Lists every extracted verification record for a single business, newest first. Each record is a curated, normalized snapshot of a KYB verification result. Unlike GET /api/v1/kyb/detail/{business_id}, which returns only the most recent record, this endpoint returns the full history so you can see how a business's verification evolved over time. Records are scoped to the authenticated client, so only records belonging to the caller's own client are returned.

Authentication & access

• Requires a Bearer token in the Authorization header.
• Permission: kyb.businesses.read.
• Allowed roles: owner and operations.

Path parameters

• business_id (string, required) - the business customer ID whose verification history you want to retrieve.

Behavior

• Records are filtered to the business identified by business_id AND the authenticated client. Records belonging to another client are never returned.
• Ordering is decision_at descending (records without a decision timestamp sorted last), then fetched_at descending. This puts the most recently decided record first.
• This is a curated, client-facing view. A fixed baseline (identity/company headline, check statuses and scores, AML hit count, data_trusted, and timestamps) is always present. The extended groups (business_registry_details, business_key_people, aml_hits, documents, plus the KYC-style document_number, sof_questionnaire, poa) are included only when your client has been granted that visibility group; otherwise they are returned as null.

Responses

• 200 OK - returns a VerificationDetailHistoryResponse object with a single field records, an array of verification-record objects ordered newest first.
• If the business has no verification records, or business_id does not match any record owned by the caller's client, records is an empty array. This endpoint does not return 404 for an unknown or empty business.

Each item in records contains:

Baseline (always present):

• status - one of approved, declined, in_review, pending, expired, unknown.
• kind - kyc or kyb. For this endpoint records are kyb.
• data_trusted - boolean indicating whether the extracted data is from a trusted (approved) decision.
• decision_at - decision timestamp, nullable.
• fetched_at - when the record was fetched.
• Company headline (all nullable): company_name, registration_number, registration_country, company_type, incorporation_date, registry_status.
• Extracted identity/document fields (all nullable, populated for the verified representative): first_name, last_name, full_name, date_of_birth, nationality, document_type, document_issuing_country, document_expiry, gender.
• Check outcomes (all nullable): liveness_status, liveness_score, face_match_status, face_match_score, nfc_status, poa_status, aml_status, aml_total_hits. These check-result fields are populated only when the corresponding check was part of the verification performed; otherwise they are null.

Extended groups (present only when your client is granted the corresponding visibility group; otherwise null):

• business_registry_details - object with registry address, tax number, registered capital, nature of business, contacts, legal entity identifier, risk level, and registry source.
• business_key_people - array of UBOs / officers / directors with ownership information.
• aml_hits - array of AML hit detail objects.
• documents - array of downloadable file-role identifiers for this record.
• document_number - the decrypted document number.
• sof_questionnaire - source-of-funds answers, object.
• poa - proof-of-address extracted fields, object.

Error responses

Standard 401 (authentication), 403 (insufficient permission or role), and 429 (rate limit) responses apply to every endpoint and are documented in the Error reference.