> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rhinestone.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create or resume a compliance customer and mint a scoped session

> Called by the integrator backend. Creates or resumes the provider-neutral compliance customer for the given opaque external customer id, optionally binds a registered smart account, and returns a short-lived browser session bearer. The project API key must never be forwarded to the browser — hand the returned token to the modal instead.



## OpenAPI

````yaml https://raw.githubusercontent.com/rhinestonewtf/openapi/refs/heads/main/deposit-service.json post /compliance/sessions
openapi: 3.1.0
info:
  title: Deposit Service API
  version: 1.0.0
  description: >-
    Cross-chain deposit processing service with automatic token bridging and gas
    sponsorship
servers:
  - url: https://v1.orchestrator.rhinestone.dev/deposit-processor
security: []
paths:
  /compliance/sessions:
    post:
      tags:
        - Compliance
      summary: Create or resume a compliance customer and mint a scoped session
      description: >-
        Called by the integrator backend. Creates or resumes the
        provider-neutral compliance customer for the given opaque external
        customer id, optionally binds a registered smart account, and returns a
        short-lived browser session bearer. The project API key must never be
        forwarded to the browser — hand the returned token to the modal instead.
      parameters:
        - schema:
            type: string
            description: API key for authentication
            example: your-api-key
          required: true
          description: API key for authentication
          name: x-api-key
          in: header
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ComplianceSessionRequestBody'
      responses:
        '200':
          description: Scoped session token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ComplianceSessionResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Authentication required or invalid credential
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: >-
            API key lacks the required deposits scope, or the smart account is
            not registered to the calling project
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: >-
            The requested smart account is already bound to another customer in
            this project, or the customer is already bound to a different
            account and changing it requires an explicit migration
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Failed to create the compliance session
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Compliance sessions are paused
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ComplianceSessionRequestBody:
      type: object
      properties:
        externalCustomerId:
          type: string
          minLength: 1
          maxLength: 200
          description: >-
            The integrator's stable, opaque end-user identifier. Must reveal no
            identity data (no email/name/wallet). Stored verbatim within the
            authenticated project.
          example: usr_01J7H8Q4K67Y8E
        smartAccount:
          type: string
          pattern: ^0x[a-fA-F0-9]{40}$
          description: Ethereum address (0x followed by 40 hex characters)
          example: '0x742d35Cc6634C0532925a3b844Bc9e7595f5bE91'
      required:
        - externalCustomerId
    ComplianceSessionResponse:
      type: object
      properties:
        externalCustomerId:
          type: string
          description: >-
            The opaque external customer reference, returned only to the
            authenticated integrator backend.
        token:
          type: string
          description: Short-lived scoped session bearer for the browser.
        expiresAt:
          type: string
          description: ISO-8601 absolute expiry of the session token.
          example: '2026-08-13T12:15:00.000Z'
      required:
        - externalCustomerId
        - token
        - expiresAt
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
        details:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
              path:
                type: array
                items:
                  anyOf:
                    - type: string
                    - type: number
              code:
                type: string
            required:
              - message
      required:
        - error

````