Request resubmission of a user's failed verification steps on their existing verification session. The endpoint reuses the same session rather than starting a new one, so the user is not re-billed. On success it flags the failed steps for the user to redo, moves KYC back to pending (if it was not already), records an audit entry, and returns the verification link to share along with the neutral names of the steps the user must complete again.

Authentication & access

• Requires a client API token: Authorization: Bearer <token>.
• The caller must hold the kyc.verification.resubmit permission and have the OWNER or OPERATIONS role.

Path parameters

Preconditions

Self-resubmission only applies to UrbanpayX-managed verification and requires an active session that failed on user-fixable steps:

• The user must not be in external attestation mode. Users configured for external attestation are rejected (400).
• The user must have an active UrbanpayX-managed verification session. If there is none, the request is rejected (400).
• KYC status must be pending or rejected. If the user is already approved, the request returns 409; any other status returns 400.
• The session must not have expired. An expired session returns 409 — initiate verification again for that user instead.
• The failed steps must be ones the user can fix by redoing them (for example: document, selfie, liveness, or address). A failure caused by a compliance or risk check cannot be self-resubmitted and returns 422 — route those to manual handling/support.
• There must be at least one failed step eligible for resubmission. If none are found, the request returns 409.

What it does

For each user-fixable failed step, the endpoint flags it for resubmission on the existing session. If the user's KYC was rejected, it is moved back to pending and a status-change event is emitted. The action is written to the audit log. No new verification session is created and no charge is incurred.

Response

Returns 200 with a KycResubmitResponse:

• user_id — the user's ID.
• kyc_status — the user's KYC status after the request (pending once resubmission is requested).
• session_url — the verification link to share so the user can redo the flagged steps. May be null if no link is available.
• resubmit_steps — neutral names of the steps the user must redo.
• message — human-readable result.

Error responses

Standard 401 (authentication), 403 (insufficient permission or role), and 429 (rate limit) responses apply to every endpoint and are documented in the Error reference.