curl --request POST \
  --url https://sandbox.singapay.id/api/v1/kyc/bank/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_number": "1234-5678-9012",
  "bank_code": "014",
  "name": "Siti R.",
  "request_id": "f1c2a3b4-5d6e-7f80-9012-345678901234"
}
'

{
  "code": "SUCCESS",
  "data": {
    "similarity": 100,
    "status": "found",
    "suggestion": "pass"
  },
  "message": "OK",
  "pricing": "PAID",
  "request_id": "TXN-20260727-001"
}

Bank

Verify the holder name on a bank account.

Looks up the registered holder name on the named bank for the given account number and compares it against the submitted name.

Responses use the standard envelope (code, data / message, request_id, pricing). Only code=SUCCESS is billable (pricing=PAID).

Behaviour by outcome

Upstream result	Envelope
Account exists	`code=SUCCESS`, `data.status="found"`, `pricing=PAID`
Account not found	`code=SUCCESS`, `data.status="not found"`, `suggestion=reject`, `pricing=PAID`
Upstream unavailable after retry	`code=SERVER_ERROR`, `pricing=FREE`
Validation error (bad account / bank / name / request_id)	`code=CLIENT_ERROR`, `pricing=FREE`
Duplicate / conflicting `request_id`	`code=DUPLICATE_REFERENCE`, `pricing=FREE`
Not entitled / not authenticated	`code=UNAUTHORIZED`, `pricing=FREE`
Prepaid balance too low	`code=INSUFFICIENT_BALANCE`, `pricing=FREE`

Access

Requires a valid Bearer token. Access is gated by feature entitlement (BANK_CHECK_INQUIRY); BOSS enables the feature per merchant. When the feature is off the call returns UNAUTHORIZED.

Account number format

Accept digits with optional separators ( , -, ., _). The service strips separators and requires 6–20 digits remaining.

Bank code

Must be an enabled entry in the supported-banks catalogue (≈104 Indonesian clearing codes). Numeric codes are zero-padded to 3 digits (2 → 002). Fetch the live list from the merchant dashboard (Supported banks).

Idempotency

Two requests with the same (merchant_id, request_id) return the same SUCCESS response and are billed once when the prior attempt completed successfully. A conflicting payload with the same request_id returns DUPLICATE_REFERENCE. A prior upstream failure is re-run on retry rather than replayed.

POST

api

kyc

bank

verify

curl --request POST \
  --url https://sandbox.singapay.id/api/v1/kyc/bank/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_number": "1234-5678-9012",
  "bank_code": "014",
  "name": "Siti R.",
  "request_id": "f1c2a3b4-5d6e-7f80-9012-345678901234"
}
'

{
  "code": "SUCCESS",
  "data": {
    "similarity": 100,
    "status": "found",
    "suggestion": "pass"
  },
  "message": "OK",
  "pricing": "PAID",
  "request_id": "TXN-20260727-001"
}

Authorizations

Authorization

string

header

required

RS256-signed JWT obtained from POST /api/v1/kyc/auth/get-auth-token. Default lifetime one hour. JWKS is published at /.well-known/jwks.json on the service side (used by the gateway, not by merchants).

Body

application/json

account_number

string

required

Bank account number. Spaces, dashes, dots, and underscores are stripped; the digits-only form is stored and sent upstream. After normalisation the value must be 6–20 digits.

Example:

"1234567890"

bank_code

string

required

Indonesian bank clearing code from the supported-banks catalogue (≈104 entries). Numeric codes are zero-padded to 3 digits (2 → 002, 14 → 014). Unknown or disabled codes return CLIENT_ERROR.

Example:

"014"

name

string

required

Name to verify against the registered account holder name. Trimmed before validation.

Required string length: 1 - 200

Example:

"Budi Santoso"

request_id

string

required

Merchant-supplied idempotency / reference key. Recommended: UUID v4. Two requests with the same key return the same answer and are billed once.

Example:

"TXN-20260727-001"

Response

Verification complete (whether the account exists or not). code is always SUCCESS; inspect data.status / data.suggestion for the outcome. pricing is PAID.

code

enum<string>

required

Business status code. Always SUCCESS on this shape.

Available options:

SUCCESS

Example:

"SUCCESS"

data

object

required

Show child attributes

message

enum<string>

required

Always OK. Present so every response carries a message, whether it succeeded or not; branch on code, not on this.

Available options:

OK

Example:

"OK"

pricing

enum<string>

required

Billing outcome for this call. PAID when verification ran (including data.status = "not found").

Available options:

PAID

Example:

"PAID"

request_id

string

required

Echo of the request's request_id.

Example:

"TXN-20260727-001"