POST /customers/:id/kyc-link/rotate

Rotate the customer's hosted KYC link. The existing token is overwritten in place with a new one. The previous URL stops working immediately. Use after a suspected leak (e.g. the link was shared on a compromised channel) or when a partner wants to invalidate a long-outstanding link.

Every customer carries a HostedKycLink inline on every read. There is no GET here, the post-rotation pair lives on the next GET /customers/:id. This endpoint returns the new pair eagerly so callers don't need a follow-up read.

There's no expiry, no revocation list, no per-link metadata. Rotation is the only way to invalidate.

Request body

None. Empty body.

Response 200

A fresh HostedKycLink. The kind segment in url matches the customer's type (ind for individual, biz for business, bi for business-individual). The origin matches the environment (https://orchestration.seismic.systems on production, https://orchestration.seismictest.net on sandbox).

Individual customer:

{
  "token": "klink_z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0f",
  "url": "https://orchestration.seismic.systems/kyc-link/ind/klink_z9y8x7w6v5u4t3s2r1q0p9o8n7m6l5k4j3i2h1g0f"
}

Business customer:

{
  "token": "klink_q3p2o1n0m9l8k7j6i5h4g3f2e1d0c9b8a7z6y5x4w3v",
  "url": "https://orchestration.seismic.systems/kyc-link/biz/klink_q3p2o1n0m9l8k7j6i5h4g3f2e1d0c9b8a7z6y5x4w3v"
}

Errors

404, unknown id or the customer belongs to an org you're not a member of (the two cases collapse so existence doesn't leak across tenants).

Example

curl -X POST "$SEISMIC_ORCHESTRATION_URL/v0/customers/2f10…/kyc-link/rotate" \
  -H "Api-Key: $SEISMIC_ORCHESTRATION_API_KEY"