> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zapyd.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Update Document Information
> Updates the identity document details on a customer's KYC record.
Add the Zapyd "Update Document Information" call (`PATCH /cms/api/v1/kyc/update-document-info`) to my backend. Updates the identity document details on a customer's KYC record.
* Sandbox: `PATCH https://sandbox.zapyd.com/cms/api/v1/kyc/update-document-info`
* Production: `PATCH https://api.zapyd.com/cms/api/v1/kyc/update-document-info`
JSON body:
* `customer_id` (string, uuid, required): Zapyd customer ID (UUID) returned by Create Customer.
* `full_address` (string, required): Residential address. Example: `FULL_ADDRESS_OF_THE_CUSTOMER`.
* `document_type` (string, required): Document type as returned by /kyc/configuration/`{customer_id}` (e.g. PASSPORT, etc.).
* `document_front_image_url` (string, optional): Front image URL (JPG, JPEG, PNG or PDF). Required for every document type except AADHAAR, which accepts either both images or aadhaar\_json / aadhaar\_xml in document\_details.additional\_data.
* `document_back_image_url` (string, optional): Back image URL (JPG, JPEG, PNG or PDF). Same rule as document\_front\_image\_url.
* `document_details` (object, required): Must include document\_number.
* `document_number` (string, required): Document number: 6–20 letters, digits or hyphens. Example: `123456123456`.
* `additional_data` (object, optional): For AADHAAR without images, send aadhaar\_json or aadhaar\_xml here.
Success: HTTP 200, `{status: true, message, data}`. `data`: `id`, `status`, `failure_reason` (KYC failure reason when status is FAILED, otherwise null).
Errors (`{status: false, message, err_code, errors}`):
* 400 `Customer not found or access denied`: Customer not found; Customer does not belong to the organization
* 400 `KYC already in use`: KYC is being used by another customer
* 500 `Internal Server Error`
Every endpoint can also return 401 `AUTH_*` (signature, timestamp or key: fix, don't retry), and 429 or 5xx (retry with backoff).
Rules:
* Use it only after a `CUSTOMER` webhook `FAILED` with `failure_reason: DOCUMENT_VERIFICATION_FAILED`. Each update moves the customer back to `PROCESSING` and uses one of the customer's 3 KYC attempts. Wait for the `CUSTOMER` webhook again.
* Send both image URLs, except for `AADHAAR`, which also accepts `aadhaar_json` or `aadhaar_xml` in `document_details.additional_data`.
Signing (every request):
* Headers: `X-API-KEY`, `X-TIMESTAMP` (Unix seconds, within 300 s of server time; generate per request) and `X-SIGNATURE`.
* `X-SIGNATURE` = Base64(HMAC-SHA256(key = API secret, message = apiKey + "|" + timestamp + "|" + canonicalBody)). Base64 of the raw digest, not hex.
* canonicalBody: the JSON body with keys sorted at every nesting level, no whitespace (separators `,` and `:`), and every non-ASCII character escaped as lowercase `\uXXXX` (Python `json.dumps(body, sort_keys=True, separators=(",", ":"))`). Requests with no body (GET, DELETE) sign `{}`. Query parameters are not signed.
* Send the exact canonicalBody string you signed as the request body, with `Content-Type: application/json`.
* Test vector: key `3f1b2c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d`, secret `test-secret-do-not-use`, timestamp `1735689600`. Signing `{}` gives `6sCtVSRQjU9+2/af8gdwUAvY1l6Ii6ENcbRfanPkhY0=`. Body `{"customer_id":"78c99d71-f28f-47a9-8302-93b286efbe0e","amount":100.5,"currency":"INR","meta":{"note":"Café","b":2,"a":1}}` gives `l+DvQrzlKbsOSxSYOdWoWHEehcFRZfDJPKlLDkm2cSI=`.
Deliver:
1. A typed `updateDocumentInformation` function in this codebase's language and HTTP client. Reuse an existing Zapyd client and signer, or write one small shared client.
2. Config from `ZAPYD_API_KEY`, `ZAPYD_API_SECRET` and `ZAPYD_BASE_URL`. The secret stays on the server, never in a browser or app.
3. Return `data`. When `status` is false, throw an error with the HTTP status, `err_code`, `message` and `errors`. Don't show raw errors to end users.
4. Retry only 429 and 5xx: exponential backoff from 1 s, capped at 30 s, at most 5 attempts.
5. Amounts as strings. Types for every field above.
6. Tests: the signer against the test vector, and this call against sandbox.
Reference: `https://docs.zapyd.com/api-reference-exchange/endpoint/kyc/update-document-info.md`
**Update Limit**: KYC information can be updated a maximum of **3
times** per customer.
Once this limit is reached, no further updates will be allowed.
## Error Codes and Messages
| API Status Code | Response | Reason |
| - | - | - |
| 400 | Customer not found or access denied | Customer not found |
| 400 | Customer not found or access denied | Customer does not belong to the organization |
| 400 | KYC already in use | KYC is being used by another customer |
| 500 | Internal Server Error | Internal Server Error |
## OpenAPI
````yaml PATCH /kyc/update-document-info
openapi: 3.1.0
info:
title: Zapyd API
description: API for Zapyd - Customer, Payout, and Webhook services
license:
name: MIT
version: 1.0.0
servers:
- url: https://sandbox.zapyd.com/pos/api/v1
description: Payout API Base URL
variables:
base_url:
default: https://sandbox.zapyd.com
- url: https://sandbox.zapyd.com/cms/api/v1
description: Customer API Base URL
variables:
base_url:
default: https://sandbox.zapyd.com
security:
- ApiKeyAuth: []
TimestampAuth: []
SignatureAuth: []
tags:
- name: Customer
description: Customer related operations
x-displayName: Customer
x-traitTag: true
- name: Payout
description: Payout related operations
- name: Webhooks
description: Webhook related operations
- name: Widget
description: Hosted buy/sell widget session initialization
paths:
/kyc/update-document-info:
patch:
tags:
- KYC
description: Update customer's document information
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- customer_id
- full_address
- document_type
- document_details
properties:
customer_id:
type: string
format: uuid
example: 4e6f1b20-a73c-11ec-b909-0242ac120002
description: Zapyd customer ID (UUID) returned by Create Customer.
full_address:
type: string
example: FULL_ADDRESS_OF_THE_CUSTOMER
description: Residential address.
document_type:
type: string
description: >-
Document type as returned by
/kyc/configuration/{customer_id} (e.g. PASSPORT, etc.)
document_front_image_url:
type: string
description: >-
Front image URL (JPG, JPEG, PNG or PDF). Required for every
document type except AADHAAR, which accepts either both
images or aadhaar_json / aadhaar_xml in
document_details.additional_data.
format: uri
document_back_image_url:
type: string
description: >-
Back image URL (JPG, JPEG, PNG or PDF). Same rule as
document_front_image_url.
format: uri
document_details:
type: object
required:
- document_number
properties:
document_number:
type: string
example: '123456123456'
description: 'Document number: 6–20 letters, digits or hyphens.'
additional_data:
type: object
description: >-
Optional. For AADHAAR without images, send aadhaar_json
or aadhaar_xml here.
description: Required. Must include document_number.
responses:
'200':
description: Document information updated successfully
content:
application/json:
schema:
type: object
properties:
status:
type: boolean
example: true
message:
type: string
example: Success
data:
type: object
properties:
id:
type: string
format: uuid
example: 550e8400-e29b-41d4-a716-446655440000
status:
type: string
example: UNVERIFIED
failure_reason:
type:
- string
- 'null'
description: >-
KYC failure reason when status is FAILED, otherwise
null.
example: null
'500':
description: Internal Server Error
content:
application/json:
schema:
type: object
properties:
status:
type: boolean
example: false
message:
type: string
example: Internal Server Error
data:
type: 'null'
err_code:
type: string
example: SYS_INTERNAL_ERROR
errors:
type: string
example: Unexpected error occurred. Please try again later.
servers:
- url: https://sandbox.zapyd.com/cms/api/v1
description: KYC API Base URL
components:
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-KEY
description: API Key for authentication
TimestampAuth:
type: apiKey
in: header
name: X-TIMESTAMP
description: Current timestamp in seconds since epoch
SignatureAuth:
type: apiKey
in: header
name: X-SIGNATURE
description: HMAC SHA256 signature of the request encoded in Base64
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.