Compliance provider API reference

DALP exposes tenant-scoped endpoints for Sumsub, ComplyAdvantage, Elliptic, Jumio, Middesk, Onfido, Persona, Trulioo, Veriff, and other configured compliance-provider integration setup, subject mapping, webhook intake, and monitoring history.

All endpoint paths below are relative to the versioned API base path. Webhook paths are relative to the platform origin.

Provider kinds

Roles

Compliance-provider read and manage operations require one of these system roles on the active organisation:

• admin
• systemManager
• complianceManager

Integration statuses

Integration endpoints

Create integration request

POST /compliance/integrations accepts:

Webhook authentication is resolved against the selected provider. Sumsub, Elliptic, ComplyAdvantage, Sumsub AML, Sumsub KYT, Middesk, Onfido, Persona, Trulioo, and Veriff use hmac. Creation rejects a non-empty webhookIpAllowlist for those integrations because their webhook verifiers do not consult an allowlist. Jumio always resolves to basic_auth_ip_allowlist, whether the request omits webhookAuthMode or supplies the default hmac. Jumio creation requires a non-empty webhookIpAllowlist.

Sumsub credentials use:

{
  "providerKind": "sumsub",
  "credentials": {
    "appToken": "...",
    "secretKey": "..."
  }
}

Sumsub AML credentials use:

{
  "providerKind": "sumsub-aml",
  "credentials": {
    "apiToken": "...",
    "secretKey": "...",
    "webhookSigningSecret": "...",
    "levelName": "aml-monitoring-level"
  }
}

Sumsub KYT credentials use:

{
  "providerKind": "sumsub-kyt",
  "credentials": {
    "apiToken": "...",
    "secretKey": "...",
    "webhookSigningSecret": "...",
    "levelName": "kyt-monitoring-level"
  }
}

Sumsub KYT supports both entity and wallet subject mapping: the applicant id anchors the entity subject, while txn.info.address is treated as the tenant wallet and txn.counterparty.address as the other side of the monitored transaction.

Elliptic credentials use:

{
  "providerKind": "elliptic",
  "credentials": {
    "apiKey": "...",
    "apiSecret": "..."
  }
}

ComplyAdvantage credentials use:

{
  "providerKind": "complyadvantage",
  "credentials": {
    "apiToken": "...",
    "webhookSigningSecret": "..."
  }
}

Jumio credentials use:

{
  "providerKind": "jumio",
  "credentials": {
    "apiToken": "...",
    "apiSecret": "...",
    "region": "eu-1",
    "basicAuthCredentials": "..."
  },
  "webhookSigningSecret": "jumio-callback-basic-auth-secret",
  "webhookAuthMode": "basic_auth_ip_allowlist",
  "webhookIpAllowlist": ["203.0.113.10"]
}

Jumio regions are amer-1, eu-1, and sg-1. Jumio uses callback Basic Auth plus an IP allowlist instead of HMAC-only webhook authentication. The Basic Auth credential configured in the Jumio callback must match the integration webhookSigningSecret; credentials.basicAuthCredentials is provider credential material, not the callback verifier secret.

Middesk credentials use:

{
  "providerKind": "middesk",
  "credentials": {
    "apiKey": "...",
    "webhookSigningSecret": "..."
  }
}

Onfido credentials use:

{
  "providerKind": "onfido",
  "credentials": {
    "apiToken": "...",
    "webhookSigningSecret": "...",
    "region": "eu"
  }
}

Onfido regions are us, eu, and ca.

Persona credentials use:

{
  "providerKind": "persona",
  "credentials": {
    "apiToken": "...",
    "webhookSigningSecret": "...",
    "inquiryTemplateId": "itmpl_..."
  }
}

Trulioo credentials use:

{
  "providerKind": "trulioo",
  "credentials": {
    "apiKey": "...",
    "apiSecret": "...",
    "webhookSigningSecret": "..."
  }
}

Veriff credentials use:

{
  "providerKind": "veriff",
  "credentials": {
    "apiKey": "...",
    "apiSecret": "...",
    "webhookSigningSecret": "..."
  }
}

Integration response fields

Subject endpoints

create-applicant accepts:

create-applicant returns externalId and may return redirectUrl. When applicantHints.level is omitted, DALP forwards its default level value to providers that need a selector. Use that omission only when the provider tenant has a real workflow or configuration with that exact value. The default is not a portable Jumio or Onfido workflow identifier.

For Jumio, pass applicantHints.level as the tenant's workflow definition key, such as the numeric key or label configured in Jumio. DALP uses applicantHints.externalUserId, or the identity address when omitted, as the external subject id and may return a hosted web URL as redirectUrl.

For Middesk, pass applicantHints.name or businessName, applicantHints.tin, and at least one address in applicantHints.addresses. DALP stores Middesk external_id, falling back to the external subject id supplied in the request.

For Onfido, pass applicantHints.level as the active workflow id from Onfido, and pass applicantHints.firstName and applicantHints.lastName. DALP forwards optional email, phone number, redirect URLs, and locale. DALP also maps the returned Onfido applicant id when it differs from the external subject id.

For Persona, pass applicantHints.inquiryTemplateId or configure inquiryTemplateId on the integration. DALP creates an inquiry and stores the returned Persona inquiry id as the external subject id. The response may include the hosted inquiry URL as redirectUrl.

For Trulioo, pass applicantHints.countryCode and applicantHints.demographics. DALP forwards the demographics object to DataVerify as DataFields.PersonInfo. DALP stores CustomerReferenceID as the external subject id. This adapter does not return a hosted redirect URL.

For Veriff, pass applicantHints.person when pre-filling hosted session person data and applicantHints.callbackUrl when the session should carry an explicit Veriff callback URL. DALP stores vendorData as the external subject id and returns the hosted session URL as redirectUrl.

register-wallet accepts either an Elliptic wallet mapping or a ComplyAdvantage entity-search mapping:

register-wallet returns externalId and the resolved identityAddress.

Webhook paths

Provider dashboards send webhook events to:

/api/webhooks/compliance/<provider>/<integrationId>/<urlToken>

Current provider path segments are:

• sumsub
• sumsub-aml
• sumsub-kyt
• complyadvantage
• elliptic
• jumio
• middesk
• onfido
• persona
• trulioo
• veriff

The request body limit is 64 KiB.

Webhook signatures

If Sumsub omits x-payload-digest-alg, DALP uses HMAC_SHA256_HEX. Persona accepts space-separated signature sets during key rotation.

Trulioo DataVerify webhooks prefer the top-level TransactionId as the provider event id. Legacy deliveries without that stable id use a lower-trust composite fallback: SHA-256 over (TransactionId, RecordStatus, body_hash), where body_hash is the SHA-256 hex digest of the raw body.

ComplyAdvantage webhooks prefer the top-level id as the provider event id. Legacy deliveries without that stable id use a composite fallback: SHA-256 over (search_id, created_at).

Webhook processing outcomes

Monitoring fields

The monitoring endpoint returns paginated rows with:

See also

• Onboard a compliance provider
• Map compliance-provider subjects
• How compliance provider intake works