Email a KYB party its hosted verification link

Optional (on request). Applies only if this feature is enabled for your client.

Send an owner or officer of a KOBBLE_KYB_2 company — discovered by the partner from the company registry (links_from[].source PARTNER), or declared by you and projected with POST /customers/v1/verifications/{companyId}/parties/declared (source CUSTOMER) — its hosted verification link by email, so the party can complete identity verification without the company relaying a URL. companyId is the company verification and partyId one of its links_from[].party_id; both must belong to the calling client, otherwise 404 Party link not found.

Kobble mints a fresh hosted link for the party (the same link GET /verifications/{partyId}/session-token would return), emails it, and records the invite on the party link (invited_email masked, invited_at, invite_count on the company's links_from). A NOT_STARTED party moves to PENDING.

The email. Plain text, sent from Kobble on behalf of the company. It greets the party by its registry display_name, explains that the named company has asked them to verify their identity as one of its owners or officers as part of its business verification, carries the secure link, states that the link expires in 7 days, and — when message is supplied — quotes your message verbatim, attributed to the company. It closes by noting the address is not monitored. No ownership figure, address, date of birth or partner reference is included.

Cooldown and re-issue. One invite per party per 10 minutes: a second call inside the window is a 409 INVITE_RATE_LIMITED with error.context.retry_after_seconds. A call after the cooldown (e.g. to a corrected address, or because the 7-day link lapsed) issues a brand-new link and sends a fresh email; earlier links for the party are superseded.

Not invitable. 409 PARTY_NOT_INVITABLE when the party is on a _1 product (verified inside the company's SDK flow), when the partner has not yet created an applicant for it (the ownership graph is still being fetched), or when the party is already APPROVED / REJECTED / CANCELLED. The same conditions make the party's session-token call a 400 with the same reason.

Requires the client/write scope. Owner-scoped.

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200OK

application/json

Invite sent.

Bodyapplication/json

Example

{
    "sent_to": "jane.citizen@example.com",
    "sent_at": "2026-09-21T03:12:44.000Z",
    "verification_url": "https://verify.kobble.net/verification/def456"
}

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🟠404Record Not Found

🟠409