> ## Documentation Index > Fetch the complete documentation index at: https://docs.zuba.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Money amounts are always major-unit decimal strings (e.g. "1000.00"), never floats and never minor units, in every request, response, and webhook payload. > Authentication is OAuth 2.0 client credentials: exchange the Client ID and Client Secret at the Token URL for a 24-hour JWT and cache it; do not request a token per call. > Set a unique clientRef on every money-moving request; it is the idempotency key, and retries return the original resource. > Quotes are single-use, intent-locked, and expire fast: always read expiresAt, consume the quote with the executor matching its intent, and re-quote on expiry instead of retrying. > Prefer webhooks over polling for payout, order, application, and virtual-account status tracking. > Use the sandbox (api.sandbox.zuba.com) with its deterministic magic values before touching production. # Update an application (draft data only; never changes status) ## OpenAPI ````yaml /openapi.json patch /v2/applications/{id} openapi: 3.0.0 info: contact: {} description: >- Comprehensive payment platform API supporting fiat and crypto payments, currency conversion, and compliance management title: Zuba Payment Platform API version: '1.0' servers: [] security: [] tags: - description: Manage M2M API keys and credentials name: API Keys - description: Internal ledger accounts and transactions name: Ledger - description: Handle incoming payments and deposits name: Pay-ins - description: Manage payouts, beneficiaries, and SEPA transfers name: Payouts - description: Manage outbound webhook endpoints and deliveries name: Webhooks paths: /v2/applications/{id}: patch: tags: - Applications (v2) summary: Update an application (draft data only; never changes status) operationId: ApplicationV2Controller_patch parameters: - in: path name: id required: true schema: format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/PatchKybApplicationDto' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationDto' description: '' '400': content: application/json: schema: $ref: '#/components/schemas/GenericErrorResponseDto' description: '' '403': content: application/json: schema: oneOf: - $ref: '#/components/schemas/GenericErrorResponseDto' - $ref: >- #/components/schemas/RmiDirectUpdateForbiddenErrorResponseDto - $ref: '#/components/schemas/StepLockedErrorResponseDto' description: >- The application is not editable. `error` carries the reason: rmi_direct_update_forbidden (the reviewer requested changes, so edit the flagged section instead of the fields directly) or step_locked (body adds `lockedStep` and `editableSteps`, the sections the reviewer did flag). An application belonging to another account returns a generic body. '404': description: Not found security: - bearer: [] components: schemas: PatchKybApplicationDto: properties: applicant: $ref: '#/components/schemas/ApplicantDto' businessActivity: $ref: '#/components/schemas/BusinessActivityDto' businessInfo: $ref: '#/components/schemas/BusinessInfoDto' hasIndirectControl: description: >- Whether anyone controls the business other than through the declared persons. Send it together with `indirectControlDetails` when true, unless the application already records them. type: boolean indirectControlDetails: description: >- Describes the indirect control when `hasIndirectControl` is true, and is required with it. Cleared whenever `hasIndirectControl` is false, and `null` clears it under any answer. An unexplained yes tells a reviewer control exists and gives them nothing to assess, so the requirement is judged on the application as it stands after the write. nullable: true type: string individualActivity: $ref: '#/components/schemas/IndividualActivityDto' persona: enum: - sme - large_corp - licensed_fi type: string type: object ApplicationDto: properties: accountId: description: The account this application belongs to (self or sub-account). format: uuid type: string applicationType: enum: - business - individual type: string createdAt: format: date-time type: string editableSections: description: >- When status is more_info_requested, the sections you may edit and resubmit. `applicant` / `businessInfo` / `businessActivity` / `individualActivity` are edited via PATCH; `persons` via the /persons sub-resource (and covers that person’s own documents); `documents` is company-level documents via the /documents sub-resource. Empty otherwise. items: type: string type: array id: format: uuid type: string moreInfoReason: description: >- When status is more_info_requested, the reviewer’s notes describing what needs to change. Null otherwise. type: string registeredName: description: >- The name the company is registered under, so a directory can label an application without reading the full record. type: string riskLevel: enum: - low - medium - high - prohibited type: string screeningStatus: enum: - pending - in_progress - clear - flagged - failed - timed_out type: string status: enum: - draft - under_review - approved - more_info_requested - rejected type: string required: - id - accountId - applicationType - status - createdAt type: object GenericErrorResponseDto: properties: error: description: Error type identifier example: BAD_REQUEST type: string message: description: Error message example: Bad Request type: string path: description: Request path that generated the error example: /v1/resource type: string statusCode: description: HTTP status code example: 400 type: number timestamp: description: ISO timestamp when the error occurred example: '2024-01-15T10:30:00.000Z' type: string required: - statusCode - message - error - timestamp - path type: object RmiDirectUpdateForbiddenErrorResponseDto: properties: error: description: Error type identifier example: rmi_direct_update_forbidden type: string message: description: Error message example: Bad Request type: string path: description: Request path that generated the error example: /v1/resource type: string statusCode: description: HTTP status code example: 400 type: number timestamp: description: ISO timestamp when the error occurred example: '2024-01-15T10:30:00.000Z' type: string required: - statusCode - message - error - timestamp - path type: object StepLockedErrorResponseDto: properties: editableSteps: description: Sections the reviewer did flag for editing example: - documents items: type: string type: array error: description: Error type identifier example: step_locked type: string lockedStep: description: Section rejected because it was not flagged by the reviewer example: business_info type: string message: description: Error message example: Bad Request type: string path: description: Request path that generated the error example: /v1/resource type: string statusCode: description: HTTP status code example: 400 type: number timestamp: description: ISO timestamp when the error occurred example: '2024-01-15T10:30:00.000Z' type: string required: - statusCode - message - error - timestamp - path - lockedStep - editableSteps type: object ApplicantDto: properties: applicantDateOfBirth: example: '1985-06-15' format: date type: string applicantFirstName: type: string applicantLastName: type: string applicantNationalId: description: National ID or tax identification number (TIN) for the applicant. type: string applicantNationality: description: ISO 3166-1 alpha-2 country code type: string applicantPhone: type: string applicantResidentialAddress: allOf: - $ref: '#/components/schemas/AddressDto' description: >- Required for individual applications: the applicant’s residential address. Its country is the corridor/eligibility key for an individual (there is no country of incorporation). required: - applicantFirstName - applicantLastName - applicantDateOfBirth - applicantNationality type: object BusinessActivityDto: properties: accountPurposes: items: type: string type: array accountPurposesOtherDescription: description: >- Describes the account purpose when `accountPurposes` includes `other`, and is required with it. Cleared whenever no purpose is `other`. The requirement is judged on the application as it stands after the write, so a description already on file satisfies it. nullable: true type: string expectedCounterpartyCountries: items: type: string type: array isMsb: description: Whether the business is a Money Services Business. type: boolean monthlyCryptoVolume: description: Major-unit decimal string. type: string monthlyFiatVolume: description: Major-unit decimal string. type: string sourceOfFunds: enum: - revenue - investment - other type: string sourceOfFundsOther: description: >- Describes the source of funds when `sourceOfFunds` is `other`, and is required with it. Cleared whenever `sourceOfFunds` is anything else. The requirement is judged on the application as it stands after the write, so a description already on file satisfies it. nullable: true type: string targetMarket: description: >- Primary market the business sells to. Send it together with `targetMarketOtherDescription` when it is `other`. `null` clears the market and its description; any other value outside the listed ones, including an empty string, is rejected: a clear either happens or fails, never silently. enum: - commercial - retail - government - other nullable: true type: string targetMarketOtherDescription: description: >- Describes the target market when `targetMarket` is `other`, and is required with it. Cleared whenever `targetMarket` is anything else. The requirement is judged on the application as it stands after the write, so a description already on file satisfies it and can be corrected without resending the market. nullable: true type: string required: - sourceOfFunds - accountPurposes - monthlyFiatVolume type: object BusinessInfoDto: properties: businessDescription: description: >- Description of the business. USD corridors require at least 100 characters. type: string countryOfIncorporation: description: ISO 3166-1 alpha-2 country of incorporation. type: string entityType: enum: - corporation - llc_ltd - partnership - non_profit - trust - sole_proprietorship type: string incorporationAddress: $ref: '#/components/schemas/AddressDto' incorporationDate: format: date type: string industry: type: string industryCode: description: >- North American Industry Classification System code, exactly 6 digits. Required for USD collection. example: '541611' type: string industryOtherDescription: nullable: true type: string industrySubtype: type: string legalName: description: Registered legal name of the business. type: string physicalAddress: $ref: '#/components/schemas/AddressDto' registrationNumber: description: Company registration / incorporation number. type: string sameAsIncorporation: description: When true, physicalAddress equals incorporationAddress. type: boolean taxId: type: string tradingName: type: string required: - legalName - registrationNumber - countryOfIncorporation - entityType - industry - businessDescription - incorporationAddress - sameAsIncorporation type: object IndividualActivityDto: properties: applicantAccountPurposes: items: type: string type: array applicantAccountPurposesOtherDescription: description: >- Describes the account purpose when `applicantAccountPurposes` includes `other`. nullable: true type: string applicantEmploymentStatus: type: string applicantExpectedCounterpartyCountries: items: type: string type: array applicantExpectedCryptoMonthlyVolume: description: Major-unit decimal string. type: string applicantExpectedFiatMonthlyVolume: description: Major-unit decimal string. type: string applicantSourceOfFunds: items: type: string type: array applicantSourceOfFundsOtherDescription: description: >- Describes the source of funds when `applicantSourceOfFunds` includes `other`. nullable: true type: string applicantSourceOfWealth: items: type: string type: array applicantSourceOfWealthOtherDescription: description: >- Describes the source of wealth when `applicantSourceOfWealth` includes `other`. nullable: true type: string type: object AddressDto: properties: city: type: string country: description: ISO 3166-1 alpha-2 type: string postalCode: type: string state: type: string street: type: string required: - street - city - state - postalCode - country type: object securitySchemes: bearer: bearerFormat: JWT description: Enter Auth0 JWT token scheme: bearer type: http ````