Submits a candidate's completed background check form. Takes no API key — the caller is whichever page the candidate filled in, identified only by the request_key issued when the request was created.

Which page that is depends on the callback_url you set when creating the request. Leave it pointing at the Prembly-hosted form and the candidate is sent there, and you need not call this endpoint at all. Point it at a page of your own and you are hosting the form: you collect the candidate's details and post them here yourself.

If you host the form

You take on the obligations that come with collecting this data. The form gathers personal information — identity, address, employment and education history, and named references — so you are responsible for obtaining the candidate's consent and for telling them what the data will be used for, before you submit it. This endpoint performs no consent check and will accept whatever it is given. Consent to the background check itself is captured later in the provider's own flow and reported back as a consent_signed webhook event; that is a separate step and does not cover your collection of the data here.

Your page must also be served from the host you registered as callback_url. A redirect_url on an unrecognised host is ignored, because these endpoints are unauthenticated and honouring one would be an open redirect.

Submitting

Accepts JSON or multipart/form-data. Inline file blobs inside request_data are converted to storage URLs before the verification engine is called; multipart file fields on the same request are stored and replaced with URLs. Submitting twice for the same request_key is rejected.