Overview

The Reap Compliance API verifies cardholders and businesses for card issuance through Reap Cards API or via BIN sponsorship route. Four integration methods are supported across two entity types, differentiated by where verification is collected and how it is submitted.

Approval of an entity returns a signed payload that authorises card creation through POST /cards. Approval status is delivered asynchronously by webhook.

Method Selection

Comparison

Decision Guide

Apply these in order:

1. Retail or commercial card? For retail cards, the cardholder is an INDIVIDUAL and goes through KYC. For commercial (corporate) cards, the business your program serves is a BUSINESS and goes through Universal KYB.
2. Already have a SumSub KYC contract? Use Verified Token Sharing.
3. Using a KYC provider other than SumSub, or more than one provider? Use Universal KYC.
4. Otherwise, use KYCaaS.

Verification Methods

KYCaaS

Hosted identity verification for individual cardholders through the SumSub WebSDK. Reap orchestrates the verification and returns the decision via webhook.

KYCaaS Integration Guide

Verified Token Sharing

Reuse of a verification already completed in the integrator's SumSub account, imported as a share token. Cardholders are held to a Reap-defined SumSub Partner Level, and Reap issues the final decision

• A token minted against any other level fails ingestion with SHARE_TOKEN_LEVEL_MISMATCH.
• A cardholder who doesn't meet the level is rejected with LEVEL_ENFORCED_MISMATCH and reject type RETRY.
• An ingestion response of status: "completed" means the token was accepted. It is not an approval, which arrives by webhook.

Verified Token Sharing Guide

Universal KYC

Submission of individual cardholder data to Reap using a canonical payload structure, where verification is captured by the integrator's own KYC provider. Reap re-verifies every submission and issues the decision.

Behaviour after approval depends on Reap's position in the card creation path:

• Standard card issuance programs- Reap is in the card creation path. Fetch the signed payload and pass it into POST /cards. No valid signed payload, no card
• BIN sponsorship programs - Cards are created directly on the processor, so Reap cannot gate issuance at source. Every card must be linked to an approved Reap KYC record via cardProcessorPublicToken, which is mandatory at submission.

Universal KYC Guide

Universal KYB

For commercial card programs. You submit KYB on the business your program serves: its legal profile, beneficial owners, due-diligence answers and company documents. Reap Compliance reviews every case and decides. Approval enables card issuance for that business.

Universal KYB Guide

Authentication

All Reap Compliance API requests require an API key passed in the x-reap-api-key header.

x-reap-api-key: <API_KEY>

API keys are generated in the Reap Dashboard at Settings → Product Settings → KYC API Keys and are linked to a Business UUID (BUUID) that scopes all activity to the issuing business. Sandbox validation is required before switching to production keys.

Core Concepts

Business

The organisation registered with Reap, identified by a unique API Key and Business UUID (BUUID). All entities, requirements, and KYC activity are scoped to the BUUID.

Entity

The individual or business being verified. Every applicant is represented as an entity created via POST /entity with type: INDIVIDUAL or type: BUSINESS.

Reap assigns a unique entityId at creation. An optional externalId may be supplied to correlate the entity with the integrator's internal records.

{
  "entityId": "ent_123e4567-e89b-12d3-a456-426614174000",
  "externalId": "user_123"
}

Entity type by method.

Feature

A capability enabled for a business. Card Issuance is the feature governing verification and card issuance authority and must be enabled by Reap before use.

Requirement Slug

A typed name for a document category or a submission, for example ukyc-id-document for Universal KYC, or certificate-of-incorporation and ubo-kyc for Universal KYB.

Status

Every entity and requirement carries a status from the RequirementStatus enum.

Universal KYB tracks the case as a whole:

Signed Payload

A cryptographically signed object retrieved from Reap once an entity reaches APPROVED. The payload authorises card creation when passed into POST /cards.

Shape depends on the method.

External ID

An integrator supplied identifier passed as externalId and echoed back by Reap. Used to correlate Reap records with integrator internal records.

BIN Country and Jurisdiction Data

binCountry is the ISO 3166-1 alpha-3 code of the issuing BIN. The field is included only when the issuing BIN belongs to a jurisdiction with jurisdiction specific KYC requirements (currently MEX).

For Universal KYC, a matching jurisdictionData.<COUNTRY> block accompanies binCountry. The field is independent of identity.nationality, and nationality driven document requirements (such as ukyc-curp-document for Mexican nationals) are determined separately.

Webhook Notifications

Register a webhook before you start, because decisions are delivered asynchronously. Use POST /notification and subscribe to the event type for your method:

Documentation Map

Next Steps

1. Identify the appropriate integration method using the Comparison table and Decision Guide.
2. Configure the webhook endpoint first by following the Webhook Setup guide. Reap's verification decision is delivered by webhook for every method that emits one.
3. Follow the appropriate integration guide.
   • KYCaaS Integration Guide
   • SumSub KYC Sharing Guide
   • Universal KYC Guide
   • Universal KYB Guide