End-to-end KYC onboarding

Customer fills onboarding form
     │
     ▼
1. POST /api/customers (Identity)
     │
     ▼
2. POST /api/identity/document/ktp/challenge (Identity)
     │   SDK uses challenge to capture KTP
     ▼
3. POST /api/identity/document/ktp/capture (Identity)
     │
     ├─ verdict = passed         → step 4
     ├─ verdict = requires_review → human review queue → step 4 on approve
     └─ verdict = failed         → decline
     │
     ▼
4. POST /api/identity/face/flash-challenge (Identity)
     │   SDK captures live selfie
     ▼
5. POST /api/identity/auth/step-up (Identity)
     │   atomic liveness + match
     ├─ allow = true → step 6
     └─ allow = false → decline (or retry once)
     │
     ▼
6. POST /api/identity/nik/dukcapil (Identity)    [optional — if you have PKS Dukcapil]
     │
     ▼
7. POST /api/screenings (AML)
     │   lane = onboarding
     ├─ status = confirmed → human review queue (sanctions hit)
     ├─ status = review    → human review queue (review-band match)
     └─ status = no_match  → step 8
     │
     ▼
8. POST /api/evaluate (Anti-Fraud)    [optional — if you have anti-fraud product]
     │   lane = onboarding
     ├─ decision = allow  → onboarding complete, customer ready
     ├─ decision = review → human review queue (synthetic identity suspicions)
     └─ decision = block  → decline
     │
     ▼
Onboarding complete · kycLevel = premium (if Dukcapil) or standard (without)

import { QuantumElixir } from '@quantum-elixir/sdk';
 
const qe = new QuantumElixir({ apiKey: process.env.QE_API_KEY! });
 
async function onboard(input: OnboardingForm): Promise<OnboardingResult> {
  // 1. Create customer
  const { data: customer } = await qe.identity.customers.create({
    fullName:    input.fullName,
    externalRef: input.applicationId,
  });
 
  // 2-3. KTP capture (SDK does this; here we assume the bundle arrived from client)
  const { ktpBundle, faceEnrolment } = await qe.identity.document.ktp.capture({
    customerId:  customer.id,
    bundle:      input.ktpBundle,
    hmacKey:     input.hmacKey,
  });
  if (ktpBundle.verdict === 'failed') {
    return decline(customer.id, 'ktp_failed');
  }
  if (ktpBundle.verdict === 'requires_review') {
    await queueForHumanReview(customer.id, 'ktp_review');
    return pending(customer.id);
  }
 
  // 4-5. Live selfie + match
  const stepUp = await qe.identity.authStepUp({
    customerId:  customer.id,
    riskLevel:   'medium',
    actionLabel: 'Initial onboarding biometric',
    trigger:     'onboarding',
    bundle:      input.faceBundle,
  });
  if (!stepUp.allow) {
    return decline(customer.id, 'biometric_mismatch');
  }
 
  // 6. (Optional) Dukcapil verdict ingest
  if (input.dukcapilVerdict) {
    await qe.identity.dukcapil.ingest({
      customerId: customer.id,
      valid:      input.dukcapilVerdict.valid,
      photo:      input.dukcapilVerdict.photo,
      raw:        input.dukcapilVerdict.raw,
    });
  }
 
  // 7. AML screening
  const screening = await qe.aml.screenings.create({
    lane:          'onboarding',
    customerId:    customer.id,
    subjectType:   'individual',
    fullName:      input.fullName,
    nik:           ktpBundle.ocr.nik,
    nationality:   'ID',
    externalId:    input.applicationId,
  });
  if (screening.status === 'confirmed' || screening.status === 'review') {
    await queueForHumanReview(customer.id, 'aml_review');
    return pending(customer.id);
  }
 
  // 8. Anti-fraud onboarding evaluate
  const fraud = await qe.antiFraud.evaluate({
    customerId:    customer.id,
    lane:          'onboarding',
    externalId:    input.applicationId,
    sessionToken:  input.deviceSessionToken,
    data: {
      fullName:    input.fullName,
      email:       input.email,
      phone:       input.phone,
      ipAddress:   input.clientIp,
    },
  });
  if (fraud.decision === 'block') {
    return decline(customer.id, 'fraud_block');
  }
  if (fraud.decision === 'review') {
    await queueForHumanReview(customer.id, 'fraud_review');
    return pending(customer.id);
  }
 
  return success(customer.id);
}