Create a subject's first ComplianceEntity

post

https://api.wingspan.app/v3/platform/compliance-entities

Creates the first ComplianceEntity for a subject. If a current record already exists, returns 409 ResourceConflict; use the explicit /advance action to create a successor. A subject-less Individual is Person-owned and callers must omit X-Wingspan-Account. Business and subject-bearing records are Account-owned. A headerless Person session may create one under its authorized principal Account, and the response identifies that Account in ownerId/accountId. Item requests resolve the returned globally unique ComplianceEntity id only across the request's already-authorized Person and principal Account lanes. List requests never merge lanes: use filter[ownerType][eq]=OwnerAccount for the principal Account chain or OwnerPerson for the Person chain. X-Wingspan-Account remains required to select any other accessible Account. An unauthorized owner lane returns 403. Idempotent via Idempotency-Key.

Requires a session with recent MFA step-up for HighRiskWriteAction. If step-up is missing or expired, this operation returns 403 StepUpMfaRequired; create and verify an MFA challenge at /v3/platform/mfa-challenges with requiredFor: "HighRiskWriteAction", then retry.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Request body for creating the subject's first ComplianceEntity. The API sets the owner from the authenticated scope. If a current record already exists, returns 409 ResourceConflict; use advanceComplianceEntity to mint a successor. subject is immutable once the chain is created.

subject

object

The party this ComplianceEntity is about. Optional — when omitted it defaults to the authenticated current account. Use a Stakeholder subject for Account-owned Individual records attached to a Principal or Person Stakeholder. Immutable once set.

type

string

enum

required

Allowed:

jurisdictionCountry

string

required

ISO 3166-1 alpha-2 country code for the subject's primary compliance jurisdiction.

form

string

enum

Universal canonical legal form; local fidelity preserved via jurisdictionalFormCode.

taxClassification

string

enum

Allowed:

trustSubtype

string

enum

Allowed:

jurisdictionalFormCode

string

jurisdictionalFormName

string

otherFormDescription

string

legalName

string

legalNameTransliteration

string

doingBusinessAs

string

doingBusinessAsTransliteration

string

legalAddress

object

Not yet supported; requests with this field return 422. Use physicalAddress.

formationJurisdiction

object

mccCode

string

natureOfBusiness

string

websiteUrl

uri

individualLegalName

object

Globalization-aware natural-person name. Application invariant: either fullLegalName, or both familyName and givenName, must be populated.

dateOfBirth

date

usTaxProfile

object

U.S. tax identity for a non-US individual. The name is distinct from the ComplianceEntity's local legal name. Only givenName, middleNames, and familyName are stored; fullLegalName, suffix, prefix, and transliteration are rejected on write.

address

object

Not yet supported; requests with this field return 422. Use physicalAddress.

governmentIds

array of objects

governmentIds

preferredName

string

phoneNumber

string

Primary contact number (both types).

string

Primary email address (Individual only).

occupation

string

Free-text job title or occupation (Individual only).

physicalAddress

object

Postal address. Subdivision codes per locale; country ISO 3166-1 alpha-2.

mailingAddress

object

Optional correspondence address (PO box / registered agent / mail-forwarding).

taxIdentifiers

array of objects

taxIdentifiers

fatcaChapter4Status

string

stakeholders

array of objects

Beneficial owners / stakeholders. Not yet supported on this API path; requests with a non-empty array return 422. Use Stakeholder records for ownership.

stakeholders

metadata

object

Not yet supported on this API path; requests with non-empty metadata return 422.

Headers

Idempotency-Key

string

length between 1 and 255

^[\x21-\x7e]{1,255}$

Optional idempotency token for authenticated POST and PATCH requests. Reusing the same key and body returns the cached response for 24 hours, except credential operations that explicitly document a 409 because one-time secret material is never cached; reusing it with a different body returns 409 IdempotencyKeyConflict. Use 1-255 printable ASCII characters.

X-Wingspan-Account

string

^(?:[A-Za-z0-9_.]{22}|[a-f0-9]{24})$

Select the Account for an Account-scoped operation. A direct ServiceAccount API key MUST supply this header, and the target must be within the ServiceAccount owner's or Authorization grant's Account boundary. A Person bearer may select an Account on which it has an active Stakeholder, and an Account session may select its bound Account (or a descendant only when the session explicitly includes descendants).

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201First ComplianceEntity created

400Malformed request syntax

401Unauthenticated

403Forbidden or step-up MFA required

404Resource not found

409Conflict

422Validation error

503A downstream dependency is temporarily unavailable; retryable. Body carries code: ServiceUnavailable and may include extensions.retryAfter.