Skip to main content
Every customer has to accept Lumx’s Terms of Service before they can complete identity verification and move money. Acceptance is collected programmatically through the API. Until the customer accepts, the TERMS_OF_SERVICE entry stays in their requirements array and verification can’t proceed. Send a POST request to /customers/{id}/tos to generate an acceptance URL for a specific customer. Optionally include a redirectUrl to send the customer back to your app after they accept.
Request
Response
The returned url expires after 24 hours. If it expires before the customer accepts, generate a new one. redirectUrl takes an http or https address. Custom schemes such as myapp:// don’t pass validation, and neither does localhost — point it at 127.0.0.1 when you’re testing locally.

Opening the acceptance page

The acceptance flow lives on a Lumx-hosted page. Open the returned url somewhere the address bar is visible, so the customer can see they’re accepting on Lumx’s domain: either a full redirect or a separate window, depending on whether you can afford to leave the current screen. Sending the link over email or SMS works too.
The page can’t be embedded in an iframe. The response sets X-Frame-Options: SAMEORIGIN, so the browser refuses to render it on your domain and the customer gets an empty frame.

Full redirect

Send the customer straight to the URL. They accept and come back to your redirectUrl as a normal top-level navigation. Simplest option, but it unloads the current screen along with any unsaved form state.
Web

Separate window

Open the URL in its own window and your screen stays loaded underneath, form state intact. Browsers only allow this from inside a user gesture, so open a blank window in the click handler and set its location once your backend returns the URL.
Web
Point redirectUrl at a route on your own origin. It loads inside the same window, so it can message the opener and close. Run it before the page paints and the customer sees no extra screen: they accept, the window closes, your screen carries on.
Web

In-app browser

On mobile, open the URL in the platform’s in-app browser. These are browser contexts too, not frames, so the page renders normally. Present it as a sheet rather than full screen and it reads as part of your app.
iOS
Android
There’s no opener to message here, and redirectUrl won’t take a custom scheme, so point it at a universal link on iOS or an app link on Android. The operating system hands the customer back to your app and dismisses the browser. Skip that setup and you can detect the dismissal instead, then read the customer.

Tracking acceptance status

Terms of Service appears as a TERMS_OF_SERVICE entry inside the customer’s requirements array, alongside other onboarding requirements. It moves to APPROVED once the customer accepts. Read the customer to confirm acceptance rather than trusting the redirect, since the customer can close the window before it completes. No webhook event is specific to Terms of Service, so subscribe to customer webhooks to follow the rest of verification.
Request
Response (excerpt)

Legal Documents

Full list of Lumx’s legal documents and policies.

Identity Verification

Data requirements for KYC/KYB after acceptance.

Individual verification

End-to-end onboarding flow for individual customers.

Business verification

End-to-end onboarding flow for business customers.