Skip to main content
The API is built on a deliberate deny-list — responses include only fields explicitly listed in the public DTO. Everything else is withheld, even if the integration has the broadest scopes.

​
What you receive

​
What you never receive

These are withheld unconditionally:
  • amlScreeningData — the raw Sumsub case blob, including hit names, source watchlists, and media titles.
  • verifiedDateOfBirth — full date of birth.
  • verifiedAddress — full street address.
  • kycRejectionReason — free-text rejection reason (often contains sensitive moderator notes).
  • kycVerificationModeratorNote / addressVerificationModeratorNote — internal moderator notes.
  • sumsubApplicantId — the underlying Sumsub identifier.
  • Any document ids, image URLs, or file references.

​
Why

  • Regulatory minimisation. Sharing only what a downstream integrator needs to act keeps our and your AML obligations clean.
  • Breach blast radius. A leaked API key cannot exfiltrate document images or detailed AML hit data even if it has every scope.
  • Vendor-neutrality. Integrators receive a stable shape — not raw vendor (Sumsub) payloads that can change without notice.

​
Asking for a withheld field

If your use case genuinely requires a withheld field, contact support@instantcompliance.ai with the legal basis and intended use. We do not add fields to the public surface lightly — each addition is reviewed against the regulatory minimisation duty.