Email, phone and verification timestamps now required to create users

Availability: Sandbox since November 3, 2026 · Production since November 3, 2026

Breaking change: POST /private/v1/users now requires phoneNumber, email, emailVerifiedAt and phoneVerifiedAt. Previously only emailVerifiedAt was required. Requests that omit any of these fields, or send a malformed value, return 400.

The one-click create endpoint (POST /private/v1/users/one-click) now requires email, because Verified does not return one, so you must supply it. phoneVerifiedAt stays optional there. It defaults to the current time when the phone was confirmed by one-time code. A user whose phone is not a US number, or was not confirmed, gets a 422.

Update your integration to send these fields before this change reaches your environment. Retry-KYC and update-user requests are unchanged, and their fields remain optional.

See User Onboarding.