Corrected KYB submissions

GET /portal/merchants/{merchant}/kyb/submission/revisions returns at most ten entries, newest first, with opaque ID, revision sequence, predecessor ID, saved draft version, submission time and current review state. GET /portal/merchants/{merchant}/kyb/submission/{id} retrieves that exact historical receipt. Both require fresh Owner/Admin membership; historical image and thread routes retain the same authorization.

POST /portal/merchants/{merchant}/kyb/submission/revisions accepts {previous_submission, expected_review_version, draft_version, documents: [{id, version}]} and an Idempotency-Key. The latest MORE_INFO_REQUIRED dossier can be corrected. Only the saved draft is submitted, never unsaved changes in the portal’s form: its required fields must be present (409 KYB_INCOMPLETE otherwise) and every upload must have finished. The new submission starts again at SUBMITTED, to be taken on by a compliance analyst; an eleventh submission answers 409 KYB_REVISION_LIMIT. A latest APPROVED dossier with an existing approval can be refreshed only with a strictly newer saved draft. The displayed review version and the complete active READY document set must match. Merchant locking makes validation, encrypted immutable submission insertion, new SUBMITTED review initialization and prior transition atomic. Corrections mark the prior review SUPERSEDED; a refresh preserves the prior APPROVED review, messages, assessment and approval unchanged. A concurrent reply or decision invalidates the expected review version.

Initial and revision submission keys share the merchant/actor namespace: cross-operation reuse conflicts. Same actor/key/normalized body replays its original receipt after fresh authorization even after later edits, document removal or revisions. Prior initial receipts keep their original shape; prior review command responses remain replayable. New commands against SUPERSEDED dossiers conflict. Ten total submissions per merchant are retained; removed draft attachments still count toward the existing document quota.

Staff use GET /staff/kyb/{id}/revisions to navigate the same merchant history. Existing evidence endpoints resolve the exact requested ID. Since 0.44.0 the queue lists open dossiers only, with stable keyset pagination; a superseded dossier stays readable by its ID and in this history. Each staff read of the history is journalled (kyb.revisions_viewed). History exposes metadata; profiles, images and messages remain in private authorized views. Revision audit contains opaque IDs only. Both BFF and API bound revision requests to 16 KiB, including unknown-length bodies.

This is local synthetic acceptance. Production sanctions/PEP providers, compliance policy, retention/vault controls and live activation remain separate gates.

Updating an approved submission

After a profile change, save a newer version, then use « Soumettre la mise à jour enregistrée ». The new submission must go through a complete review. The earlier approval stays readable in the history and does not approve the changed profile. New settlements require an approval of the latest submission and a verified account for the current profile version. An identical attempt keeps its original submission. No live mode is activated.

An unchanged saved version cannot refresh an approval. Rejected, superseded or currently reviewed dossiers cannot use this path. A new latest review blocks new settlement routing until approved; an account tied to an older profile must be replaced and verified. Already authorized settlement instructions and original approval receipts remain unchanged. The ten-submission sandbox limit still applies.