Create or upsert a customer
Ingest an individual customer. The record is created with
kyc_status = NOT_STARTED and added_via = INTEGRATION. No KYC is
triggered and no credits are charged — your back-office team
triggers verification from inside Instant Compliance.
Designated services
Pass designatedServices to record the specific designated
service(s) you provide to this customer, using the stable catalog
codes documented on the DesignatedServices schema (e.g.
PRO-FORMATION, RE-BROKER) and served by
GET /designated-services. This does everything the in-app
“Designated services” editor does:
isDesignatedServiceis derived from the list (non-empty →true, empty →false) — don’t send the boolean alongside the list unless they agree, or the request is rejected with422.- The customer’s risk rating is recomputed immediately, so the service’s risk tier flows into the High-risk designated service factor.
- The AML/CTF client classification is derived (new client / pre-commencement full CDD / monitoring-only).
- An empty array is an explicit “no designated services” — on
creation the record lands with
kyc_status = NOT_REQUIRED. - On an idempotent upsert (see below) the list replaces the customer’s existing designated-service set.
Unknown or non-designated codes are rejected with
422 validation_failed — nothing is silently dropped.
Without designatedServices, the legacy risk.isDesignatedService
boolean behaves as before: it sets the flag only, and your
back-office team picks the specific services in-app.
Idempotency
- If
external_idis supplied and already exists in your organisation, the existing record is updated and the response is 200 OK. - If
emailandfullName(case-insensitive) match an existing record (and the existing record has no conflictingexternal_id), the record is updated and returned with 200 OK. Email alone is not treated as unique — family members may share one address. - Otherwise a new record is created and returned with 201 Created.
Include an Idempotency-Key header to make network retries safe for
24 hours.
INTEGRATION with kyc_status = NOT_STARTED. No KYC is
triggered. No credits are charged. Your back-office team completes
the risk questions in-app and starts verification when ready.
Idempotent upsert behaviour
Retry safety
PassIdempotency-Key (a UUID or any string ≤ 255 chars). Repeated
calls with the same key within 24 hours replay the original response.
See Idempotency.Authorizations
Bearer API key issued from Settings → Developers in your
Instant Compliance organisation. Format: ic_live_….
Headers
Caller-supplied unique key for safe retries. Repeat the same key within 24 hours and we replay the original response instead of repeating the side effect. Reusing the key with a different request body returns 409 idempotency_conflict.
255Body
1 - 255255Your CRM identifier. Strongly recommended for idempotent upsert + round-tripping.
255Individual customer types — /customers only ingests these.
Entity customers (companies, trusts, partnerships, SMSFs) live on
/entities with their own EntityType.
INDIVIDUAL, SOLE_TRADER 32Optional risk pre-answers. Your back-office team will complete the full risk assessment in-app before triggering KYC; these values seed it.
The specific designated service(s) provided to the customer, as
stable catalog codes. An empty array is an explicit "no designated
services". Unknown or non-designated codes are rejected with
422 validation_failed.
The catalog is also available programmatically via
GET /designated-services.
Professional services
Real estate
Financial services
Other designated services
6464Response
Existing customer updated (idempotent upsert).
Instant Compliance customer UUID.
Individual customer types — /customers only ingests these.
Entity customers (companies, trusts, partnerships, SMSFs) live on
/entities with their own EntityType.
INDIVIDUAL, SOLE_TRADER NOT_STARTED, PENDING, IN_PROGRESS, VERIFIED, FAILED, NOT_REQUIRED, AWAITING_RESUBMISSION How the record entered Instant Compliance.
ADMIN_MANUAL, AI_EXTRACTED, CONTACT_PORTAL, BULK_IMPORT, INTEGRATION, SYSTEM Populated only when kyc_status = VERIFIED. Deliberately minimal —
full date of birth and full address are never exposed.

