Onboarding

Create an onboarding flow

POST/onboarding/flows
onboarding:writecreate_complianceDeprecatedSunset 2027-06-30

Create a new onboarding flow (the investor journey: KYC, FCA classification, risk warnings, appropriateness). A base section/form is created and wired as the flow's start form, mirroring the editor's create flow. Returns the created flow; define its steps with PUT /onboarding/flows/{complianceId}/definition and publish it with PATCH /onboarding/flows/{complianceId}/status.

An onboarding flow is a REUSABLE, FIRM-LEVEL definition — you typically maintain a small number (often a single combined journey), NOT one per investor. To put an investor through a flow, attach the flow's uuid when you invite them (POST /investors with onboarding_uuid); that creates the investor's own implementation (their individual run through the flow). Do not create a new flow per investor. After creating a flow, define its steps with PUT /onboarding/flows/{complianceId}/definition and publish it with PATCH /onboarding/flows/{complianceId}/status. Deprecated: withdrawn on 2027-06-30. POST /onboarding-flows replaces it; the Link header names it.

Request body

application/json, required

  • namestringRequired#
  • expiry_typestring | null#

    How often a respondent must re-complete the flow. Values: DAILY = re-complete every day; ONE_MONTH = monthly; THREE_MONTH = every 3 months; SIX_MONTH = every 6 months; TWELVE_MONTH = yearly; NEVER_EXPIRE = complete once, never re-prompted. Defaults to TWELVE_MONTH.

    One of: DAILY, ONE_MONTH, THREE_MONTH, SIX_MONTH, TWELVE_MONTH, NEVER_EXPIRE
  • mode_typestring | null#

    Flow mode. Continuous = respondents can update their responses at any time; Versioned = responses are locked per published version (re-completion required against a new version). Defaults to Continuous.

    One of: Continuous, Versioned
  • user_typesarray | null#

    Which user types the flow can onboard. Defaults to [investor].

    One of: investor, advisor
{
  "name": "Investor Suitability",
  "expiry_type": "TWELVE_MONTH",
  "mode_type": "Continuous"
}

Responses

201

Created

Compliance
{
  "data": {
    "id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "name": "Investor Suitability",
    "status": "draft",
    "expiry_type": "TWELVE_MONTH",
    "mode_type": "Continuous",
    "definition": null,
    "forms_count": 1,
    "created_at": "2026-06-15T10:30:00+00:00",
    "updated_at": "2026-06-15T10:30:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/onboarding/flows\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "name": "Investor Suitability",
  "expiry_type": "TWELVE_MONTH",
  "mode_type": "Continuous"
}'