",
"card_acquiring_id": "07f78e86-b3c6-4761-84ae-22176ca015c1"
},
"query_generated_time": 1712847600000
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Update a Pending Card Processing Application
Correct a card-processing application that is still under review.
Use this while an application is pending — for example when an underwriter asks for a clearer bank statement or a corrected volume figure. Once the application has been approved, declined or suspended it can no longer be edited and this returns 409: at that point the packet is the record the decision was made on.
Addressed by card_acquiring_id, the id returned when the merchant was onboarded. An id belonging to another platform returns 404.
Everything is optional. Only what you send changes. An omitted block is left alone entirely, and an omitted field inside a block you do send is left alone too — so you can correct one figure without restating the packet. The same applies to documents: a file part replaces that slot, and a slot with no part keeps whatever is stored.
The payload form field is a JSON object, all keys optional:
merchant_info— any ofaverage_ticket_minor,monthly_volume_minor,max_ticket_minor. The max-versus-average rule is checked against the merged result, so raising only the average is validated against the stored maximum.business_data— any ofbusiness_type,formation_date,mcc,business_phone,phone_country_code,dba,website,registration_number,business_description,contact_first_name,contact_last_name,contact_email,business_address,ownership,business_documents. Sendingbusiness_documentsreplaces the whole list, so include every document you want to keep (2 to 5 entries).kyc— any identity field:first_name,last_name,email,dob,phone_country_code,phone_no,ssn,address,city,state,zip,country,id_type,id_no, and the image linksselfie,id_front_img,id_back_img.
Three fields cannot be changed and are rejected with 422 if sent: business_legal_name, business_ein and business_email. The first two are the pair used to decide whether a resubmission is the same business, and the third is the key the merchant record is found by — editing any of them would silently point the application at a different company. Onboard a new merchant instead.
File rules match the create endpoint: https:// links only, publicly reachable, PNG/JPG/JPEG/PDF only, 10 MB per uploaded document and 7 MB per linked file. Links are downloaded and re-hosted, and no two files in one request may be byte-identical.
Editing a verification sends its check back for review. A change to kyc returns the identity (KYC) check to in_review, and a change to kyb returns the business (KYB) check to in_review — the same state a fresh submission lands in, so an edited check queues alongside new ones. A verification verdict describes the evidence it was given — the identity details, or the legal name, EIN and documents — and this call changes that evidence, so an approval that stood against the old details would not describe what is now on file.
Only the axis you edit moves: send just kyb and the identity check is left alone. Supplying a new inquiry_id also re-decides the identity check, since the re-sync takes its status from the verification provider. Edit a verification only when you mean to have it re-reviewed.
The card-processing application itself is never approved or declined by this endpoint.
PUT
/
v1
/
platform
/
merchant-onboarding
Update a Pending Card Processing Application
curl --request PUT \
--url https://api-sandbox.finogates.com/v1/platform/merchant-onboarding \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form 'payload=<string>' \
--form 'voided_check=<string>' \
--form 'bank_statements=<string>' \
--form 'processing_statements=<string>' \
--form voided_check.0='@example-file' \
--form bank_statements.0='@example-file' \
--form processing_statements.0='@example-file'import requests
url = "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding"
files = {
"voided_check.0": ("example-file", open("example-file", "rb")),
"bank_statements.0": ("example-file", open("example-file", "rb")),
"processing_statements.0": ("example-file", open("example-file", "rb"))
}
payload = {
"payload": "<string>",
"voided_check": "<string>",
"bank_statements": "<string>",
"processing_statements": "<string>"
}
headers = {"Authorization": "Bearer <token>"}
response = requests.put(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('payload', '<string>');
form.append('voided_check', '<string>');
form.append('bank_statements', '<string>');
form.append('processing_statements', '<string>');
form.append('voided_check.0', '{
"fileName": "example-file"
}');
form.append('bank_statements.0', '{
"fileName": "example-file"
}');
form.append('processing_statements.0', '{
"fileName": "example-file"
}');
const options = {method: 'PUT', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api-sandbox.finogates.com/v1/platform/merchant-onboarding', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.finogates.com/v1/platform/merchant-onboarding"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://api-sandbox.finogates.com/v1/platform/merchant-onboarding")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.finogates.com/v1/platform/merchant-onboarding")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"payload\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"voided_check.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"bank_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"processing_statements.0\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"status_code": 200,
"data": {
"user_id": "228e4b03-6831-4b63-ad8e-2250d01f6d64",
"kyb_id": "69b336da-331c-4ddf-8ac5-0a0557c7f279",
"card_acquiring_id": "07f78e86-b3c6-4761-84ae-22176ca015c1"
},
"query_generated_time": 1712847600000
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
multipart/form-data
The application to edit and the fields to change, sent as JSON text. Only card_acquiring_id is required.
Replacement voided check. Omit to keep the stored one.
Replacement bank statements. Omit to keep the stored one.
Replacement processing statements. Omit to keep the stored one.