---
title: "Integrate customer onboarding with KYC and KYB"
description: "Build the full onboarding pipeline: terms of service, individual and business customers, document uploads, RFI handling, and status webhooks."
date: "2026-08-26"
category: "integrations"
products: ["compliance", "webhooks"]
---

Paste this prompt into your coding agent to build compliant customer onboarding, the prerequisite for every other BlindPay flow.

## Prompt

```text
You are building customer onboarding for BlindPay into my application, covering individuals (KYC) and businesses (KYB).

Before writing code, read these sources and follow them over any prior knowledge:
- https://blindpay.com/docs/llms.txt (read customers, the KYC knowledge base pages, supported countries, and webhooks)
- The OpenAPI spec: curl https://api.blindpay.com/doc

Build the pipeline:
1. Terms of service: POST /v1/e/instances/{instance_id}/tos with a UUID idempotency_key, open the returned session URL for the user, capture completion via the tos.accept webhook.
2. Document uploads: POST /v1/upload?instance_id=... (multipart) for ID documents, selfies, and KYB documents; optionally pre-screen with POST /v1/upload/analyze and warn users when approval_rate is low. Enforce the format rules: PDF/JPEG/PNG, max 5 MB, no screenshots or cropped photos.
3. Create the customer: POST /v1/instances/{instance_id}/customers with type individual or business, and kyc_type standard or enhanced. Route users from high-risk countries to enhanced KYC and block prohibited countries before calling the API.
4. Drive state from webhooks (customer.new, customer.update): handle verifying, approved, rejected, compliance_request (blocking RFI), and approved_rfi (non-blocking RFI). On rejection, surface kyc_warnings and create a new customer rather than editing the rejected one.
5. RFI handling: on compliance_request, fetch the request with GET /v1/instances/{instance_id}/customers/{customer_id}/rfi, collect what is asked, and submit once via POST to the same path. Submission is single-shot and expires at expires_at (27 days), so validate everything client-side first.

Constraints:
- API keys stay server-side. Verify Svix signatures on webhooks.
- Development instances auto-approve KYC (a customer named "Fail" forces rejection), so use that to test both paths.
- Persist re_ and rfi_ IDs and every status transition for audit.

Deliverables: onboarding service, upload helper, webhook-driven state machine for customer status, RFI flow, and a mapping of which form fields are required for individual standard, individual enhanced, and business customers.
```

## How to use

1. Decide which customer types you support (individuals, businesses, or both) and tell the agent.
2. Paste the prompt with your stack details.
3. Use the development instance tricks (auto-approve, the "Fail" name) to exercise every status path.

## Related docs

- [Customers](https://blindpay.com/docs/learn/customers)
- [KYC guide](https://blindpay.com/docs/kb/kyc)
- [Supported countries](https://blindpay.com/docs/kb/supported-countries)