> ## Documentation Index > Fetch the complete documentation index at: https://docs.agentcard.sh/llms.txt > Use this file to discover all available pages before exploring further. # Submit information > Submits the extra fields requested by a `needs_information` response. Send only the fields listed in `required_fields`. On success, the response returns the `iframe_url` for the face scan. ## OpenAPI ````yaml openapi.json POST /api/v2/kyc/information openapi: 3.1.0 info: title: Agentcard API version: 2.0.0 description: >- The Agentcard v2 API — connect your users and verify their identity from your own backend. Every call is authenticated with a platform access token minted from your `client_id` + `client_secret`. servers: - url: https://api.agentcard.sh description: >- There is one base URL. Sandbox vs production is decided by the client credential you use, never by the host. security: - platformToken: [] tags: - name: Authentication description: >- Exchange your client credentials for a platform access token, and introspect what a token acts as. - name: Connect description: >- Connect a user to your platform: send a one-time code, verify it, record consent, and keep the connection alive. - name: Identity verification description: >- Verify a connected user's identity: upload their ID, submit any extra fields we ask for, then show a short face scan. - name: Wallet funding description: >- Fund a connected user's wallet from your own UI — request a payment link, relay the phone verification code, and poll until the funds land. - name: Withdrawals description: >- Move money out of a connected user's wallet — to a saved bank account or a crypto address on Base. Transfers are processed manually by the Agentcard team, usually within 1-3 business days. paths: /api/v2/kyc/information: post: tags: - Identity verification summary: Submit information description: >- Submits the extra fields requested by a `needs_information` response. Send only the fields listed in `required_fields`. On success, the response returns the `iframe_url` for the face scan. operationId: kycSubmitInformation requestBody: required: true content: application/json: schema: type: object required: - user_id properties: user_id: type: string description: The connected user's id. first_name: type: string last_name: type: string date_of_birth: type: string description: ISO 8601 date, `YYYY-MM-DD`. national_id_number: type: string description: The user's national identification number. phone_number: type: string description: E.164 format with country code (e.g. `+15551234567`). address_line1: type: string address_line2: type: string address_city: type: string address_region: type: string description: State, province, or region. address_postal_code: type: string address_country: type: string description: ISO 3166-1 alpha-2 country code (e.g. `US`). example: user_id: user_7g8h9i national_id_number: '123456789' address_line1: 123 Main St address_city: San Francisco address_region: CA address_postal_code: '94105' address_country: US responses: '200': description: >- The next step — usually `requires_verification` with the `iframe_url`. content: application/json: schema: $ref: '#/components/schemas/KycState' example: object: kyc status: requires_verification iframe_url: https://in.sumsub.com/websdk/p/… '400': description: >- `invalid_request` — missing `user_id`. `invalid_fields` — a value didn't check out; the error adds a `field_errors` object naming each field to fix. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: invalid_fields message: Some of the information provided is invalid. field_errors: date_of_birth: Enter a valid date. '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/ConnectionNotFound' '409': $ref: '#/components/responses/UserConflict' '502': $ref: '#/components/responses/VerificationError' components: schemas: KycState: type: object description: The single status contract every KYC response carries. properties: object: type: string enum: - kyc status: type: string enum: - awaiting_documents - needs_information - requires_verification - pending - approved - rejected description: >- `awaiting_documents` — upload the front and back. `needs_information` — collect the `required_fields` and submit them. `requires_verification` — show the user the `iframe_url`. `pending` — under review, no action needed. `approved` — verified, done. `rejected` — the user did not pass. Statuses are not one-way: a review can send a user back — `pending` may return to `needs_information` (a detail didn't match the document; re-collect the listed fields and resubmit, the check re-runs automatically) or to `awaiting_documents` (the images were unusable; upload both sides again). Always branch on the current status. required_fields: type: array items: type: string description: >- Only on `needs_information` — exactly the fields to collect and post to `/kyc/information`. iframe_url: type: string description: >- Only on `requires_verification` — the URL to show the user for the face scan. Embed it in an iframe with `allow="camera; microphone"`. Short-lived: always use the most recent one from a poll or webhook, never a stored copy. warnings: type: array items: type: string description: >- Optional, on document uploads — actionable feedback safe to show the user (for example, that the other side of the document is still needed). extracted: type: object description: >- Optional, on document uploads — what the document reader pulled off the uploaded image(s), so you can prefill your details form instead of asking the user to re-type what the ID already says. Keys match the `/kyc/information` request fields (`first_name`, `last_name`, `date_of_birth`, `address_line1`, `address_city`, `address_region`, `address_postal_code`, `address_country`) plus `document_type`, `issuing_country`, and `document_number` (the number printed on the document — for US documents this is NOT the SSN, so never prefill it into `national_id_number` when `issuing_country` is `US`). Fields appear as they become readable: the front usually carries the name and date of birth; a US back adds the barcode address. Always let the user confirm or correct prefilled values. additionalProperties: type: string reason: type: string description: >- Optional, on `needs_information`, `awaiting_documents`, `requires_verification`, and `rejected` — a short, end-user-safe explanation of what the review asked for (for example, “Enter your full name exactly as it appears on your identity document.”). Safe to show the user verbatim. Error: type: object description: Every v2 error uses the same envelope. properties: error: type: object properties: code: type: string description: A stable, machine-readable string (snake_case). Branch on this. message: type: string description: A human-readable explanation, safe to log. docs: type: string description: A link back to the reference. field_errors: type: object additionalProperties: type: string description: Only on `invalid_fields` — names each field to fix. warnings: type: array items: type: string description: >- Only on document upload errors — actionable feedback safe to show the user. responses: Unauthorized: description: >- `unauthorized` — the platform access token is missing or expired. Exchange your client credentials for a fresh one. content: application/json: schema: $ref: '#/components/schemas/Error' ConnectionNotFound: description: >- `connection_not_found` — no connection exists for that user under your client. content: application/json: schema: $ref: '#/components/schemas/Error' UserConflict: description: >- `user_conflict` — the email on file in your organization belongs to a different account. Contact support. content: application/json: schema: $ref: '#/components/schemas/Error' VerificationError: description: '`verification_error` — the step failed downstream. Try again.' content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: platformToken: type: http scheme: bearer description: >- A platform access token. Get one on the **Create an access token** endpoint by exchanging your `client_id` + `client_secret`, then send it as `Authorization: Bearer `. Tokens live one hour. ````