> ## Documentation Index > Fetch the complete documentation index at: https://docs.zapyd.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate KYC Link > Generates a hosted KYC link for a customer. US customers can complete KYC only through this link. Add the Zapyd "Generate KYC Link" call (`POST /cms/api/v1/kyc/generate-link`) to my backend. Generates a hosted KYC link for a customer. US customers can complete KYC only through this link. * Sandbox: `POST https://sandbox.zapyd.com/cms/api/v1/kyc/generate-link` * Production: `POST https://api.zapyd.com/cms/api/v1/kyc/generate-link` JSON body: * `customer_id` (string, uuid, required): Zapyd customer ID (UUID) returned by Create Customer. * `redirect_url` (string, optional): Where to send the customer after the KYC flow. Defaults to the redirect URL set for your organization. Example: `https://yourapp.com/kyc/return`. Success: HTTP 200, `{status: true, message, data}`. `data`: `url`, `is_mocked` (Returned as true only when the link is a sandbox mock). Errors (`{status: false, message, err_code, errors}`): * 400 `Customer not found or access denied`: Customer not found; Customer does not belong to the organization * 400 `Bad Request`: Request validation failed (e.g. invalid `customer_id` format); Customer is not eligible to generate a KYC link in their current state * 500 `Internal Server Error` Every endpoint can also return 401 `AUTH_*` (signature, timestamp or key: fix, don't retry), and 429 or 5xx (retry with backoff). Rules: * Hosted KYC: required for USA customers, available for India. Call it after `POST /customer/create`. * Return `data.url` to the frontend and open it in the browser, a new tab or a webview (allow camera access for the selfie). Zapyd sends the user back to `redirect_url` when they finish. * Reaching `redirect_url` doesn't mean the user passed. Wait for the `CUSTOMER` webhook: `VERIFIED`, or `FAILED` with `metadata.failure_reason`. * On `FAILED`, explain the reason and generate a new link. Each customer has 3 attempts; after that, contact support. * Sandbox: skip the hosted flow and set the result with `PATCH /cms/api/v1/kyc/mock-kyc-status`. Signing (every request): * Headers: `X-API-KEY`, `X-TIMESTAMP` (Unix seconds, within 300 s of server time; generate per request) and `X-SIGNATURE`. * `X-SIGNATURE` = Base64(HMAC-SHA256(key = API secret, message = apiKey + "|" + timestamp + "|" + canonicalBody)). Base64 of the raw digest, not hex. * canonicalBody: the JSON body with keys sorted at every nesting level, no whitespace (separators `,` and `:`), and every non-ASCII character escaped as lowercase `\uXXXX` (Python `json.dumps(body, sort_keys=True, separators=(",", ":"))`). Requests with no body (GET, DELETE) sign `{}`. Query parameters are not signed. * Send the exact canonicalBody string you signed as the request body, with `Content-Type: application/json`. * Test vector: key `3f1b2c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d`, secret `test-secret-do-not-use`, timestamp `1735689600`. Signing `{}` gives `6sCtVSRQjU9+2/af8gdwUAvY1l6Ii6ENcbRfanPkhY0=`. Body `{"customer_id":"78c99d71-f28f-47a9-8302-93b286efbe0e","amount":100.5,"currency":"INR","meta":{"note":"Café","b":2,"a":1}}` gives `l+DvQrzlKbsOSxSYOdWoWHEehcFRZfDJPKlLDkm2cSI=`. Deliver: 1. A typed `generateKycLink` function in this codebase's language and HTTP client. Reuse an existing Zapyd client and signer, or write one small shared client. 2. Config from `ZAPYD_API_KEY`, `ZAPYD_API_SECRET` and `ZAPYD_BASE_URL`. The secret stays on the server, never in a browser or app. 3. Return `data`. When `status` is false, throw an error with the HTTP status, `err_code`, `message` and `errors`. Don't show raw errors to end users. 4. Retry only 429 and 5xx: exponential backoff from 1 s, capped at 30 s, at most 5 attempts. 5. Amounts as strings. Types for every field above. 6. Tests: the signer against the test vector, and this call against sandbox. Reference: `https://docs.zapyd.com/api-reference-exchange/endpoint/kyc/generate-link.md` ## Error Codes and Messages | API Status Code | Response | Reason | | - | - | - | | 400 | Customer not found or access denied | Customer not found | | 400 | Customer not found or access denied | Customer does not belong to the organization | | 400 | Bad Request | Request validation failed (e.g. invalid `customer_id` format) | | 400 | Bad Request | Customer is not eligible to generate a KYC link in their current state | | 500 | Internal Server Error | Internal Server Error | ## OpenAPI ````yaml POST /kyc/generate-link openapi: 3.1.0 info: title: Zapyd API description: API for Zapyd - Customer, Payout, and Webhook services license: name: MIT version: 1.0.0 servers: - url: https://sandbox.zapyd.com/pos/api/v1 description: Payout API Base URL variables: base_url: default: https://sandbox.zapyd.com - url: https://sandbox.zapyd.com/cms/api/v1 description: Customer API Base URL variables: base_url: default: https://sandbox.zapyd.com security: - ApiKeyAuth: [] TimestampAuth: [] SignatureAuth: [] tags: - name: Customer description: Customer related operations x-displayName: Customer x-traitTag: true - name: Payout description: Payout related operations - name: Webhooks description: Webhook related operations - name: Widget description: Hosted buy/sell widget session initialization paths: /kyc/generate-link: post: tags: - KYC description: >- Creates a one-time URL for Zapyd's hosted KYC flow. Send the customer to data.url. Fails if the customer is already VERIFIED or a KYC is in review. requestBody: required: true content: application/json: schema: type: object required: - customer_id properties: customer_id: type: string format: uuid example: 075986f3-282b-4555-bfcd-fad973e32596 description: Zapyd customer ID (UUID) returned by Create Customer. redirect_url: type: string format: uri example: https://yourapp.com/kyc/return description: >- Optional. Where to send the customer after the KYC flow. Defaults to the redirect URL set for your organization. responses: '200': description: Hosted KYC URL generated successfully content: application/json: schema: type: object properties: status: type: boolean example: true message: type: string example: Success data: type: object properties: url: type: string format: uri example: >- https://app.zapyd.com/kyc?kyc_id=977c8923-3818-4880-bfbf-65436635ea91 is_mocked: type: boolean description: Returned as true only when the link is a sandbox mock. example: true '500': description: Internal Server Error content: application/json: schema: type: object properties: status: type: boolean example: false message: type: string example: Internal Server Error data: type: 'null' err_code: type: string example: SYS_INTERNAL_ERROR errors: type: string example: Unexpected error occurred. Please try again later. servers: - url: https://sandbox.zapyd.com/cms/api/v1 description: KYC API Base URL components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-KEY description: API Key for authentication TimestampAuth: type: apiKey in: header name: X-TIMESTAMP description: Current timestamp in seconds since epoch SignatureAuth: type: apiKey in: header name: X-SIGNATURE description: HMAC SHA256 signature of the request encoded in Base64 ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.