Browse the docs

Update end-customer KYC status

PATCH /v1/api-gateway/end-customer/{id}

Records that you verified (or un-verified) the end customer yourself: is_kyc_verified: true sets delegated_kyc_completed_at to now, false clears it. Returns the updated end customer.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`id` required	string	Your `end_customer_id` for the cardholder, not the Moon cardholder id.

Body

Field	Type	Description
`is_kyc_verified` required	boolean	Whether you have verified this end customer yourself. `true` sets `delegated_kyc_completed_at` to now; `false` clears it.

Example request

cURL

curl --request PATCH \
     --url 'https://api.themooncard.com/v1/api-gateway/end-customer/customer_123' \
     --header 'x-api-key: YOUR_API_KEY' \
     --header 'content-type: application/json' \
     --data '{
       "is_kyc_verified": true
     }'

Responses

200 Success

Field	Type	Description
`id` required	string	Cardholder id.
`delegated_kyc_completed_at` required	string, nullable
`external_id` required	string, nullable	Your identifier for this cardholder.
`end_customer_id` required	string, nullable	Deprecated alias of `external_id`, emitted alongside it.
`created_at` required	string, nullable
`updated_at` required	string, nullable

JSON

{
  "id": "3f5b1c2e-8d4a-4b6f-9e2a-1c7d8e9f0a1b",
  "delegated_kyc_completed_at": "2026-08-02T14:20:05.000Z",
  "external_id": "customer_123",
  "end_customer_id": "customer_123",
  "created_at": "2026-08-01T09:12:44.000Z",
  "updated_at": "2026-08-15T09:03:44.000Z"
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

Your organization could not be found, or no cardholder has this end_customer_id (CARDHOLDER_NOT_FOUND).

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated August 17, 2026