Skip to content

Get an organization's member-readable onboarding checklist

GET
/api/v1/organizations/{organization_id}/onboarding/checklist
curl --request GET \
--url https://api.elephants.inc/api/v1/organizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/onboarding/checklist \
--header 'Authorization: Bearer <token>'

Returns document- and field-level onboarding requirements for any organization member, including per-subject and admin-request details.

organization_id
required
string format: uuid

Organization ID

Organization onboarding checklist

Media typeapplication/json
OnboardingChecklist
object
data
required
Array<object>
OnboardingChecklistItem
object
accepted_subtypes
required
Array<object>
OnboardingChecklistSubtype
object
components
required
Array<object>
OnboardingChecklistComponent
object
document_id
required
string | null format: uuid
id
required
string format: uuid
key
required
string
label
required
string
position
required
integer
status
required
string
Allowed values: not_uploaded pending_review verified rejected expired
uploaded_at
required
string | null format: date-time
description
required
string | null
id
required
string format: uuid
key
required
string
label
required
string
status
required
string
Allowed values: not_uploaded pending_review verified rejected expired
admin_request
required
Any of:
OnboardingChecklistAdminRequest
object
id
required
string format: uuid
kyc_entity_id
required
string format: uuid
reason
required
string
requested_at
required
string format: date-time
subject_label
required
string
blocking
required
boolean
description
required
string | null
document_id
required
string | null format: uuid
field_spec
required
Any of:
OnboardingChecklistFieldSpec
object
current_display_value
required
string | null
form_schema
required

Mergeable JSON Schema (draft 2020-12) fragment for this field, keyed by its requirement key: {“properties”: {“”: …}, “required”: [“”]}. Merge the fragments across items to build one form document. Select options are oneOf entries carrying const (the id to submit) and title (the label). UI hints live under x-* keys, which conforming validators ignore: x-widget, x-searchable, x-optionsLoader (a shared catalog such as “countries”), and x-countryField (the sibling driving a subdivision lookup).

object
key
additional properties
any
is_set
required
boolean
value_type
required
string
Allowed values: string boolean integer decimal date select address
graced
required
boolean
graced_until
required
string | null format: date-time
key
required
string
kind
required
string
Allowed values: document field process imported
label
required
string
latest_event
required
Any of:
OnboardingChecklistEvent
object
occurred_at
required
string format: date-time
reason
required
string | null
type
required
string
Allowed values: rejected expired
optional
required
boolean
scope
required
string | null
status
required
string
Allowed values: not_uploaded pending_review verified rejected expired
subject_kyc_entity_id
required
string | null format: uuid
subject_label
required
string | null
uploaded_at
required
string | null format: date-time
has_more
required
boolean
next_cursor
required
string | null

Example

{
"data": [
{
"accepted_subtypes": [
{
"components": [
{
"status": "not_uploaded"
}
],
"status": "not_uploaded"
}
],
"field_spec": {
"value_type": "string"
},
"kind": "document",
"latest_event": {
"type": "rejected"
},
"status": "not_uploaded"
}
]
}

Invalid request parameters or body

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}

Missing, invalid, or expired bearer token

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}

Too many requests

Media typeapplication/json
RateLimitedError
object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string
error
required
object
type
required
string
Allowed value: rate_limited

Example

{
"error": {
"type": "rate_limited"
}
}
Retry-After
required
string

How long to wait before retrying, expressed as delay seconds or an HTTP date

Unexpected server error

Media typeapplication/json
Error

Error response. error.type is the machine-readable code — branch on it, never on error.message or the HTTP status. error.message is display-grade prose safe to render to a user; when a failure has no specific copy it falls back to a generic sentence, so it never carries a machine code. Unrecognised failures collapse to the generic unprocessable_entity code, so treat type as an open enum: match the codes you handle and fall through to a default branch for the rest.

object
error
required
object
details

Structured error details (e.g. validation errors), when present

message
required

Display-grade message, safe to render verbatim. Never a machine code — do not branch on it.

string
request_id

Correlation ID for this request (also in the x-request-id response header). Include it when contacting support.

string
step_up
Any of:
StepUpChallenge
object
delivery
required

Method used to deliver this challenge

string
expires_at
required

Challenge expiry

string | null format: date-time
id
required

Sudo session ID returned to completeStepUp

string
match_code
required

3-digit number-matching code. This response is the ORIGINATING surface: display the code; a user approving from the Ele mobile app is asked to enter it. Null only for challenges minted before match codes existed.

string | null
methods
required

Available verification methods

Array<string>
step_up_authentication_id
required

The step-up authentication this challenge was minted from — a DIFFERENT id from id (the sudo session). completeStepUp takes id as sudo_session_id; requestStepUpFallback takes this one.

string format: uuid
webauthn
required
Any of:
PasskeyAuthenticationOptions
object
allow_credentials
required
Array<object>
object
id
required
string
transports
required
Array<string>
type
required
string
challenge
required
string
challenge_id
required
string format: uuid
rp_id
required
string
timeout
required
integer
user_verification
required
string
type
required

Machine-readable error code from a stable vocabulary (open enum — handle unknown values)

string

Example generated

{
"error": {
"details": "example",
"message": "example",
"request_id": "example",
"step_up": {
"delivery": "example",
"expires_at": "2026-04-15T12:00:00Z",
"id": "example",
"match_code": "example",
"methods": [
"example"
],
"step_up_authentication_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"webauthn": {
"allow_credentials": [
{
"id": "example",
"transports": [
"example"
],
"type": "example"
}
],
"challenge": "example",
"challenge_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
"rp_id": "example",
"timeout": 1,
"user_verification": "example"
}
},
"type": "example"
}
}