Applications

Record that the account owner accepted one of the account terms

Records the owner’s acceptance of one document from the terms an account would be opened under. The documents, their slug, the version to acknowledge and the exact wording each acceptance stands for come from GET /v1/virtual-accounts/requirements, whose disclosure.acknowledgement requirement lists every outstanding document with this call as its acknowledgePath. The acceptance is recorded against the owner’s application before or after its approval. Idempotent per document; acknowledging again at a newer version updates the record in place. Acknowledging with an API key attests that the owner accepted in your own flow, so attestation is required there and carries the evidence (when they accepted, from which IP and user agent, and who signed). A dashboard session records the signed-in user’s own click and sends no attestation.

POST

applications

{applicationId}

disclosures

{slug}

acknowledge

Record that the account owner accepted one of the account terms

curl --request POST \
  --url https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "documentVersion": "2026.08.07"
}
'

import requests

url = "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge"

payload = { "documentVersion": "2026.08.07" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({documentVersion: '2026.08.07'})
};

fetch('https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'documentVersion' => '2026.08.07'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge"

	payload := strings.NewReader("{\n  \"documentVersion\": \"2026.08.07\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"documentVersion\": \"2026.08.07\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"documentVersion\": \"2026.08.07\"\n}"

response = http.request(request)
puts response.read_body

{
  "acknowledgedAt": "2026-08-07T10:22:33.123Z",
  "acknowledgedByActorType": "dashboard_user",
  "id": "<string>",
  "slug": "<string>",
  "version": "<string>",
  "attestation": {
    "acceptedAt": "2026-08-24T10:22:33.000Z",
    "ip": "203.0.113.42",
    "signerEmail": "ada@example.com",
    "signerName": "Ada Lovelace",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
  }
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

Authorizations

Authorization

string

header

required

Enter Auth0 JWT token

Headers

Zuba-Account-Id

string<uuid>

Optional. Names an owned sub-account (UUID); when present, the application must belong to it. Omit to act on any application in your workspace. Naming an account this key does not own returns 403 not_account_owner.

Path Parameters

applicationId

string<uuid>

required

slug

string

required

The document’s slug as the requirements response names it.

Example:

"terms-of-service"

Body

application/json

documentVersion

string

required

Example:

"2026.08.07"

attestation

object

Required when acknowledging with an API key on an owner's behalf. Omitted by a dashboard session, whose acknowledgment is the signed-in user's own.

Show child attributes

Response

acknowledgedAt

string

required

Example:

"2026-08-07T10:22:33.123Z"

acknowledgedByActorType

enum<string> | null

required

Which surface recorded this acknowledgment. An api_key row always carries a complete attestation; a dashboard_user row never does, because the signed-in click is itself the evidence. null names a row that asserts neither, so a missing attestation is never ambiguous.

Available options:

dashboard_user,

api_key

string

required

UUID of the ack row.

slug

string

required

version

string

required

attestation

object | null

The acceptance evidence recorded with this acknowledgment, or null when the owner acknowledged in the Zuba dashboard themselves.

Show child attributes

Record that the account owner accepted one of the account terms

curl --request POST \
  --url https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "documentVersion": "2026.08.07"
}
'

import requests

url = "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge"

payload = { "documentVersion": "2026.08.07" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({documentVersion: '2026.08.07'})
};

fetch('https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'documentVersion' => '2026.08.07'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge"

	payload := strings.NewReader("{\n  \"documentVersion\": \"2026.08.07\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"documentVersion\": \"2026.08.07\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/applications/{applicationId}/disclosures/{slug}/acknowledge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"documentVersion\": \"2026.08.07\"\n}"

response = http.request(request)
puts response.read_body

{
  "acknowledgedAt": "2026-08-07T10:22:33.123Z",
  "acknowledgedByActorType": "dashboard_user",
  "id": "<string>",
  "slug": "<string>",
  "version": "<string>",
  "attestation": {
    "acceptedAt": "2026-08-24T10:22:33.000Z",
    "ip": "203.0.113.42",
    "signerEmail": "ada@example.com",
    "signerName": "Ada Lovelace",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"
  }
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}