> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dev.symbiosis.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# The caller's identity verification status.

> Takes the `kyc_challenge` from login. No session is issued until the status is `approved`.



## OpenAPI

````yaml /openapi.yaml get /auth/kyc
openapi: 3.1.0
info:
  title: Symbiosis API
  description: >-
    The Symbiosis REST API.


    ## Authentication


    Endpoints accept one of two credentials:


    - **Session token**: `Authorization: Bearer <token>`, from `POST
    /auth/login`.

    - **API key (HMAC)**: three headers on every request:
      - `APIKEY`: the API key id, from `POST /auth/api-keys`.
      - `X-Hmac-Timestamp`: current Unix time in milliseconds.
      - `X-Hmac-Signature`: Base64-encoded HMAC-SHA256 of
        `timestamp_ms "\n" METHOD "\n" PATH_AND_QUERY "\n" BODY`, keyed with the API key
        secret. `PATH_AND_QUERY` is the full request target including the query string.

    ## Wire formats


    Token amounts (`U256`) serialize in responses as 0x-prefixed hex strings;
    requests accept decimal strings, 0x-prefixed hex strings, or JSON numbers.
    Asset ids and addresses are 0x-prefixed hex strings. Prices are integers
    scaled by 1e6.


    ## Request ids


    Every response carries an `x-request-id` header: a server-minted UUID that
    keys our logs. Include it when reporting a problem. The server never adopts
    an id you send; an inbound `x-request-id` is logged alongside ours, so a
    request that never got a response can still be found.


    ## Identifiers and uniqueness


    For integrators mirroring this API into their own storage:


    - **Globally unique, never reused**: `user_id`, `api_key_id`, `request_id`,
    `quote_id`, `match_id`, `withdrawal_id`, `job_id`, audit event `id`. The
    ledger's `entry_id` is also strictly increasing: a safe dedupe key and
    cursor.

    - **Unique per user**: `client_withdrawal_id`, the caller-chosen idempotency
    key. Replaying the same id and terms returns the original withdrawal; the
    same id with different terms returns 409.

    - **Composite keys**: an outcome token is `(venue, asset_id)`, never
    `asset_id` alone; balances are keyed by `(user, venue, asset_id)`, with USDC
    held separately.

    - **Not unique**: a ledger `ref_id` (every entry the same record caused
    shares it) and a withdrawal's `transaction_hash` (it can change if the job
    is re-signed; key on `job_id`).
  version: 0.1.0
servers:
  - url: https://api.symbiosis.markets
security: []
tags:
  - name: auth
    description: Accounts, sessions, API keys, and websocket tickets.
  - name: custody
    description: Deposit addresses, balances, and withdrawals.
  - name: rfq
    description: Quote requests, quotes, and matching.
paths:
  /auth/kyc:
    get:
      tags:
        - auth
      summary: The caller's identity verification status.
      description: >-
        Takes the `kyc_challenge` from login. No session is issued until the
        status is `approved`.
      operationId: kyc_status
      responses:
        '200':
          description: The caller's identity verification status.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KycStatusResponse'
        '401':
          description: Invalid or missing KYC challenge.
      security:
        - KycChallengeBearer: []
components:
  schemas:
    KycStatusResponse:
      description: The caller's identity verification status.
      type: object
      properties:
        can_start:
          description: Whether `POST /auth/kyc/inquiry` returns a link in this state.
          type: boolean
        inquiry_id:
          description: The current Persona inquiry, if any.
          type:
            - string
            - 'null'
        status:
          $ref: '#/components/schemas/KycStatus'
        updated_at:
          description: When Persona last reported on the inquiry.
          type:
            - string
            - 'null'
          format: date-time
      required:
        - status
        - can_start
    KycStatus:
      description: >-
        Identity verification status. Only an `approved` account is issued a
        session.
      oneOf:
        - description: No inquiry yet. The user can start one.
          type: string
          const: not_started
        - description: An inquiry is open. The user can resume it.
          type: string
          const: in_progress
        - description: The flow is complete. No decision yet.
          type: string
          const: under_review
        - description: Verified. The account is usable.
          type: string
          const: approved
        - description: Rejected. Only a reversal in Persona's dashboard changes this.
          type: string
          const: declined
        - description: The inquiry lapsed. The user can start a new one.
          type: string
          const: expired
        - description: The user ran out of attempts. The user can start a new one.
          type: string
          const: failed
  securitySchemes:
    KycChallengeBearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        KYC challenge from `POST /auth/login`, returned instead of a session
        token until the account is approved.

````