Download a stored identity-verification document for one of your individual customers. The endpoint locates the customer's most recent verification record under your client, finds the file matching the requested file_role, and streams it back as a binary attachment. The download is recorded in your client's audit log.

Authentication & access

• Requires a client API token: Authorization: Bearer <token>.
• The caller must hold the kyc.users.read permission and have the OWNER or OPERATIONS role.
• Document download must be enabled for your client. If your client's verification visibility configuration does not grant the documents group, the request returns 403.

Path parameters

• user_id — the individual customer whose document you want. Must belong to your client.
• file_role — which document to download. Supported values for KYC:
  • kyc_id_front — front of the identity document
  • kyc_id_back — back of the identity document
  • kyc_selfie — selfie / liveness capture
  • kyc_poa — proof-of-address document
  • kyc_nfc_photo — photo read from the document chip

An unrecognized file_role is treated as a missing document (404).

Which record is used

The document is taken from the customer's most recent verification record (ordered by decision time, then fetch time). Records belonging to other clients are never returned, and a user_id that does not exist or has no verification record returns 404.

Response

200 OK returns the raw file as an attachment, not JSON:

• The body is the binary file content.
• Content-Type is the document's stored content type, falling back to application/octet-stream.
• Content-Disposition is attachment with the document's original filename (sanitized).
• X-Content-Type-Options: nosniff is set.

Error responses

Standard 401 (authentication), 403 (insufficient permission or role), and 429 (rate limit) responses apply to every endpoint and are documented in the Error reference.