> ## Documentation Index > Fetch the complete documentation index at: https://docs.rinne.com.br/llms.txt > Use this file to discover all available pages before exploring further. # Answer an onboarding requirement > Requires the merchant.onboarding-requirement.edit permission. Answers an `INFORMATION` or `EVIDENCE_PACKAGE` requirement of the merchant and returns the row resolved. An `INFORMATION` requirement needs `text`. An `EVIDENCE_PACKAGE` collects files first — uploads that name it in `requirement_id` — and is closed by this call, with or without `text`; without `text` it needs at least one completed attachment the provider has not refused. Once closed, the package takes no more attachments until the provider refuses it. A later answer replaces the earlier one in the resolution. Any other requirement type, and a waived one, answers `400` on `requirement_id`. ## OpenAPI ````yaml /api-spec.yaml post /v1/merchants/{merchantId}/onboarding-requirements/{id}/answer openapi: 3.1.0 info: title: Rinne API version: 1.0.0 description: > **Rinne API** is a robust payment platform that offers integration with multiple payment providers. ## Authentication The API uses API Key authentication via the `x-api-key` header. Each company has a unique key to access resources. ## Response Format All responses follow a consistent format: - **Success**: Returns the requested data directly - **Error**: Returns an `error` object with detailed information ## Pagination Endpoints that return lists support pagination through parameters: - `page`: Page number (default: 1) - `limit`: Items per page (default: 20, maximum: 100) ## Supported Providers The API supports multiple payment providers: - **Rinne**: Internal provider - **Celcoin**: PIX integration and other financial services ## Raw Card Data (PCI Endpoints) Card credential fields (`card_data.number`, `card_data.cvv`, `card_data.network_token`, `card_data.cryptogram`, and the 3DS `card.number`) must always be sent encrypted — values start with the `ev:` prefix. Plaintext values are rejected with `400 VALIDATION_ERROR` on every host. There are two ways to send encrypted values: - **rinne-js**: card forms and wallet buttons (Apple Pay / Google Pay) encrypt credentials client-side before they leave the browser. - **PCI API host**: server-to-server integrations that handle raw card data must call `https://pci.api.rinne.com.br/core` (sandbox: `https://pci.api-sandbox.rinne.com.br/core`) instead of the regular host. This endpoint encrypts `number` and `cvv` in transit before the request reaches the API; all other fields pass through unchanged. The PCI host serves only transaction creation and 3DS session creation (both the self and merchant variants); use the regular host for everything else. contact: name: Rinne API Support email: suporte@rinne.com.br servers: - url: https://api-sandbox.rinne.com.br/core description: Sandbox - url: https://api.rinne.com.br/core description: Production security: [] tags: - name: System description: System and API health endpoints - name: Tap-on-Phone description: Access-token minting for the Tap-on-Phone SDK (called from your backend) - name: Authentication description: User authentication and authorization endpoints - name: Management description: >- Merchant management endpoints - create, list, get specific, overview, update - name: Transactions description: Transaction operations for merchants - create, list, overview, refunds - name: Affiliations description: Affiliation management for merchants - name: Biometric Verifications description: Biometric verifications of your merchants' contacts - name: Onboarding Requirements description: What your merchants must prove to a provider, and how far along they are - name: Onboarding Documents description: Documents uploaded for your merchants - name: KYC description: KYC check history of your merchants - name: Banking description: Banking operations for merchants - balance, cashout, statements - name: Bank Accounts description: Bank account management for merchants - name: Pix Keys description: PIX key management for merchants - name: Company Transactions description: Direct transaction management and query endpoints for companies - name: Companies description: Company management - name: Company Affiliations description: Payment provider affiliation management - name: Company Biometric Verifications description: Biometric verifications of the company contact - name: Company Onboarding Requirements description: What the company must prove to a provider, and how far along it is - name: Company Onboarding Documents description: Documents the company uploads for its onboarding - name: Company Banking description: Company banking endpoints (balance, etc.) - name: Company Pix description: Company PIX key management - name: Company Ledger description: Company ledger entry query endpoints - name: Company Disputes description: Company dispute query endpoints - name: Company Receivables description: Contract effects on the company's own receivables - name: Ledger description: Ledger entry query endpoints (company and merchants) - name: Disputes description: Dispute query endpoints for an organization's merchants - name: Cards description: Stored card management (self and merchant) - name: API Keys description: API key management - create, list, revoke (hashed, show-once) - name: Webhooks description: Endpoints for receiving webhooks from external providers - name: Pricing description: Fee and cost policy management for transaction pricing - name: Users description: User management endpoints - name: Roles description: Role management endpoints - name: Permissions description: Permission management endpoints paths: /v1/merchants/{merchantId}/onboarding-requirements/{id}/answer: post: tags: - Onboarding Requirements summary: Answer an onboarding requirement description: > Requires the merchant.onboarding-requirement.edit permission. Answers an `INFORMATION` or `EVIDENCE_PACKAGE` requirement of the merchant and returns the row resolved. An `INFORMATION` requirement needs `text`. An `EVIDENCE_PACKAGE` collects files first — uploads that name it in `requirement_id` — and is closed by this call, with or without `text`; without `text` it needs at least one completed attachment the provider has not refused. Once closed, the package takes no more attachments until the provider refuses it. A later answer replaces the earlier one in the resolution. Any other requirement type, and a waived one, answers `400` on `requirement_id`. parameters: - in: path name: merchantId required: true schema: type: string description: The merchant ID example: c0a8012e-4d3b-4a6e-8f1b-1a2b3c4d5e6f - in: path name: id required: true schema: type: string format: uuid description: The requirement ID example: 7f3d9c2a-5b1e-4c8d-9a6f-0e2b4d6c8a10 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AnswerOnboardingRequirementRequest' responses: '201': description: The requirement, resolved with the new answer content: application/json: schema: $ref: '#/components/schemas/OnboardingRequirementResponse' '400': description: >- Validation error, a requirement that takes no answer, or a blank answer the requirement cannot take content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' '401': description: Unauthorized - Invalid or missing API key content: application/json: schema: $ref: '#/components/schemas/AuthenticationErrorResponse' '403': description: > Insufficient permissions, or company onboarding is not available to the caller yet (`message`: "Company onboarding is not available yet") content: application/json: schema: $ref: '#/components/schemas/AuthorizationErrorResponse' '404': description: >- Merchant not found or does not belong to the authenticated organization, or the requirement is not the merchant's content: application/json: schema: $ref: '#/components/schemas/NotFoundErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/InternalServerErrorResponse' security: - ApiKeyAuth: [] components: schemas: AnswerOnboardingRequirementRequest: type: object properties: text: type: string maxLength: 10000 description: >- The answer; surrounding whitespace is trimmed. Required for `INFORMATION`; optional for `EVIDENCE_PACKAGE`, whose attachments may carry the answer example: The business sells coffee and pastries to walk-in customers. OnboardingRequirementResponse: type: object description: >- One thing a company must prove to a provider, with its status derived from the evidence Rinne holds properties: id: type: string format: uuid example: 7f3d9c2a-5b1e-4c8d-9a6f-0e2b4d6c8a10 company_id: type: string description: >- The company the requirement applies to (the organization itself or one of its merchants) example: c0a8012e-4d3b-4a6e-8f1b-1a2b3c4d5e6f provider: type: string enum: - CELCOIN - CAPPTA example: CELCOIN type: type: string enum: - IDENTITY_DOCUMENT - BIOMETRIC_VERIFICATION - ARTICLES_OF_INCORPORATION - POWER_OF_ATTORNEY - PROOF_OF_ADDRESS - PROOF_OF_INCOME - FINANCIAL_STATEMENT - INFORMATION - EVIDENCE_PACKAGE - OTHER description: > What meets it: `IDENTITY_DOCUMENT` a `CNH_DIGITAL` or the front and back of one identity document; `BIOMETRIC_VERIFICATION` an approved biometric verification of the subject; `ARTICLES_OF_INCORPORATION`, `POWER_OF_ATTORNEY`, `PROOF_OF_ADDRESS`, `PROOF_OF_INCOME`, `FINANCIAL_STATEMENT` and `OTHER` a document of the same type; `INFORMATION` a text answer; `EVIDENCE_PACKAGE` files attached to it and closed by an answer. example: IDENTITY_DOCUMENT subject_document_number: type: string description: Whom the requirement is about, digits only (a CPF or a CNPJ) example: '81146431023' subject_role: type: string enum: - COMPANY - CONTACT - PARTNER_COMPANY description: The subject's role for the company example: CONTACT origin: type: string enum: - BASE - PROVIDER_REQUEST - STAFF description: >- `BASE` from the provider's base set for the company's shape; `PROVIDER_REQUEST` from a provider's rejection review; `STAFF` added by Rinne staff example: BASE description: type: - string - 'null' description: >- What is being asked, for `PROVIDER_REQUEST` and `STAFF` rows; `null` on `BASE` rows example: null status: type: string enum: - PENDING - SATISFIED - REJECTED - WAIVED description: > Derived at read time: `PENDING` with no usable evidence; `SATISFIED` with `satisfied_by`; `REJECTED` when the only evidence is one the provider refused; `WAIVED` when staff waived it or the company's shape no longer calls for it (`waived_at` set). example: PENDING accepted_document_types: type: - array - 'null' description: >- The document types that meet the requirement at this provider (the identity family for `IDENTITY_DOCUMENT`, the type of the same name otherwise, each only when the provider accepts it); `null` for a requirement no document meets items: type: string enum: - CNH_FRONT - CNH_BACK - CNH_DIGITAL - RG_FRONT - RG_BACK - RNE_FRONT - RNE_BACK - ARTICLES_OF_INCORPORATION - POWER_OF_ATTORNEY - PROOF_OF_ADDRESS - PROOF_OF_INCOME - FINANCIAL_STATEMENT - OTHER example: - CNH_DIGITAL - CNH_FRONT - CNH_BACK - RG_FRONT - RG_BACK - RNE_FRONT - RNE_BACK satisfied_by: oneOf: - $ref: '#/components/schemas/OnboardingRequirementSatisfiedBy' - type: 'null' description: The evidence that meets it; `null` unless `SATISFIED` waived_at: type: - string - 'null' format: date-time example: null created_at: type: string format: date-time example: '2026-10-09T12:00:00.000Z' updated_at: type: string format: date-time example: '2026-10-09T12:00:00.000Z' required: - id - company_id - provider - type - subject_document_number - subject_role - origin - description - status - accepted_document_types - satisfied_by - waived_at - created_at - updated_at ValidationErrorResponse: type: object properties: error: type: object properties: code: type: string example: VALIDATION_ERROR message: type: string example: Validation error status: type: integer example: 400 details: type: object properties: issues: type: array items: type: object properties: field: type: string example: email type: type: string example: REQUIRED message: type: string example: Field 'email' is required value: anyOf: - type: string - type: number - type: boolean example: invalid_value constraints: type: object example: min: 18 max: 120 path: type: string example: /companies timestamp: type: string format: date-time example: '2023-12-01T10:00:00.000Z' requestId: type: string example: req_123456789 AuthenticationErrorResponse: type: object properties: error: type: object properties: code: type: string example: AUTHENTICATION_ERROR message: type: string example: Authentication required to access this resource status: type: integer example: 401 details: type: object properties: reason: type: string example: Invalid API key path: type: string example: /companies/me timestamp: type: string format: date-time example: '2023-12-01T10:00:00.000Z' requestId: type: string example: req_123456789 AuthorizationErrorResponse: type: object properties: error: type: object properties: code: type: string example: AUTHORIZATION_ERROR message: type: string example: You need 'admin' permissions to access this resource status: type: integer example: 403 path: type: string example: /companies timestamp: type: string format: date-time example: '2023-12-01T10:00:00.000Z' requestId: type: string example: req_123456789 NotFoundErrorResponse: type: object properties: error: type: object properties: code: type: string example: RESOURCE_NOT_FOUND message: type: string example: Company with ID '123' not found status: type: integer example: 404 path: type: string example: /companies/me timestamp: type: string format: date-time example: '2023-12-01T10:00:00.000Z' requestId: type: string example: req_123456789 InternalServerErrorResponse: type: object properties: error: type: object properties: code: type: string example: INTERNAL_SERVER_ERROR message: type: string example: An unexpected error occurred status: type: integer example: 500 path: type: string example: /companies timestamp: type: string format: date-time example: '2023-12-01T10:00:00.000Z' requestId: type: string example: req_123456789 OnboardingRequirementSatisfiedBy: type: object description: The evidence a `SATISFIED` requirement reads from properties: onboarding_document_ids: type: array description: >- The documents that meet it; both of an identity pair, or, for an `EVIDENCE_PACKAGE`, the attachments its answer recorded that the provider has not refused items: type: string format: uuid example: - 9c1e7b3a-2d4f-4a6b-8c0d-5e7f9a1b3c2d biometric_verification_id: type: - string - 'null' format: uuid description: >- The approved verification that meets a `BIOMETRIC_VERIFICATION` requirement example: null answer: type: - string - 'null' description: >- The text of the answer that meets an `INFORMATION` or `EVIDENCE_PACKAGE` requirement example: null required: - onboarding_document_ids - biometric_verification_id - answer securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: Company API key for authentication ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.