Information Requests (RFIs)

Overview

An information request (RFI) is MoonPay Enterprise asking for more detail about one of your customers. An RFI carries questions, a request for documents, or both. You collect the answers from your customer, submit them through the API, and MoonPay reviews and closes the RFI. There are three types:

probing_questions: questions about the customer or their activity
source_of_funds: questions about specific transactions. Always tied to a transaction
liveness: a new selfie check. The RFI carries a liveness_url to send your customer to. It takes no answers and no follow-up rounds, so a response to it returns 400

Some RFIs also move the customer back to IdentificationRequired. That pauses the customer, and funds sent to an active Autoramp are held until the RFI is resolved. Treat an RFI on a live customer as blocking, not informational.Held funds can be returned to the sender, but only manually. Contact the MoonPay team to arrange it.

Not every RFI does this. A customer can keep transacting with an open RFI, so read the customer’s status rather than assuming the RFI paused them.

RFIs do not emit webhooks. Poll GET /api/rfis to pick up new requests.

Rounds

Every RFI has at least one round. Round 1 is created with the RFI. If your answers don’t settle the question, MoonPay sends a follow-up round with new questions on the same RFI. Only the latest round accepts a response. The write endpoints take a round_id and return 409 Conflict if that round is not the latest one, so read the RFI first and use the round with the highest round_number. Rounds come back sorted by round_number ascending.

Statuses

Status	Description
`waiting_on_response`	The latest round is open. You owe a response.
`needs_review`	Your response is in. MoonPay is reviewing it.
`closed`	MoonPay resolved the RFI.

Submitting a response moves an RFI from waiting_on_response to needs_review. A follow-up round moves it back to waiting_on_response.

The API does not return how an RFI was resolved. A closed RFI tells you MoonPay is done with it, not whether the response passed.

How it works

Poll for open RFIs

GET /api/rfisReturns open RFIs grouped by customer, oldest first.

Read the latest round

Take the round with the highest round_number. Its questions are what you need to answer, and documents_requested tells you whether documents are also needed.

Upload documents, if requested

POST /api/rfis/{rfi_id}/rounds/{round_id}/documentsCollect the files from your customer and upload each one. Upload at least one before you submit the response.

Submit the response

POST /api/rfis/{rfi_id}/rounds/{round_id}/responseAnswer every required question in one call. The RFI moves to needs_review.

Wait for MoonPay

MoonPay either closes the RFI or sends a follow-up round. Keep polling to find out which.

Answer an RFI in the dashboard

Every RFI also shows up in the Partner Dashboard, so your team can answer one without an integration. The dashboard calls the same endpoints documented below, so an RFI answered there reaches needs_review exactly as an API response does.

1. Open the RFI queue

Compliance > RFIs: every customer with an open request, how many requests each one has, and the age of the oldest. The status column separates what you owe a response on from what is already back with MoonPay.

Compliance page on the RFIs tab, listing three customers with request counts and needs action or submitted badges

2. Read the request

Click the customer’s name. Questions · Round 1 lists what was asked, with a Needs action badge while a response is outstanding. The copy button copies the questions to your clipboard to forward to your customer. Required questions carry an asterisk, and each answer box matches the question type: free text, or Yes/No with an optional details field.

Information requests sheet showing the customer record and Questions Round 1 with four unanswered questions

3. Submit the response

Submit response stays disabled until every required question has an answer. When documents were requested, the card also shows a file upload, and submitting is blocked until at least one file is uploaded. After submitting, the card turns read-only: a Submitted badge, your answers echoed under each question, a Responded timestamp, and Copy Q&A for the whole exchange. The customer’s row drops its needs-action badge.

The same sheet after submitting, read-only with a Submitted badge, the answers echoed under each question, and a Response submitted toast

A follow-up round arrives as a new Questions · Round 2 card on the same RFI, and the customer’s row goes back to needs action. Answer it the same way.

List open RFIs

GET /api/rfis By default, returns RFIs in waiting_on_response or needs_review, grouped by customer. Customers with at least one RFI still waiting on a response come first, then the customer whose oldest RFI was sent earliest. Closed RFIs are not included unless you pass state=completed, which returns only closed RFIs, most recently closed first.

Query parameters

Parameter	Type	Required	Description
`state`	string	No	`open` (default) or `completed`
`search_term`	string	No	Matches customer name, customer email, or an exact customer ID. Max 256 characters
`cursor`	string (UUID)	No	Customer ID from the previous response’s `cursor`. Fetches the next page
`prev_cursor`	string (UUID)	No	Customer ID from the previous response’s `prev_cursor`. Fetches the previous page
`page_size`	integer	No	Customers per page. Default `10`, max `100`

curl -X GET "https://api.sandbox.iron.xyz/api/rfis?page_size=25" \
  -H "X-API-Key: <your-api-key>"

const response = await fetch(
  "https://api.sandbox.iron.xyz/api/rfis?page_size=25",
  { headers: { "X-API-Key": "<your-api-key>" } },
);

response = requests.get(
    "https://api.sandbox.iron.xyz/api/rfis",
    params={"page_size": 25},
    headers={"X-API-Key": "<your-api-key>"},
)

Response

{
  "items": [
    {
      "customer_id": "9c1f0a3e-5d4b-4f20-9a6e-3b71c8f2d014",
      "customer_name": "Alina Vogt",
      "customer_email": "alina.vogt@example.com",
      "customer_type": "Person",
      "oldest_sent_at": "2026-09-12T09:14:02Z",
      "rfis": [
        {
          "id": "7f3a2b18-64c9-4f8d-8c31-b0d5e9a12f77",
          "customer_id": "9c1f0a3e-5d4b-4f20-9a6e-3b71c8f2d014",
          "transaction_id": null,
          "rfi_type": "probing_questions",
          "status": "waiting_on_response",
          "rounds": [
            {
              "id": "c58e1d47-2a90-4b6f-9f03-7e2c4a8b1d55",
              "round_number": 1,
              "questions": [
                {
                  "id": "employment_status",
                  "prompt": "What is the customer's current employment status?",
                  "answer_type": "text",
                  "required": true
                },
                {
                  "id": "trades_for_third_party",
                  "prompt": "Is the customer transacting on behalf of anyone else?",
                  "answer_type": "yes_no",
                  "required": true
                }
              ],
              "answers": null,
              "documents_requested": true,
              "document_instructions": "Upload the last three months of bank statements.",
              "document_upload_url": null,
              "document_link_opened_at": null,
              "documents": [],
              "sent_at": "2026-09-12T09:14:02Z",
              "response_received_at": null
            }
          ],
          "partner_note": null,
          "sent_at": "2026-09-12T09:14:02Z",
          "response_received_at": null,
          "closed_at": null,
          "created_at": "2026-09-12T09:14:02Z",
          "updated_at": "2026-09-12T09:14:02Z"
        }
      ]
    }
  ],
  "cursor": null
}

cursor is the customer ID to pass as cursor for the next page. It is null on the last page.

List a customer’s RFIs

GET /api/customers/{customer_id}/rfis Returns the open RFIs for one customer as a flat array, newest first. Closed RFIs are not included here. Fetch a closed RFI by ID instead.

curl -X GET "https://api.sandbox.iron.xyz/api/customers/9c1f0a3e-5d4b-4f20-9a6e-3b71c8f2d014/rfis" \
  -H "X-API-Key: <your-api-key>"

Get an RFI

GET /api/rfis/{rfi_id} Returns one RFI in any status, including closed.

curl -X GET "https://api.sandbox.iron.xyz/api/rfis/7f3a2b18-64c9-4f8d-8c31-b0d5e9a12f77" \
  -H "X-API-Key: <your-api-key>"

Response

string (UUID)

required

The RFI ID.

string (UUID)

required

The customer the RFI is about.

string (UUID)

The transaction under review. Always set for source_of_funds, null otherwise.

string

required

probing_questions, source_of_funds, or liveness.

string

required

waiting_on_response, needs_review, or closed.

string

The verification link to send your customer on a liveness RFI. Omitted on every other RFI type, and on a liveness RFI until the link is ready.

array

required

One entry per round, sorted by round_number ascending.

Show properties

string (UUID)

required

The round ID. Pass it as round_id when you respond.

integer

required

Starts at 1 and increments per follow-up.

array

required

Show properties

string

required

Question ID. Use it as question_id in your answer. Unique within the round.

string

required

The question to put to your customer.

string

required

text or yes_no. Determines which answer field to send.

boolean

required

When true, the response is rejected unless this question is answered.

string (UUID)

The transaction this question asks about. Present on source_of_funds questions, omitted otherwise.

array

The answers you submitted for this round. null until you respond.

boolean

required

When true, the round needs documents as well as answers.

string

What the documents need to show.

string

External upload link on legacy rounds created before documents were uploaded through the API. null on new rounds: upload files with Upload a document instead.

string (ISO 8601)

When the legacy upload link was first recorded as opened. null until then.

array

required

Files uploaded for this round. Each entry has id, file_name, content_type, size_bytes, and uploaded_at. Empty until you upload one.

string (ISO 8601)

required

When the round was sent.

string (ISO 8601)

When your response for this round arrived. null until then.

string (ISO 8601)

required

When the latest round was sent. A follow-up round resets it.

string (ISO 8601)

When your response to the latest round arrived. null until you respond, and reset to null when a follow-up round is sent.

string (ISO 8601)

When MoonPay closed the RFI. null while it is open.

string

A note from MoonPay about a closed RFI. Set only on some closed RFIs, null otherwise.

string (ISO 8601)

required

When the RFI was created.

string (ISO 8601)

required

When the RFI last changed.

Upload a document

POST /api/rfis/{rfi_id}/rounds/{round_id}/documents Uploads one file for a round that has documents_requested: true. Send it as multipart/form-data in a file field. Each file must be a PDF, PNG, or JPEG of at most 10 MB, and a round holds at most 20 files. Call it once per file.

curl -X POST "https://api.sandbox.iron.xyz/api/rfis/7f3a2b18-64c9-4f8d-8c31-b0d5e9a12f77/rounds/c58e1d47-2a90-4b6f-9f03-7e2c4a8b1d55/documents" \
  -H "X-API-Key: <your-api-key>" \
  -H "Idempotency-Key: <unique-request-id>" \
  -F "file=@bank-statement.pdf;type=application/pdf"

Returns 200 with the uploaded document:

{
  "id": "0192a6f4-1c2e-7b3d-9a41-5e8f0c7d2b13",
  "file_name": "bank-statement.pdf",
  "content_type": "application/pdf",
  "size_bytes": 284113,
  "uploaded_at": "2026-09-13T10:02:45Z"
}

A file of the wrong type or over 10 MB returns 400 with a plain-text body:

< HTTP/2 400
< content-type: text/plain; charset=utf-8
<
upload a PDF, PNG or JPEG file of at most 10 MB

This POST requires an Idempotency-Key header. See Idempotency for retry behavior.

Record that the upload link was opened

POST /api/rfis/{rfi_id}/rounds/{round_id}/document-link-opened Applies only to legacy rounds that carry a document_upload_url. Records that the link was opened, and stamps document_link_opened_at. Call it once, when you hand the link to your customer. On a legacy round, an API key can submit a response with documents_uploaded: true without this call. A signed-in dashboard user has to open the link first, otherwise the response is rejected with 400.

curl -X POST "https://api.sandbox.iron.xyz/api/rfis/7f3a2b18-64c9-4f8d-8c31-b0d5e9a12f77/rounds/c58e1d47-2a90-4b6f-9f03-7e2c4a8b1d55/document-link-opened" \
  -H "X-API-Key: <your-api-key>" \
  -H "Idempotency-Key: <unique-request-id>"

Returns 200 with an empty body.

This POST requires an Idempotency-Key header. See Idempotency for retry behavior.

Calling it twice for the same round returns 409. See Common errors.

Submit a response

POST /api/rfis/{rfi_id}/rounds/{round_id}/response Submits answers for one round. One call per round: there is no partial save, so send every answer you have at once.

Body

Field	Type	Required	Description
`answers`	array	Yes	One entry per answered question. Send `[]` for a documents-only round
`answers[].question_id`	string	Yes	Must match a question `id` in this round. No duplicates
`answers[].text_value`	string	Conditional	Required for `text` questions, and must be non-empty. Omit for `yes_no`
`answers[].boolean_value`	boolean	Conditional	Required for `yes_no` questions. Omit for `text`
`answers[].explanation`	string	No	Free-text context for the answer. Allowed on either answer type
`documents_uploaded`	boolean	Yes	When the round has `documents_requested: true`, upload at least one file first. `true` without an uploaded file is accepted only on a legacy round with a `document_upload_url`

Send exactly one value per answer. A text question with boolean_value set, or a yes_no question with text_value set, returns 400. Every question marked required: true has to be answered in the same call.

curl -X POST "https://api.sandbox.iron.xyz/api/rfis/7f3a2b18-64c9-4f8d-8c31-b0d5e9a12f77/rounds/c58e1d47-2a90-4b6f-9f03-7e2c4a8b1d55/response" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: <your-api-key>" \
  -H "Idempotency-Key: <unique-request-id>" \
  -d '{
    "answers": [
      {
        "question_id": "employment_status",
        "text_value": "Employed full time as a nurse",
        "explanation": "Confirmed by the customer on a recorded call."
      },
      {
        "question_id": "trades_for_third_party",
        "boolean_value": false
      }
    ],
    "documents_uploaded": true
  }'

Returns 200 with an empty body. The RFI moves to needs_review and response_received_at is set on both the round and the RFI.

This POST requires an Idempotency-Key header. See Idempotency for retry behavior.

Error response

A rejected response returns 400 with a plain-text body, not JSON:

< HTTP/2 400
< content-type: text/plain; charset=utf-8
<
RFI answers are malformed

Unlike most API errors, these 400 bodies are plain text. Don’t parse them as JSON.

Common errors

Error	Cause
`400 Bad Request`	`RFI answers are malformed`: unknown or duplicated `question_id`, the wrong value field for the question’s `answer_type`, an empty `text_value`, or a missing required answer
`400 Bad Request`	`upload the requested documents before submitting`: the round requested documents and none has been uploaded
`400 Bad Request`	`upload a PDF, PNG or JPEG file of at most 10 MB`: the uploaded file has the wrong type or is too large
`400 Bad Request`	`a liveness RFI opens only through a liveness request and takes no answers or follow-up rounds`: you submitted a response to a `liveness` RFI
`401 Unauthorized`	Missing or invalid `X-API-Key`
`403 Forbidden`	The API key lacks `View` for the read endpoints, or `UpdateCustomer` for the write endpoints
`404 Not Found`	Unknown customer, RFI, or round, or it belongs to another partner
`409 Conflict`	The RFI is not in `waiting_on_response`, the round is not the latest one, the round did not request documents or already holds 20 files, or the upload link was already recorded as opened
`500 Internal Error`	The request failed server-side. Safe to retry

Among errors, 400 is the only status that carries a body. Unlike most of the API, these endpoints return no message or trace_id on 500.

Getting Started

Dashboard

Customer operations

Onboarding & Compliance

Addresses & Travel Rule

Autoramp & Transactions

Webhooks & Events

Billing & Settlement

Tutorials

Issuance

Wallets

Coverage

Support

Overview

Rounds

Statuses

How it works

Answer an RFI in the dashboard

1. Open the RFI queue

2. Read the request

3. Submit the response

List open RFIs

Query parameters

Response

List a customer’s RFIs

Get an RFI

Response

Upload a document

Record that the upload link was opened

Submit a response

Body

Error response

Common errors

Customer in EDD

Source of Wealth

​Overview

​Rounds

​Statuses

​How it works

​Answer an RFI in the dashboard

​1. Open the RFI queue

​2. Read the request

​3. Submit the response

​List open RFIs

​Query parameters

​Response

​List a customer’s RFIs

​Get an RFI

​Response

​Upload a document

​Record that the upload link was opened

​Submit a response

​Body

​Error response

​Common errors

​Related guides

Customer in EDD

Source of Wealth

Overview

Rounds

Statuses

How it works

Answer an RFI in the dashboard

1. Open the RFI queue

2. Read the request

3. Submit the response

List open RFIs

Query parameters

Response

List a customer’s RFIs

Get an RFI

Response

Upload a document

Record that the upload link was opened

Submit a response

Body

Error response

Common errors

Related guides