List the KYC evidence files of an accreditation

{
  "accreditationId": "acr_891418ce2f67",
  "count": 2,
  "items": [
    {
      "artifactId": "art_7c1d90f2ab34",
      "kind": "unico_evidence_set",
      "cpf": "12345678901",
      "fileName": "unico_evidence_set.jwt",
      "contentType": "application/jwt",
      "sizeBytes": 14203,
      "sha256": "3f9a2b1c0d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
      "createdAt": "2026-02-20T08:33:39Z",
      "scanStatus": "PENDING",
      "scanReason": "Pagamento pedido #12345",
      "metadata": {
        "key": "db5c2a29-243e-42a2-862b-89737c0213aa"
      },
      "downloadUrl": "https://example.com/webhooks/corpx"
    }
  ]
}

Returns the KYC artifacts archived for the accreditation — the company documents you uploaded, the signed evidence set produced by the identity provider (unico_evidence_set, a JWT) and the holder selfie (unico_selfie). Each item already carries a pre-signed downloadUrl valid for about 10 minutes, so there is no second round trip.

downloadUrl is omitted while scanStatus is not APPROVED: uploads go through type checking, antivirus and sanitisation before being archived.

Two independent switches gate this endpoint, because it returns the holder’s biometrics:

the kyc_artifacts feature must be enabled for your tenant (contact CorpX — it requires a contractual clause), otherwise 403 feature_disabled;
the API credential must carry the kyc.read scope. The generic read scope is deliberately not accepted, so no existing credential starts downloading faces without an explicit decision.

BaaS integrators only.

Returns the KYC artifacts archived for the accreditation — the company documents you uploaded, the signed evidence set produced by the identity provider (`unico_evidence_set`, a JWT) and the holder selfie (`unico_selfie`). Each item already carries a pre-signed `downloadUrl` valid for about 10 minutes, so there is no second round trip. `downloadUrl` is omitted while `scanStatus` is not `APPROVED`: uploads go through type checking, antivirus and sanitisation before being archived. Two independent switches gate this endpoint, because it returns the holder's biometrics: - the `kyc_artifacts` feature must be enabled for your tenant (contact CorpX — it requires a contractual clause), otherwise `403 feature_disabled`; - the API credential must carry the `kyc.read` scope. The generic `read` scope is deliberately **not** accepted, so no existing credential starts downloading faces without an explicit decision. **BaaS integrators only.**

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Path parameters

accreditationIdstringRequired

Accreditation identifier (acr_*).

Response

Archived artifacts, newest first.

accreditationIdstringOptional

countintegerOptional

itemslist of objectsOptional

Errors

403

Forbidden Error

404

Not Found Error

500

Internal Server Error