Organizations
Import verification
Import a verification for the in-scope organization from a donor’s Sumsub share token (Reusable KYC).
Lets a broker reuse a KYC/KYB they already performed on their own
Sumsub tenant instead of asking the customer to repeat the flow. The
broker generates a single-use share token on their tenant and posts
it here under Nxos-On-Behalf-Of: <child-org-id>. We import the
applicant on our tenant under externalUserId = <child-org-id> and
move the verification record to PENDING. Sumsub’s applicant-review
webhook fires shortly after and the platform progresses the org to
APPROVED — poll GET /v1/organizations/verification to observe
that transition.
Pre-requisite: the donor must have added nxos as a Reusable KYC partner in their Sumsub dashboard, and we must have enabled the feature on our side. There is no automated onboarding for the pairing itself.
Share tokens are single-use. A retry of this endpoint with the same
token returns share_token_invalid.
See Verification for the full flow.
POST
/
v1
/
organizations
/
verification
/
import
cURL
curl --request POST \
--url https://api.nxos.io/v1/organizations/verification/import \
--header 'Authorization: <authorization>' \
--header 'Content-Type: application/json' \
--data '
{
"shareToken": "<string>"
}
'import requests
url = "https://api.nxos.io/v1/organizations/verification/import"
payload = { "shareToken": "<string>" }
headers = {
"Authorization": "<authorization>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<authorization>', 'Content-Type': 'application/json'},
body: JSON.stringify({shareToken: '<string>'})
};
fetch('https://api.nxos.io/v1/organizations/verification/import', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nxos.io/v1/organizations/verification/import",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'shareToken' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nxos.io/v1/organizations/verification/import"
payload := strings.NewReader("{\n \"shareToken\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nxos.io/v1/organizations/verification/import")
.header("Authorization", "<authorization>")
.header("Content-Type", "application/json")
.body("{\n \"shareToken\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nxos.io/v1/organizations/verification/import")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"shareToken\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"object": "organization_verification",
"status": "APPROVED",
"type": "BUSINESS",
"updatedAt": "2026-03-15T14:30:00.000Z"
}{
"error": {
"code": "invalid_request",
"message": "The request body is malformed or missing required fields.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "missing_api_key",
"message": "No Authorization header provided.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "forbidden",
"message": "Your organization is not enabled for this action.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "not_found",
"message": "The requested resource was not found.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "quote_expired",
"message": "The quote has expired.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "rate_limited",
"message": "Rate limit exceeded: 1000 requests per minute. Retry in 23 seconds.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "internal_error",
"message": "An unexpected server error occurred.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}Headers
Bearer token. Format: Bearer <api_key>
Unique key per logical operation. UUID v4 recommended. Max 255 characters.
Body
application/json
Request body for POST /v1/organizations/verification/import.
Single-use share token generated by the donor on their Sumsub tenant for a Reusable KYC partnership with nxos.
Response
The request has succeeded.
Verification record for an organization. Surfaces the live status plus a last-updated timestamp; polling this endpoint is the canonical way to learn when KYB completes.
Object type. Always organization_verification.
Available options:
organization_verification Current verification status.
Available options:
NOT_STARTED, PENDING, APPROVED, REJECTED, ON_HOLD, RESUBMISSION_REQUIRED Verification flow applied to the org.
Available options:
BUSINESS, INDIVIDUAL ISO 8601 timestamp of the most recent status change.
⌘I
cURL
curl --request POST \
--url https://api.nxos.io/v1/organizations/verification/import \
--header 'Authorization: <authorization>' \
--header 'Content-Type: application/json' \
--data '
{
"shareToken": "<string>"
}
'import requests
url = "https://api.nxos.io/v1/organizations/verification/import"
payload = { "shareToken": "<string>" }
headers = {
"Authorization": "<authorization>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: '<authorization>', 'Content-Type': 'application/json'},
body: JSON.stringify({shareToken: '<string>'})
};
fetch('https://api.nxos.io/v1/organizations/verification/import', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.nxos.io/v1/organizations/verification/import",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'shareToken' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.nxos.io/v1/organizations/verification/import"
payload := strings.NewReader("{\n \"shareToken\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.nxos.io/v1/organizations/verification/import")
.header("Authorization", "<authorization>")
.header("Content-Type", "application/json")
.body("{\n \"shareToken\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.nxos.io/v1/organizations/verification/import")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"shareToken\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"object": "organization_verification",
"status": "APPROVED",
"type": "BUSINESS",
"updatedAt": "2026-03-15T14:30:00.000Z"
}{
"error": {
"code": "invalid_request",
"message": "The request body is malformed or missing required fields.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "missing_api_key",
"message": "No Authorization header provided.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "forbidden",
"message": "Your organization is not enabled for this action.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "not_found",
"message": "The requested resource was not found.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "quote_expired",
"message": "The quote has expired.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "rate_limited",
"message": "Rate limit exceeded: 1000 requests per minute. Retry in 23 seconds.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}{
"error": {
"code": "internal_error",
"message": "An unexpected server error occurred.",
"requestId": "req_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4"
}
}