Onboarding

This document provides a basic overview of the Account API endpoints, grouped by purpose. All endpoints are prefixed with their respective API versions as shown.

Everything starts with the login flow witch is the first step to access the app. No user can access the app without logging in. Your access token is generated after the login flow and is used to authenticate your requests to the app.

The login flow for the app is as follows:

1. The user opens the app and is prompted to log in.
2. The user enters their email and password.
3. The app validates the credentials and redirects the user to the home screen.
4. If the user has some MFA enabled, the app prompts the user to enter the MFA code.
5. The app stores the access token in the secure storage.
6. The app makes a request to the home endpoint to get the home data and so on.

For this flow, you need to call precisely some steps in order to authenticate the user.

First of all, you need to get the RSA public key from the app.

Endpoint: [GET /v1/authentication/getPublicKeyRsa]

Description: Retrieves the RSA public key from the app.

export interface RsaKey {
    value: string;
}

{
    "value": "-----BEGIN PUBLIC KEY-----\nMIGeMA0GCSqGSIb3DQEBAQUAA4GMADCBiAKBgFpSXuvNOSwZwBZAbihn/euG3vme\noFCfNlg0pJDeZQNBsPJnge8lPlig+Va6zCj7N2LriWEGyW/3Y8lhM2L+h/vypUIY\n7ka9sTX08WkofhB6SRbfnNidl3WB3Kvr1UCAvsFcoE4Rv+0BHmnGmVOKLSRrJKqY\nut0804YqTLPgIieBAgMBAAE=\n-----END PUBLIC KEY-----\n"
}

Now you have the RSA public key, you can encrypt the user password using it. You will need to send the encrypted password to the app and for it, you are going to have some RSA encryption engine.

export interface LoginRequest {
    identifier: string;
    password: string;
    identifierType: ServerIdentifierType;
    countryCode: string;
    applicationId: string;
    mfaSecretCode?: string;
}

export enum ServerIdentifierType
{
    EMAIL = 'email',
    MOBILE = 'mobile',
    DOCUMENT = 'document',
    UNKNOWN = 'unknown'
}

{
    "identifier": "email@example.com",
    "password": encryptRSA(publicKey, "MY_SAMPLE_PASSWORD"),
    "identifierType": "email",
    "countryCode": "BR",
    "applicationId": "2",
    "mfaSecretCode": "123456"
}

You are going to receive all user related information.

export interface UserDetails {
    // User's country code
    country: string;
    // User's email address
    email: string;
    // Feature flags for user capabilities
    featureControl: string;
    // Latest terms acceptance status
    hasAcceptedLatestUsePolicy: boolean;
    // Unique user identifier
    id: string;
    // Multi-factor authentication status
    mfaStatus: boolean;
    // User's mobile phone number
    mobile: string;
    // KYC bypass flag for providers
    byPassKycProvider: boolean;
    // User's full name
    name: string;
    // Profile image URL path
    imagePath: string;
    // Employee code (if applicable)
    employeeCode?: string;
    // User's wallet information
    wallet: Wallet;
    // Associated enterprise identifier
    enterpriseId: string;
    // App and referral codes
    memberCodes: MemberCodes;
    // KYC verification status
    hasKyc: boolean;
    // Permission to display name publicly
    acceptShowName: boolean;
    // User's document information
    document: DocumentData;
    // Profile photo URL
    photo: string;
    // Account creation timestamp
    creationDate: Date;
    // Trusteeship profile flag
    trusteeshipProfile: boolean;
    // Onboarding validation status
    hasOnboardingValidation: string;
    // Application avatar URL
    appAvatar: string;
    // Message of the day content
    motd: Partial<Motd>;
    // User's nickname
    nickName: string;
    // Registration method used
    registerIdentifierType: RegisterIdentifierType;
    // User's address (optional)
    address?: Address;
    // White label configuration (optional)
    whitelabelConfig?: WhitelabelConfig;
    // White label profile (optional)
    whiteLabelProfile?: WhitelabelProfile;
}

And the token will be returned in the response headers as a cookie called connect.sid. You need to grab it and store it in the secure storage.

• Lost Password POST /v1/authentication/lostpassword Initiates the password recovery process.

• Change Lost Password POST /v1/authentication/changelostpassword Updates the password after a recovery request.

• Change Password POST /v1/authentication/changepassword Changes the user’s current password.

• Confirm Signup POST /v1/authentication/confirmsignup Confirms user registration using a verification code.

• Resend Confirmation Code POST /v1/authentication/resendconfirmationcode Resends the signup or verification confirmation code.

• Account Verification (Onboarding) POST /v2/accounts/onboarding/sign-up Verifies and completes the account signup process.

• Resend Verification Code POST /v1/authentication/resendconfirmationcode Resends the verification code during onboarding.

• Create User POST /v3/accounts/users Creates a new user account.

• Get User Details GET /v2/accounts/users Retrieves details of the authenticated user.

• Edit User PUT /v2/accounts/users Updates user profile information.

• Delete User DELETE /v2/accounts/users Deletes the authenticated user account.

GET /v2/accounts/onboarding/availability/{identifier}

Checks whether a given identifier (e.g. email, document, or cellphone) is available.

This endpoint is called in two steps:

1. First, to verify the availability of the document.
2. Then, to verify the availability of the cellphone number or email address.

Query Parameters

• identifier — The value to be checked (cellphone, document, or email).

Response

export interface IdentifierAvailabilityResponse {
  uniqueId: boolean;
}

• Onboarding Status GET /v2/accounts/onboarding/{identifier} Retrieves the onboarding status for a given identifier.

• Facematch POST /v2/accounts/onboarding Performs identity verification during onboarding.

• Verify MFA Status GET /v2/accounts/mfa Retrieves the MFA status for the user.

• Start MFA Process POST /v1/authentication/startmfaprocess Initiates the MFA setup or validation process.

• Finish MFA Process POST /v1/authentication/finalizemfaprocess Completes the MFA process.

• Accept Latest Policies POST /v1/authentication/policies/latest/accept Records acceptance of the latest policies and terms.

• Member Get Member (MGM) GET /v2/engagements/referrals/mgm Retrieves MGM referral information.

• Referrals GET /v1/referrals Retrieves referral data for the user.

• Linked Accounts GET /v2/accounts/linked-accounts Retrieves accounts linked to the current user.

• All Linked Accounts (Homepage) GET /v2/e-commerce/homepage/linked-accounts Retrieves all linked accounts for homepage display.

• Enroll Account Connection POST /v2/accounts/linked-accounts/auth-tokens/{provider} Enrolls a new account connection for a given provider.

• Add Mobile Token POST /v1/platform/mobile/token Registers a mobile device token.

• Countries & Areas GET /v2/accounts/countries-area Retrieves the list of supported countries and areas.

• Accepted Documents List GET /v1/platform/documents/accepted Retrieves the list of accepted documents.