Skip to main content
Get create account URL
This API MUST be implemented by the Partner. Platform’s backend will consume it to obtain the delegated registration link.
Our backend will consume this service by performing a POST request to: [Base-URL]/GetCreateAccountUrl.
The path must be respected exactly as specified. The Partner defines only the [Base-URL]; the resource segment /GetCreateAccountUrl, the POST method and the JSON body are fixed by this contract and are case-sensitive.Every request travels signed. It carries the X-Timestamp and X-Signature headers with the HMAC-SHA256 signature of the raw body. The Partner must validate the signature before processing the request.
This endpoint will only be used when the Partner has account creation configured as OnDemand. Expected behavior: Invokes the retrieval of a temporary delegated registration URL. In cases where the Partner orchestrates the user account registration, this endpoint must generate and return a secure RegistrationUrl where the user can complete or initiate their enrollment.

Headers

X-Timestamp
string
required

UTC timestamp in ISO-8601 format with milliseconds (yyyy-MM-ddTHH:mm:ss.fffZ), generated at send time. Its exact string value is part of the signed message, so it cannot be altered, and it lets the Partner reject stale requests (replay protection). See Data Integrity.

X-Signature
string
required

HMAC-SHA256 signature of the request, Base64-encoded (standard alphabet). It is computed over bytes(X-Timestamp) + bytes(".") + rawBodyBytes using the shared secret agreed for the integration. The Partner MUST validate it — with a constant-time comparison and over the raw body, before any deserialization — and reject the request if it does not match. See Data Integrity.

User-Agent
string
required

Fixed value VNA. Sent on every request. Some Partners' WAFs reject requests without a User-Agent, so the Platform always sets it explicitly; if the Partner filters by this header, this is the value to allow.

Body

application/json
TransactionId
string
required

Unique identifier of the request, used as an idempotency key. It is derived deterministically from the operation, the Partner and the action, so a retry of the same action arrives with the same value: the Partner MUST process it only once and return the original outcome on repeats.

PersonalData
object
required

Personal Data of the Person being created. At least one of PhoneNumber or Email is present, but the address may be partial: only CountryCode and StateCode are guaranteed — Address1, City and ZipCode may be absent.

PersonalDocuments
object[]
required

List of identity documents for the Person. May be an empty array when no identity document is on file.

Response

200 - application/json

Ok

RegistrationUrl
string
required

The URL where the Person must complete the registration.

Success
boolean
required

True if the URL generation is Successful / False if it Failed.

ResponseDescription
string
required

If the URL generation is not successful, the reason of the Failure will be provided in this field.