Browse the docs

Create whitelabel KYC link for cardholder

POST /v1/api-gateway/cardholder/{end_customer_id}/whitelabel-kyc

Issues a link to the Moon-hosted identity-verification page for an existing cardholder (unlike POST /cardholder/kyc, the cardholder is NOT created if it does not exist). Resets the cardholder's KYC status to NOT_STARTED and issues a new link. The link expires 7 days after creation. Cannot be used once the cardholder is APPROVED.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`end_customer_id` required	string	Your `end_customer_id` for the cardholder, not the Moon cardholder id.

Headers

Field	Type	Description
`Idempotency-Key`	string	A unique string you choose, up to 255 characters, that makes this request safe to retry. If a request times out or fails in transit, send it again with the same key: the status code and body of the first attempt are returned and the operation is not performed a second time. Stored replies — including failures — are replayed for 24 hours, after which the same key starts a fresh request. Reusing a key for a different request, or sending it while the first request is still running, returns 409. Omit the header and the request behaves exactly as before. Document upload endpoints do not accept it.

Example request

cURL

curl --request POST \
     --url 'https://api.themooncard.com/v1/api-gateway/cardholder/customer_123/whitelabel-kyc' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

201 Success

Field	Type	Description
`url` required	string	Hosted identity-verification page to send the cardholder to. Carries a signed, time-limited token.
`expires_at` required	string	ISO-8601 timestamp after which the link stops working (7 days from creation).
`external_id` required	string	Echo of the cardholder identifier the link was created for.
`end_customer_id` required	string	Deprecated alias of `external_id`, emitted alongside it.

JSON

{
  "url": "https://verify.paywithmoon.com/kyc?token=eyJhbGciOiJIUzI1NiJ9.xyz789",
  "expires_at": "2026-08-23T17:51:01.000Z",
  "external_id": "customer_123",
  "end_customer_id": "customer_123"
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).