Onboarding

Create a test implementation of an onboarding flow

POST/onboarding/flows/{complianceId}/implementations
onboarding:writecreate_compliance_implementationDeprecatedSunset 2027-06-30

Creates an implementation of the flow for user_id. It defaults to a TEST run (flow_test true), which replaces the user's earlier test runs and notifies nobody. flow_test: false makes a real one, which notifies holders of the permission to view user onboarding questionnaires, not the respondent. It checks neither the flow's state nor the user's type. Invites do not create implementations. Deprecated: withdrawn on 2027-06-30. POST /onboarding-sessions replaces it; the Link header names it.

Path parameters

  • complianceIdstring (uuid)Required#

    The compliance flow's public uuid.

Request body

application/json, required

  • user_idstring (uuid)Required#

    The respondent's platform user guid.

  • flow_testboolean#

    Create a dry-run implementation. Defaults to true; pass false for a real implementation, which notifies holders of the permission to view user onboarding questionnaires.

    Default: true
{
  "user_id": "a1b2c3d4-e5f6-4071-8293-a4b5c6d7e8f9"
}

Responses

201

Created

ComplianceImplementation
{
  "data": {
    "id": "1f0c9e8d-7b6a-4039-8271-6e5d4c3b2a19",
    "compliance_id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "user_id": "a1b2c3d4-e5f6-4071-8293-a4b5c6d7e8f9",
    "flow_test": true,
    "expired": false,
    "start_date": "2026-06-15T10:30:00+00:00",
    "end_date": null,
    "created_at": "2026-06-15T10:30:00+00:00",
    "updated_at": "2026-06-15T10:30:00+00:00"
  }
}
401

Authentication failed. error.code is one of invalid_token, expired, revoked.

Error
403

Authorization failed. error.code is one of org_disabled, ip_blocked, missing_scope, scope_disabled, user_disabled.

Error
404

Resource not found (error.code = not_found).

Error
422

Request validation failed (HTTP 422). The body is either the Laravel validation envelope (message + field-keyed errors) or the API error envelope for domain rejections (e.g. form_type_not_supported, folder_locked, parent_not_found, folder_not_empty).

429

Rate limit exceeded (error.code = rate_limited).

Error

Examples

curl -X POST https://your-org-domain/kong/core/api/v2/onboarding/flows/{complianceId}/implementations\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"\
  -d '{
  "user_id": "a1b2c3d4-e5f6-4071-8293-a4b5c6d7e8f9"
}'