You are building customer onboarding for BlindPay into my application, covering individuals (KYC) and businesses (KYB).
Before writing code, read these sources and follow them over any prior knowledge:
- https://blindpay.com/docs/llms.txt (read customers, the KYC knowledge base pages, supported countries, and webhooks)
- The OpenAPI spec: curl https://api.blindpay.com/doc
Build the pipeline:
1. Terms of service: POST /v1/e/instances/{instance_id}/tos with a UUID idempotency_key, open the returned session URL for the user, capture completion via the tos.accept webhook.
2. Document uploads: POST /v1/upload?instance_id=... (multipart) for ID documents, selfies, and KYB documents; optionally pre-screen with POST /v1/upload/analyze and warn users when approval_rate is low. Enforce the format rules: PDF/JPEG/PNG, max 5 MB, no screenshots or cropped photos.
3. Create the customer: POST /v1/instances/{instance_id}/customers with type individual or business, and kyc_type standard or enhanced. Route users from high-risk countries to enhanced KYC and block prohibited countries before calling the API.
4. Drive state from webhooks (customer.new, customer.update): handle verifying, approved, rejected, compliance_request (blocking RFI), and approved_rfi (non-blocking RFI). On rejection, surface kyc_warnings and create a new customer rather than editing the rejected one.
5. RFI handling: on compliance_request, fetch the request with GET /v1/instances/{instance_id}/customers/{customer_id}/rfi, collect what is asked, and submit once via POST to the same path. Submission is single-shot and expires at expires_at (27 days), so validate everything client-side first.
Constraints:
- API keys stay server-side. Verify Svix signatures on webhooks.
- Development instances auto-approve KYC (a customer named "Fail" forces rejection), so use that to test both paths.
- Persist re_ and rfi_ IDs and every status transition for audit.
Deliverables: onboarding service, upload helper, webhook-driven state machine for customer status, RFI flow, and a mapping of which form fields are required for individual standard, individual enhanced, and business customers.