Respond to a recipient RFI case

Use this endpoint after the case shows that we need a response from you. Send one TEXT or FILE response per request. Responses are sent to the case; we match each one to the requirement it satisfies, so do not send requirement_id in the path or body.

This is the shared RFI endpoint. The full request and response schemas and the Try It console are on Respond to an RFI case.

POST /v1/customers/{customer_id}/rfi-cases/{case_id}/submissions

Headers

Header	Required	Description
`Idempotency-Key`	Yes	A new UUID for each response. Reuse it only when retrying the exact same request.
`Content-Type`	Yes	`application/json` for a TEXT response, `multipart/form-data` for a FILE response. Any other value is rejected.
`X-OM-Content-SHA256`	FILE only	Set to `UNSIGNED-PAYLOAD` when your HTTP client builds the multipart body internally and you sign the `Idempotency-Key` instead of the body. Omit it when you sign the complete multipart body, and never send it for JSON. See Signing multipart requests.

Send a TEXT response

POST /v1/customers/{customer_id}/rfi-cases/{case_id}/submissions
Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
Content-Type: application/json

{
  "type": "TEXT",
  "text": "Acme Software Inc is our payroll software vendor under a two-year contract."
}

text is required, nonblank, and at most 2,560 UTF-8 bytes. Do not send note, document_type, or file.

Send a FILE response

Use multipart/form-data and send the original file bytes. Do not Base64-encode the file. Send each part once; field names and enum values are case-sensitive.

Part	What to send
`type`	The literal `FILE`
`document_type`	One value from the requirement's `accepted_document_types`
`note`	A nonblank explanation, up to 1,000 characters
`file`	A nonempty file with a filename. Allowed extensions are pdf, jpeg, jpg, png, csv, xls, and xlsx; maximum size is 10 MB

curl -X POST "https://api.sandbox.1money.com/v1/customers/{customer_id}/rfi-cases/TC-3N7Q-D2KV/submissions" \
  -H "Authorization: Bearer <sandbox_token>" \
  -H "Idempotency-Key: 8c1f3b2e-4d5a-4c6b-9e7f-0a1b2c3d4e5f" \
  -F "type=FILE" \
  -F "document_type=STANDARD_RECIPIENT_INFORMATION" \
  -F "note=Services agreement and the invoices for the planned payments." \
  -F "[email protected]"

A document_type from the recipient list that no current requirement accepts is stored as voluntary evidence and does not complete a requirement. A document_type that recipient cases do not offer is rejected with 400.

Response

201 when the response is accepted; 200 with the original response when the same Idempotency-Key and request are replayed.

{
  "submission_id": "RS-7Q2M-K4XD",
  "case_id": "TC-3N7Q-D2KV",
  "requirement_id": "RQ-5K2P-M8WD",
  "type": "TEXT",
  "document_type": null,
  "text": "Acme Software Inc is our payroll software vendor under a two-year contract.",
  "note": null,
  "file_name": null,
  "submitted_at": "2026-09-23T08:41:05.912+00:00"
}

Status	Meaning
`400`	Invalid body, unsupported `Content-Type`, or a file that breaks the size or extension rules.
`404`	The case does not exist or does not belong to this customer.
`409`	The `Idempotency-Key` was already used with a different request.

After you respond

Retrieve the case again. One response may complete one requirement while others still need your attention. When everything requested in the current round has been received, the case moves to ANSWERED and we send rfi.recipient.answered; the recipient's action_required returns to null. If compliance needs more, the case returns to ACTION_REQUIRED and you receive another rfi.recipient.action_required.

Responding to the case does not approve the recipient. Its outcome still arrives as recipient.approved or recipient.rejected.