Submit Access Application
Request and response reference for POST /v1/access-applications.
/v1/access-applicationsRequest
This entry point does not require an existing session. Applicable onboarding, origin and verification policies still apply.
curl -X POST "$OSAI_CONSOLE_BASE_URL/v1/access-applications" \
-H "Content-Type: application/json" \
-H "Origin: $OSAI_APP_ORIGIN" \
-H "Idempotency-Key: <stable-operation-key>" \
--data '{
"legal_name": "<legal_name>",
"company_email": "<company_email>",
"website": "<website>",
"country": "<country>",
"intended_use": "<intended_use>",
"requested_corridors": [
"<value>"
],
"consent_version": "<consent_version>"
}'Parameters
| Name | Location | Requirement | Description |
|---|---|---|---|
Origin | header · string | Required | Use the value defined for this resource. |
Idempotency-Key | header · string | Required | Use the value defined for this resource. |
Request body
Send JSON with Content-Type: application/json. Nested field names identify their parent object; required markers apply within that object. Replace template values using the relevant resource and configured instrument rules.
| Field | Type | Description & constraints |
|---|---|---|
legal_nameRequired in parent object | string | Defined by the resource contract. |
company_emailRequired in parent object | string | Defined by the resource contract. |
websiteRequired in parent object | stringuri | Defined by the resource contract. |
countryRequired in parent object | string | Defined by the resource contract.Pattern: ^[A-Z]{2}$ |
intended_useRequired in parent object | string | Defined by the resource contract. |
requested_corridorsRequired in parent object | array | Defined by the resource contract. |
consent_versionRequired in parent object | string | Defined by the resource contract. |
Responses
Inspect HTTP status before parsing a body. These tables describe client response fields rather than invented successful transaction payloads.
202 · HTTP 202 response
| Field | Type | Description & constraints |
|---|---|---|
statusRequired in parent object | string | Defined by the resource contract.Values: RECEIVED, MAILBOX_VERIFIED_REVIEW_PENDING |
400 · Invalid bounded request
No client body fields are defined for this response.
401 · Authentication required
No client body fields are defined for this response.
403 · Staff scope, MFA, CSRF, domain or verification denied
No client body fields are defined for this response.
409 · Version, slug or idempotency conflict
No client body fields are defined for this response.
503 · Unconfigured policy, unavailable owner or unknown outcome
No client body fields are defined for this response.
Retries & recovery
Keep the original request identifiers and any required idempotency key. A timeout does not establish failure. Read the original resource or command before another financial write; use expected versions for concurrent changes.