> ## Documentation Index
> Fetch the complete documentation index at: https://docs.services.payward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create hosted verification

> Create or reuse the hosted verification required for the user.

PWS derives the provider, level, and verification type from the current KYC requirement. The result contains the public verification ID and one or more hosted methods, or `not_required` when the user has no actionable requirement.



## OpenAPI

````yaml https://dsct1ci24fgcu.cloudfront.net/prod/merged/openapi.json post /v1/users/{user_id}/verifications/hosted
openapi: 3.1.0
info:
  title: PWS Public API
  version: '1'
  description: >-
    Integrate with Payward Services to onboard users, manage accounts and funds,
    trade assets, and receive event notifications.
  contact:
    name: Payward Services
servers:
  - url: https://api.services.payward.com
security: []
tags:
  - name: Assets
    description: List the assets PWS is willing to swap.
    x-displayName: Assets
  - name: Conversions
    description: >-
      Rule-driven and on-demand fiat ↔ crypto value movement, including
      conversion rules and deposits.
    x-displayName: Conversions
  - name: Earn
    description: >-
      Manage Auto Earn preferences and retrieve allocation and reward
      information.
    x-displayName: Earn
  - name: Funding
    description: >-
      Discover deposit and withdrawal options, manage deposit addresses, and
      move funds between accounts.
    x-displayName: Funding
  - name: Derivative transfers
    description: >-
      Move funds between an account's spot balance and the same owner's futures
      balance.
    x-displayName: Derivative transfers
  - name: Portfolio
    description: 'Inspect a customer''s portfolio: balances, valuations, and transactions.'
    x-displayName: Portfolio
  - name: Ramp
    description: >-
      Support Ramp flows with discovery, quotes, limits, and hosted checkout
      experiences.
    x-displayName: Ramp
  - name: Reports
    description: Settlement and reconciliation reports for the partner.
    x-displayName: Reports
  - name: Swaps
    description: Account-funded quotes that lock a price until they expire or are executed.
    x-displayName: Swaps
  - name: Onchain quotes
    description: Wallet-funded quotes that return the data needed to settle onchain.
    x-displayName: Onchain quotes
  - name: Price trigger swaps
    description: Swaps that wait for a target price before submitting a trade.
    x-displayName: Price trigger swaps
  - name: Travel Rule verifications
    description: Travel Rule address ownership verification flows.
    x-displayName: Travel Rule verifications
  - name: Users
    description: >-
      User onboarding and status flows that the partner manages.


      - **Create User** provisions an account-owned user from an external
      reference and optional email.

      - **Get User** retrieves the user's profile, verification status, and
      required actions.


      Use the returned user `id` for calls that require the user's identifier.
    x-displayName: Users
  - name: Verifications
    description: Identity verification (KYC) submission and status for end users.
    x-displayName: Verifications
  - name: Webhooks
    description: >-
      Register HTTPS destinations to receive event deliveries, rotate signing
      secrets, and inspect, update, or delete existing subscriptions. Each
      subscription is owned by the authenticated partner; deliveries are signed
      with HMAC-SHA256 and retried on transient failures.
    x-displayName: Webhooks
paths:
  /v1/users/{user_id}/verifications/hosted:
    post:
      tags:
        - Verifications
      summary: Create hosted verification
      description: >-
        Create or reuse the hosted verification required for the user.


        PWS derives the provider, level, and verification type from the current
        KYC requirement. The result contains the public verification ID and one
        or more hosted methods, or `not_required` when the user has no
        actionable requirement.
      operationId: createHostedVerification
      parameters:
        - $ref: '#/components/parameters/UserId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Verifications_HostedVerificationRequest'
            examples:
              hosted-verification:
                summary: Start or reuse the required hosted verification
                value: {}
      responses:
        '200':
          description: >-
            Verification ID and hosted methods returned, or no hosted
            verification required.
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/Verifications_HostedVerificationResponseBody
              examples:
                methods:
                  summary: Web and embedded methods are available
                  value:
                    data:
                      verification_id: PVABCDE-FGHIJ-KLMNOP
                      methods:
                        web:
                          url: https://in.sumsub.com/websdk/pws-example
                          expires_at: '2026-07-29T18:00:00Z'
                        embedded:
                          sumsub:
                            access_token: <redacted>
                            user_id: AA45N8G4MLDYWAR7
                            expires_at: '2026-07-29T18:00:00Z'
                not-required:
                  summary: No user-actionable verification is required
                  value:
                    data:
                      not_required: {}
          headers:
            X-Trace-Id:
              $ref: '#/components/headers/TraceId'
            Strict-Transport-Security:
              $ref: '#/components/headers/StrictTransportSecurity'
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
        '400':
          $ref: '#/components/responses/VerificationsBadRequestResponse'
        '401':
          $ref: '#/components/responses/VerificationsUnauthenticatedResponse'
        '403':
          $ref: '#/components/responses/VerificationsForbiddenResponse'
        '429':
          $ref: '#/components/responses/VerificationsResourceExhaustedResponse'
        '500':
          $ref: '#/components/responses/VerificationsInternalResponse'
        '501':
          $ref: '#/components/responses/VerificationsUnimplementedResponse'
        '503':
          $ref: '#/components/responses/VerificationsUnavailableResponse'
        '504':
          $ref: '#/components/responses/VerificationsDeadlineExceededResponse'
      security:
        - ApiKey: []
          ApiSign: []
          ApiNonce: []
      x-codeSamples:
        - lang: bash
          label: curl
          source: >-
            curl -X POST
            "https://api.services.payward.com/v1/users/AA45N8G4MLDYWAR7/verifications/hosted"
            \
              -H "API-Key: $PWS_API_KEY" \
              -H "API-Nonce: $PWS_API_NONCE" \
              -H "API-Sign: $PWS_API_SIGN" \
              -H "Content-Type: application/json" \
              -d '{}'
components:
  parameters:
    UserId:
      name: user_id
      in: path
      required: true
      example: AA23N84GGQN4WE6I
      schema:
        $ref: '#/components/schemas/UserId'
  schemas:
    Verifications_HostedVerificationRequest:
      type: object
      description: >-
        Empty request body. PWS derives the provider and verification
        requirement.
      additionalProperties: false
      properties: {}
      example: {}
    Verifications_HostedVerificationResponseBody:
      description: >-
        Hosted verification methods available to the user, or an indication that
        none are required.
      type: object
      additionalProperties: false
      properties:
        data:
          description: Hosted verification result for the user's current requirements.
          title: HostedVerificationResult
          oneOf:
            - $ref: >-
                #/components/schemas/Verifications_HostedVerificationMethodsResult
            - $ref: >-
                #/components/schemas/Verifications_HostedVerificationNotRequiredResult
      required:
        - data
    UserId:
      description: Globally unique public identifier for a user.
      type: string
      minLength: 14
      maxLength: 42
    Verifications_HostedVerificationMethodsResult:
      title: Verification methods
      description: >-
        Public verification ID and hosted methods that the user can use to
        complete the required verification.
      type: object
      additionalProperties: false
      properties:
        methods:
          $ref: '#/components/schemas/Verifications_HostedVerificationMethods'
          description: Interfaces available for completing the hosted verification.
        verification_id:
          type: string
          description: >-
            Public identifier for the created or reused Payward-managed
            verification.
          pattern: ^PV[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{6}$
          minLength: 20
          maxLength: 20
          example: PVABCDE-FGHIJ-KLMNOP
      required:
        - methods
        - verification_id
    Verifications_HostedVerificationNotRequiredResult:
      title: Not required
      description: Indicates that the user has no hosted verification to complete.
      type: object
      additionalProperties: false
      properties:
        not_required:
          type: object
          additionalProperties: false
          description: The user has no actionable KYC requirement.
      required:
        - not_required
    BadRequestError:
      title: Bad Request
      description: Request validation failed or the request could not be processed.
      oneOf:
        - title: Bad Request
          allOf:
            - $ref: '#/components/schemas/PwsValidationErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsValidationError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 400
                        code:
                          type: string
                          enum:
                            - bad_request
        - title: Gateway
          description: >-
            Gateway-level validation failure returned before the request reaches
            the service.
          allOf:
            - $ref: '#/components/schemas/PwsValidationErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsValidationError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 400
                        code:
                          type: string
                          const: gateway
    UnauthenticatedError:
      title: Unauthenticated
      description: Authentication credentials are missing, invalid, or not accepted.
      oneOf:
        - title: Unauthenticated
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 401
                        code:
                          type: string
                          enum:
                            - unauthenticated
        - title: Gateway
          description: Authentication failure returned by the API gateway.
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 401
                        code:
                          type: string
                          const: gateway
    ForbiddenError:
      title: Forbidden
      description: The caller is not allowed to perform this operation.
      oneOf:
        - title: Forbidden
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 403
                        code:
                          type: string
                          enum:
                            - forbidden
        - title: Gateway
          description: Authorization failure returned by the API gateway.
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 403
                        code:
                          type: string
                          const: gateway
    ResourceExhaustedError:
      description: The request was rate limited or a resource quota was exhausted.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 429
                    code:
                      type: string
                      enum:
                        - resource_exhausted
    InternalError:
      description: An unexpected server-side error occurred.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 500
                    code:
                      type: string
                      enum:
                        - internal
    UnimplementedError:
      description: The requested operation is not implemented.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 501
                    code:
                      type: string
                      enum:
                        - unimplemented
    UnavailableError:
      description: The service is temporarily unavailable.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 503
                    code:
                      type: string
                      enum:
                        - unavailable
    DeadlineExceededError:
      description: The request deadline was exceeded before a response could be produced.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 504
                    code:
                      type: string
                      enum:
                        - deadline_exceeded
    Verifications_HostedVerificationMethods:
      description: >-
        Hosted verification methods available through web, embedded, or both
        interfaces.
      oneOf:
        - $ref: '#/components/schemas/Verifications_HostedVerificationWebOnlyMethods'
        - $ref: >-
            #/components/schemas/Verifications_HostedVerificationEmbeddedOnlyMethods
        - $ref: >-
            #/components/schemas/Verifications_HostedVerificationWebAndEmbeddedMethods
    PwsValidationErrorEnvelope:
      description: Error envelope for request validation failures.
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/PwsValidationError'
          description: Validation error details.
    PwsValidationError:
      description: Standard PWS API error object for request validation failures.
      type: object
      required:
        - type
        - status
        - instance
        - code
      properties:
        type:
          description: Machine-readable error class.
          type: string
        status:
          description: HTTP status code returned for this error.
          type: integer
          format: int32
        instance:
          description: Request identifier for this specific error occurrence.
          type: string
        code:
          description: Stable machine-readable error code.
          type: string
        doc_url:
          description: Optional link to documentation for this error.
          type: string
          format: uri
        causes:
          description: Validation failures that contributed to the error.
          type: array
          items:
            $ref: '#/components/schemas/PwsErrorCause'
    PwsGeneralErrorEnvelope:
      description: Error envelope for operational or domain failures.
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/PwsGeneralError'
          description: General error details.
    PwsGeneralError:
      description: Standard PWS API error object for non-validation failures.
      allOf:
        - $ref: '#/components/schemas/PwsErrorBase'
        - type: object
          properties:
            causes:
              description: Additional error details, when present.
              type: array
              items:
                type: object
                additionalProperties: true
    Verifications_HostedVerificationWebOnlyMethods:
      title: Web
      description: A hosted verification that is available through the web interface only.
      type: object
      additionalProperties: false
      properties:
        web:
          $ref: '#/components/schemas/Verifications_HostedVerificationWebMethod'
          description: Configuration for the hosted web verification flow.
      required:
        - web
    Verifications_HostedVerificationEmbeddedOnlyMethods:
      title: Embedded
      description: >-
        A hosted verification that is available through an embedded provider
        interface only.
      type: object
      additionalProperties: false
      properties:
        embedded:
          $ref: '#/components/schemas/Verifications_HostedVerificationEmbeddedMethod'
          description: Configuration for the embedded verification flow.
      required:
        - embedded
    Verifications_HostedVerificationWebAndEmbeddedMethods:
      title: Web and embedded
      description: >-
        A hosted verification available through both web and embedded
        interfaces.
      type: object
      additionalProperties: false
      properties:
        web:
          $ref: '#/components/schemas/Verifications_HostedVerificationWebMethod'
          description: Configuration for the hosted web verification flow.
        embedded:
          $ref: '#/components/schemas/Verifications_HostedVerificationEmbeddedMethod'
          description: Configuration for the embedded verification flow.
      required:
        - web
        - embedded
    PwsErrorCause:
      description: A single request validation failure.
      type: object
      required:
        - field
        - message
      properties:
        field:
          description: Dot-notation path to the offending request field.
          type: string
        message:
          description: Human-readable explanation of the failed validation rule.
          type: string
    PwsErrorBase:
      description: Common fields present on every PWS API error object.
      type: object
      required:
        - type
        - status
        - instance
        - code
      properties:
        type:
          description: Machine-readable error class.
          type: string
        status:
          description: HTTP status code returned for this error.
          type: integer
          format: int32
        instance:
          description: Request identifier for this specific error occurrence.
          type: string
        code:
          description: Stable machine-readable error code.
          type: string
        doc_url:
          description: Optional link to documentation for this error.
          type: string
          format: uri
    Verifications_HostedVerificationWebMethod:
      description: Expiring link to a provider-hosted verification interface.
      type: object
      additionalProperties: false
      properties:
        url:
          type: string
          format: uri
          description: Expiring URL for the hosted verification UI.
          example: https://in.sumsub.com/websdk/pws-example
        expires_at:
          type: string
          format: date-time
          description: Time when the hosted URL expires.
          example: '2026-07-29T18:00:00Z'
      required:
        - url
        - expires_at
    Verifications_HostedVerificationEmbeddedMethod:
      description: Provider-specific configuration for an embedded verification flow.
      type: object
      additionalProperties: false
      properties:
        sumsub:
          $ref: '#/components/schemas/Verifications_SumsubEmbeddedVerificationMethod'
      required:
        - sumsub
    Verifications_SumsubEmbeddedVerificationMethod:
      description: >-
        Expiring credentials for starting an embedded Sumsub verification
        session.
      type: object
      additionalProperties: false
      properties:
        access_token:
          type: string
          description: Expiring Sumsub SDK access token.
        user_id:
          $ref: '#/components/schemas/UserId'
        expires_at:
          type: string
          format: date-time
          description: Time when the embedded session expires.
          example: '2026-07-29T18:00:00Z'
      required:
        - access_token
        - user_id
        - expires_at
  headers:
    TraceId:
      description: Trace identifier for the request. Include it when contacting support.
      schema:
        type: string
        example: 4bf92f3577b34da6a3ce929d0e0e4736
    StrictTransportSecurity:
      description: Enforces HTTPS for the duration specified by `max-age`.
      schema:
        type: string
        example: max-age=31536000; includeSubDomains; preload
    CacheControl:
      description: Prevents caching of sensitive financial data. Always `no-store`.
      schema:
        type: string
        enum:
          - no-store
        example: no-store
  responses:
    VerificationsBadRequestResponse:
      description: Validation error
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BadRequestError'
          examples:
            bad-request:
              value:
                error:
                  type: validation_error
                  status: 400
                  instance: req_123
                  code: bad_request
    VerificationsUnauthenticatedResponse:
      description: Authentication required
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnauthenticatedError'
          examples:
            unauthenticated:
              value:
                error:
                  type: authentication_error
                  status: 401
                  instance: req_123
                  code: unauthenticated
    VerificationsForbiddenResponse:
      description: Forbidden
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
          examples:
            forbidden:
              value:
                error:
                  type: authorization_error
                  status: 403
                  instance: req_123
                  code: forbidden
    VerificationsResourceExhaustedResponse:
      description: Rate limit exceeded
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ResourceExhaustedError'
          examples:
            resource-exhausted:
              value:
                error:
                  type: rate_limit_error
                  status: 429
                  instance: req_123
                  code: resource_exhausted
    VerificationsInternalResponse:
      description: Internal server error
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/InternalError'
          examples:
            internal-error:
              value:
                error:
                  type: internal_error
                  status: 500
                  instance: req_123
                  code: internal
    VerificationsUnimplementedResponse:
      description: Error response
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnimplementedError'
          examples:
            unimplemented:
              value:
                error:
                  type: api_error
                  status: 501
                  instance: req_123
                  code: unimplemented
    VerificationsUnavailableResponse:
      description: Service unavailable
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnavailableError'
          examples:
            unavailable:
              value:
                error:
                  type: service_error
                  status: 503
                  instance: req_123
                  code: unavailable
    VerificationsDeadlineExceededResponse:
      description: Deadline exceeded
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/DeadlineExceededError'
          examples:
            deadline-exceeded:
              value:
                error:
                  type: service_error
                  status: 504
                  instance: req_123
                  code: deadline_exceeded
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: API-Key
      description: Your public API key. Identifies the partner making the request.
    ApiSign:
      type: apiKey
      in: header
      name: API-Sign
      description: HMAC signature over the request, computed with your private key.
    ApiNonce:
      type: apiKey
      in: header
      name: API-Nonce
      description: Monotonically increasing nonce included in the request signature.

````