Decide a Non-Protected Identity Review

Apply additive/name/template/activity drift or reject a pending review. The public tenant route cannot approve protected entity-ID, business-ID, or TIN migrations; protectedMigration: true returns GW_IDENTITY_PROTECTED_MIGRATION_REQUIRED and an administrator must use the audited operator boundary.

Authorization

apiKey

x-api-key<token>

The API key generated for your business in Duplo Dashboard. The credential's ipWhitelisted setting is enforced end to end on the customer-facing custom-domain Gateway routes in this public contract. A trusted edge overwrites the configured client-IP header and Gateway carries that verified address over its authenticated internal hop; caller-supplied X-Forwarded-For values are never trusted. An empty IP allowlist permits any source. When an allowlist is configured, a missing, malformed, or nonmatching verified client address is rejected with HTTP 403.

In: header

Path Parameters

gatewaySubBusinessId*string

Immutable Gateway represented-business identifier returned by onboarding/list. Treat it as an opaque value; it may be an original NRS ID or a retained compatibility alias and can differ from the current versioned NRS mapping after an audited migration.

Length1 <= length <= 255

reviewId*string

Identity-review UUID returned by reverification/history.

Match^[0-9a-fA-F-]{36}$

Formatuuid

Header Parameters

x-idempotency-key*string

Stable key identifying one logical command. Gateway management keys contain 8–128 letters, digits, dots, underscores, colons, or hyphens. For onboarding, the key binds the normalized optional profile; a completed replay may omit NRS credentials and QR material.

Match^[A-Za-z0-9._:-]+$

Length8 <= length <= 128

X-Request-ID?string

Optional caller correlation metadata. Gateway creates a new authoritative request ID, returns it in the response X-Request-ID header and Problem Details requestId, and propagates that generated value to its dependencies.

Match^[A-Za-z0-9][A-Za-z0-9._:-]*$

Length1 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

action*string

Value in"apply" | "reject"

reason*string

Length1 <= length <= 500

protectedMigration?boolean

The public route accepts false/omitted only; true requires the excluded administrator endpoint.

Defaultfalse

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/sub-businesses/nrs-business-demo/identity-reviews/497f6eca-6276-4993-bfeb-53cbbbba6f08/decision" \  -H "x-idempotency-key: command-acme-retail-0001" \  -H "X-Request-ID: erp-run-20260916-0042" \  -H "Content-Type: application/json" \  -d '{    "action": "apply",    "reason": "string"  }'

{
  "gatewaySubBusinessId": "string",
  "reviewId": "341516c7-7748-4edf-830d-9d7fcae997b7",
  "version": 1,
  "status": "unchanged",
  "driftClass": "initial",
  "changedFields": [
    "entityId"
  ],
  "requiresProtectedMigration": true,
  "observedIdentity": {
    "entityId": "string",
    "entityReference": "string",
    "nrsBusinessId": "string",
    "businessName": "string",
    "tin": "string",
    "irnTemplate": "string",
    "active": true
  }
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

{
  "type": "http://example.com",
  "title": "string",
  "status": 400,
  "detail": "string",
  "instance": "http://example.com",
  "code": "GW_REQUEST_INVALID_JSON",
  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",
  "timestamp": "2019-08-24T14:15:22Z",
  "action": {
    "code": "string",
    "description": "string",
    "documentation": "http://example.com"
  },
  "retry": {
    "strategy": "DO_NOT_RETRY",
    "sameIdempotencyKey": true,
    "afterSeconds": 0
  },
  "errors": [
    {
      "location": "header",
      "field": "string",
      "pointer": "string",
      "code": "REQUIRED",
      "detail": "string"
    }
  ],
  "operationId": "string",
  "message": "string",
  "statusCode": 0,
  "path": "string"
}

Decide a Non-Protected Identity Review

Authorization

Path Parameters

Header Parameters

Request Body

Response Body

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

413application/problem+json

415application/problem+json

429application/problem+json

500application/problem+json

502application/problem+json

503application/problem+json

504application/problem+json

508application/problem+json

defaultapplication/problem+json

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`