curl -X PATCH 'https://verification.didit.me/v3/businesses/company-123/update-status/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"status": "BLOCKED"}'import requests
resp = requests.patch(
'https://verification.didit.me/v3/businesses/company-123/update-status/',
headers={'x-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json'},
json={'status': 'BLOCKED'},
)
resp.raise_for_status()
print(resp.json()['status'])const resp = await fetch('https://verification.didit.me/v3/businesses/company-123/update-status/', {
method: 'PATCH',
headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ status: 'BLOCKED' }),
});
const biz = await resp.json();
console.log(biz.status);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/businesses/{vendor_data}/update-status/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'status' => 'FLAGGED'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/businesses/{vendor_data}/update-status/"
payload := strings.NewReader("{\n \"status\": \"FLAGGED\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://verification.didit.me/v3/businesses/{vendor_data}/update-status/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"status\": \"FLAGGED\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/businesses/{vendor_data}/update-status/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"status\": \"FLAGGED\"\n}"
response = http.request(request)
puts response.read_body{
"didit_internal_id": "a1b2c3d4-e5f6-4890-abcd-ef1234567890",
"vendor_data": "company-123",
"display_name": null,
"legal_name": "Acme Trading Ltd",
"registration_number": "12345678",
"country_code": "GB",
"effective_name": "Acme Trading Ltd",
"status": "BLOCKED",
"session_count": 2,
"approved_count": 1,
"declined_count": 0,
"in_review_count": 1,
"features": {
"KYB": "Approved"
},
"features_list": [
{
"feature": "KYB",
"status": "Approved"
}
],
"last_session_at": "2026-03-15T10:30:00Z",
"last_activity_at": "2026-03-15T10:30:00Z",
"first_session_at": "2026-01-10T08:00:00Z",
"tags": [
{
"uuid": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
"name": "VIP",
"color": "#2567FF"
}
],
"created_at": "2026-01-10T08:00:00Z",
"metadata": {
"industry": "fintech"
},
"updated_at": "2026-03-15T10:30:00Z"
}Update Business Status
Flip only the lifecycle status of a business — VendorBusinessStatusChoices (ACTIVE/FLAGGED/BLOCKED, NOT session statuses). BLOCKED adds vendor_data to the system blocklist.
curl -X PATCH 'https://verification.didit.me/v3/businesses/company-123/update-status/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{"status": "BLOCKED"}'import requests
resp = requests.patch(
'https://verification.didit.me/v3/businesses/company-123/update-status/',
headers={'x-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json'},
json={'status': 'BLOCKED'},
)
resp.raise_for_status()
print(resp.json()['status'])const resp = await fetch('https://verification.didit.me/v3/businesses/company-123/update-status/', {
method: 'PATCH',
headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ status: 'BLOCKED' }),
});
const biz = await resp.json();
console.log(biz.status);<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/businesses/{vendor_data}/update-status/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'status' => 'FLAGGED'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/businesses/{vendor_data}/update-status/"
payload := strings.NewReader("{\n \"status\": \"FLAGGED\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://verification.didit.me/v3/businesses/{vendor_data}/update-status/")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"status\": \"FLAGGED\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/businesses/{vendor_data}/update-status/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"status\": \"FLAGGED\"\n}"
response = http.request(request)
puts response.read_body{
"didit_internal_id": "a1b2c3d4-e5f6-4890-abcd-ef1234567890",
"vendor_data": "company-123",
"display_name": null,
"legal_name": "Acme Trading Ltd",
"registration_number": "12345678",
"country_code": "GB",
"effective_name": "Acme Trading Ltd",
"status": "BLOCKED",
"session_count": 2,
"approved_count": 1,
"declined_count": 0,
"in_review_count": 1,
"features": {
"KYB": "Approved"
},
"features_list": [
{
"feature": "KYB",
"status": "Approved"
}
],
"last_session_at": "2026-03-15T10:30:00Z",
"last_activity_at": "2026-03-15T10:30:00Z",
"first_session_at": "2026-01-10T08:00:00Z",
"tags": [
{
"uuid": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
"name": "VIP",
"color": "#2567FF"
}
],
"created_at": "2026-01-10T08:00:00Z",
"metadata": {
"industry": "fintech"
},
"updated_at": "2026-03-15T10:30:00Z"
}Overview
Moves a Business entity betweenACTIVE, FLAGGED, and BLOCKED. See entity lifecycle for the full state machine.
When to use it
- Block a sanctioned or confirmed-fraudulent business.
- Flag a business pending manual review.
- Unblock after remediation.
- Propagate external signals from your own compliance systems.
Notes
- Valid values:
ACTIVE,FLAGGED,BLOCKED. - Passing a
reasonstring is recommended — it is persisted and surfaced in the audit log and webhook payload. BLOCKEDbusinesses have all new Business Verification (KYB) sessions auto-declined and all new transactions auto-declined, including when they appear as counterparty.- Emits
business.status.updatedwithprevious_status,status, andreason.
Enforcement
| Status | New Business Verification (KYB) sessions | Transactions involving this business |
|---|---|---|
ACTIVE | Normal flow | Normal flow |
FLAGGED | Routed to IN_REVIEW | May auto-escalate via rules |
BLOCKED | Auto-declined | Auto-declined |
Permissions
Role must grantupdate-status:businesses.
Related
Authorizations
Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.
Path Parameters
Your unique identifier for the business (free-form string, NOT a UUID).
Body
New lifecycle status. BLOCKED also adds the vendor_data to the system blocklist.
ACTIVE, FLAGGED, BLOCKED Response
Business status updated. Full business record returned.
Full business detail. Extends BusinessListItem with metadata and updated_at.
Didit's stable internal UUID for this business.
Your unique identifier for this business (passed when creating sessions). This can be null when no vendor identifier was supplied.
Custom display name set by you
Official legal name from registry or manual entry
Company registration or incorporation number
Country of incorporation (ISO 3166-1 alpha-2, e.g. GB, US).
Best available name: display_name if set, otherwise legal_name
Lifecycle status of the business record (NOT a session status). ACTIVE is the default, FLAGGED marks it for manual attention, BLOCKED prevents new sessions for this vendor_data.
ACTIVE, FLAGGED, BLOCKED Total number of verification sessions for this business
Number of approved sessions
Number of declined sessions
Number of sessions in review
Aggregated per-feature status across all of this business's KYB sessions. Currently the only key is KYB (the registry company check status). Possible values: Approved, Declined, In Review, Not Finished, Resub Requested.
Same data as features, as an ordered array of {feature, status} objects.
Show child attributes
Show child attributes
Timestamp of the most recent session
Timestamp of the first session
Timestamp of the most recent activity (status change, session update, etc.)
Tags assigned to this business
Show child attributes
Show child attributes
Custom metadata JSON you attached to this business. Defaults to {}.