curl --request PATCH \
--url https://api-uat.dimetrades.com/api/partner/customers/kyc \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--header 'X-API-Secret: <api-key>' \
--data '
{
"isKycVerified": true,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z",
"externalCustomerId": "ext-123"
}
'import requests
url = "https://api-uat.dimetrades.com/api/partner/customers/kyc"
payload = {
"isKycVerified": True,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z",
"externalCustomerId": "ext-123"
}
headers = {
"X-API-Key": "<api-key>",
"X-API-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {
'X-API-Key': '<api-key>',
'X-API-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
isKycVerified: true,
kycVerifiedAt: '2026-08-11T12:00:00.000Z',
externalCustomerId: 'ext-123'
})
};
fetch('https://api-uat.dimetrades.com/api/partner/customers/kyc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/partner/customers/kyc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'isKycVerified' => true,
'kycVerifiedAt' => '2026-08-11T12:00:00.000Z',
'externalCustomerId' => 'ext-123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>",
"X-API-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/partner/customers/kyc"
payload := strings.NewReader("{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("X-API-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api-uat.dimetrades.com/api/partner/customers/kyc")
.header("X-API-Key", "<api-key>")
.header("X-API-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/partner/customers/kyc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["X-API-Key"] = '<api-key>'
request["X-API-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"message": "KYC status updated successfully",
"isKycVerified": true,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 401,
"error": "BrandUnauthorized",
"message": "Invalid brand credentials",
"code": 17001,
"explanation": "The X-API-Key / X-API-Secret pair is missing or does not match an active credential."
}
}{
"data": {},
"errors": {
"statusCode": 404,
"error": "CustomerNotFound",
"message": "Customer not found",
"code": 17003,
"explanation": "No customer with this externalCustomerId has been registered for this brand."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Sync a partner customer's KYC status
Updates the KYC status for an existing partner customer. This route is used by the ISV to tell Dime Trades whether the customer has completed KYC.
Server-to-server only. All /partner/* endpoints are authenticated with your brand credentials — X-API-Key + X-API-Secret headers — not with an end-user bearer token. Never expose these credentials to a browser or mobile app.
curl --request PATCH \
--url https://api-uat.dimetrades.com/api/partner/customers/kyc \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--header 'X-API-Secret: <api-key>' \
--data '
{
"isKycVerified": true,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z",
"externalCustomerId": "ext-123"
}
'import requests
url = "https://api-uat.dimetrades.com/api/partner/customers/kyc"
payload = {
"isKycVerified": True,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z",
"externalCustomerId": "ext-123"
}
headers = {
"X-API-Key": "<api-key>",
"X-API-Secret": "<api-key>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {
'X-API-Key': '<api-key>',
'X-API-Secret': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
isKycVerified: true,
kycVerifiedAt: '2026-08-11T12:00:00.000Z',
externalCustomerId: 'ext-123'
})
};
fetch('https://api-uat.dimetrades.com/api/partner/customers/kyc', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/partner/customers/kyc",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'isKycVerified' => true,
'kycVerifiedAt' => '2026-08-11T12:00:00.000Z',
'externalCustomerId' => 'ext-123'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>",
"X-API-Secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/partner/customers/kyc"
payload := strings.NewReader("{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("X-API-Secret", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api-uat.dimetrades.com/api/partner/customers/kyc")
.header("X-API-Key", "<api-key>")
.header("X-API-Secret", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/partner/customers/kyc")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["X-API-Key"] = '<api-key>'
request["X-API-Secret"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"isKycVerified\": true,\n \"kycVerifiedAt\": \"2026-08-11T12:00:00.000Z\",\n \"externalCustomerId\": \"ext-123\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"message": "KYC status updated successfully",
"isKycVerified": true,
"kycVerifiedAt": "2026-08-11T12:00:00.000Z"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 401,
"error": "BrandUnauthorized",
"message": "Invalid brand credentials",
"code": 17001,
"explanation": "The X-API-Key / X-API-Secret pair is missing or does not match an active credential."
}
}{
"data": {},
"errors": {
"statusCode": 404,
"error": "CustomerNotFound",
"message": "Customer not found",
"code": 17003,
"explanation": "No customer with this externalCustomerId has been registered for this brand."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Authorizations
ISV / partner credential — public half. Required on every request.
Identifies the integration partner (ISV) making the call. Issued by Dime
Trades when the ISV is onboarded and sent on every /partner/* endpoint:
X-API-Key: dt_pk_live_7f3c9a2e5b18
- On the two partner endpoints that create accounts or issue tokens (
POST /partner/customers,POST /partner/customers/login), it is accompanied byX-API-Secretand is the only authentication — there is no user token yet. - On every other partner endpoint it is sent alongside the user's
Authorization: Bearer <token>: the API key says which platform is calling, the bearer token says which user it is calling for.
Credentials are scoped to one or more brands; using a key with a brandId outside that scope returns 403. Staging and production keys are separate.
The key identifies your platform — treat it as a backend credential.
ISV / partner credential — secret half. Sent on every /partner/* endpoint.
The confidential counterpart to X-API-Key. It is required, together with the key, on every /partner/* endpoint: register, login, refresh-token, logout, kyc, wallet-instructions and the replay endpoints. Outside /partner/* — the ordinary user API, called with a user's bearer token — the key is sent without the secret.
X-API-Key: dt_pk_live_7f3c9a2e5b18
X-API-Secret: dt_sk_live_9d41ba07c6e2f85a3b7c1049de26f8b1
A request to a /partner/* endpoint that has a key without its matching secret is rejected with 401. The secret is shown once at issue time and stored only as a hash on our side — if it is lost or exposed, rotate the pair from the partner console rather than asking for a copy. Never ship it in a browser or mobile client: anyone holding it can mint a token for any of your users.
Body
Whether the customer is verified for KYC. Set true when KYC is complete, or false if not.
The customer's identifier on your platform. Optional when the previous step returned a customer object; required on every subsequent partner call.
1 - 128"ext-123"
UTC timestamp when KYC was verified. Optional; if omitted the server may populate it automatically.
