Skip to main content
POST
cURL
Ingest an individual customer. The record lands in your organisation tagged INTEGRATION, and kyc_status is derived by the same AML/CTF rule as in-app onboarding: providing a designated service makes customer due diligence required (NOT_STARTED — KYC is owed but not begun); an explicit “no designated services” (empty designatedServices list, or risk.isDesignatedService: false) lands NOT_REQUIRED. Ingesting never triggers KYC and never charges. Start verification when you’re ready with POST /customers/{id}/kyc, or from inside Instant Compliance.

Structured names

You can send firstName / middleName / lastName alongside fullName (both halves or neither). API-supplied parts are stored at inferred provenance rank, so a later correction by an officer or by the verification provider always wins.

Existing (pre-commencement) clients

With risk.isNewCustomer: false you can also supply:
  • clientSinceDate — when the relationship began.
  • preCommencementAssessment — the s36(4) trigger assessment for new designated services. A recorded no-trigger assessment (no significant change, or resulting risk LOW) keeps the client on the monitoring-only carve-out: services are recorded but kyc_status = NOT_REQUIRED. Without an assessment the conservative rule applies (any designated service ⇒ CDD required).
  • preExistingServices (+ preExistingServiceSince) — services you were already providing before commencement, on the “no new services” branch. History + risk only; never triggers CDD, and cannot be combined with a non-empty designatedServices list.
These run through the same engine as the in-app onboarding wizard, so the outcomes are identical. The assessment is create-time only — it describes the moment services were recorded and is not accepted on updates. The screening booleans on risk (met face-to-face, cash business, etc.) ARE accepted on update.

Power of Attorney

Pass representative: { fullName, email } to record an attorney acting under a Power of Attorney at create time. Verification links are later addressed to the active representative.

Sole traders

With type: SOLE_TRADER you can also pass the individual’s registered businessName and abn (11 digits). When an ABN is supplied the server runs its own ABR lookup and, on an active match, marks the business as register-verified on the record — best-effort: an ABR miss or outage never blocks ingest, and your team can re-verify in-app. These two fields are rejected for plain individuals.

Idempotent upsert behaviour

This lets a Zapier “Create / Update Customer” action send the same event repeatedly without creating duplicates.

Retry safety

Pass Idempotency-Key (a UUID or any string ≤ 255 chars). Repeated calls with the same key within 24 hours replay the original response. See Idempotency.

Authorizations

Authorization
string
header
required

Bearer API key issued from Settings → Developers in your Instant Compliance organisation. Format: ic_live_….

Headers

Idempotency-Key
string

Caller-supplied unique key for safe retries. Repeat the same key within 24 hours and we replay the original response instead of repeating the side effect. Reusing the key with a different request body returns 409 idempotency_conflict.

Maximum string length: 255

Body

application/json
fullName
string
required
Required string length: 1 - 255
email
string<email>
required
Maximum string length: 255
externalId
string

Your CRM identifier. Strongly recommended for idempotent upsert + round-tripping.

Maximum string length: 255
type
enum<string>

Individual customer types — /customers only ingests these. Entity customers (companies, trusts, partnerships, SMSFs) live on /entities with their own EntityType.

Available options:
INDIVIDUAL,
SOLE_TRADER
firstName
string | null

Optional structured name parts (send both firstName and lastName, or neither). Stored at inferred provenance rank — a later officer or verification-provider read can correct them.

Maximum string length: 255
middleName
string | null
Maximum string length: 255
lastName
string | null
Maximum string length: 255
phone
string | null
Maximum string length: 32
clientSinceDate
string<date> | null

When the relationship began (yyyy-mm-dd, not in the future). Existing clients only — requires risk.isNewCustomer: false.

preCommencementAssessment
object

The s36(4) trigger assessment for an existing (pre-commencement) client receiving new designated services. Requires risk.isNewCustomer: false and a non-empty designatedServices list. Initial CDD is triggered only when BOTH limbs are met — a significant change in the relationship AND resulting medium/high risk. A recorded no-trigger assessment keeps the client on the monitoring-only carve-out (kyc_status/kyb_status = NOT_REQUIRED) even though services are recorded; without an assessment the conservative rule applies (any designated service ⇒ CDD required).

preExistingServices
string[]

Designated services you were ALREADY providing before commencement ("no new services" branch). History + risk only — they never trigger CDD. Requires risk.isNewCustomer: false; cannot be combined with a non-empty designatedServices list.

Maximum array length: 64
Maximum string length: 64
Example:
preExistingServiceSince
string<date> | null

Approximate start date of the pre-existing service(s).

representative
object | null

Attorney acting under a Power of Attorney. Creates a representative on the record; verification links are later addressed to them.

businessName
string | null

Sole-trader registered business name (type: SOLE_TRADER only) — rejected for plain individuals.

Maximum string length: 255
abn
string | null

Sole-trader ABN, 11 digits (spaces tolerated; type: SOLE_TRADER only). When supplied, the server runs its own ABR lookup and marks the business register-verified on an active match — best-effort, never blocking ingest.

risk
object

Optional risk pre-answers. Your back-office team will complete the full risk assessment in-app before triggering KYC; these values seed it.

designatedServices
string[]

The specific designated service(s) provided to the customer, as stable catalog codes. An empty array is an explicit "no designated services". Unknown or non-designated codes are rejected with 422 validation_failed.

The catalog is also available programmatically via GET /designated-services.

Professional services

Real estate

Financial services

Other designated services

Maximum array length: 64
Maximum string length: 64
Example:

Response

Existing customer updated (idempotent upsert).

id
string<uuid>
required

Instant Compliance customer UUID.

type
enum<string>
required

Individual customer types — /customers only ingests these. Entity customers (companies, trusts, partnerships, SMSFs) live on /entities with their own EntityType.

Available options:
INDIVIDUAL,
SOLE_TRADER
full_name
string
required
kyc_status
enum<string>
required
Available options:
NOT_STARTED,
PENDING,
IN_PROGRESS,
VERIFIED,
FAILED,
NOT_REQUIRED,
AWAITING_RESUBMISSION
aml
object
required
added_via
enum<string>
required

How the record entered Instant Compliance.

Available options:
ADMIN_MANUAL,
AI_EXTRACTED,
CONTACT_PORTAL,
BULK_IMPORT,
INTEGRATION,
SYSTEM
created_at
string<date-time>
required
updated_at
string<date-time>
required
external_id
string | null
email
string<email> | null
kyc_started_at
string<date-time> | null
kyc_completed_at
string<date-time> | null
identity
object | null

Populated only when kyc_status = VERIFIED. Deliberately minimal — full date of birth and full address are never exposed.