Information Requests

Coinflow’s underwriting team may need more information from a sub-merchant, either while its application is in review or after it’s live. They send a request for information (RFI): a set of questions and document uploads. Coinflow doesn’t email embedded sub-merchants about RFIs, so your platform must tell them and open the RFI for them.

1. Find RFIs

Use either or both:

• Webhook: Sub-merchant RFI Sent fires when an RFI is sent or reissued. Its data.rfiId is the id you open. See Onboarding Webhooks.
• API: List RFIs returns a sub-merchant’s RFIs, newest first. Use it to recover from a missed webhook or to show a count in your product.

curl --request GET \
  --url 'https://api-sandbox.coinflow.cash/api/rfi?actionRequired=true' \
  --header "Authorization: $COINFLOW_API_KEY" \
  --header 'x-coinflow-submerchant-id: acme-store'

{
  "data": [
    {
      "id": "6720f1c2a4b5c6d7e8f90123",
      "submerchantId": "acme-store",
      "status": "open",
      "actionRequired": true,
      "round": 0,
      "sentAt": "2026-10-28T15:04:05.000Z",
      "submittedAt": null,
      "updatedAt": "2026-10-28T15:04:05.000Z"
    }
  ],
  "total": 1,
  "page": 1,
  "limit": 20
}

• actionRequired=true returns only RFIs waiting on the sub-merchant (open or reopened). To show a count, call with actionRequired=true&limit=1 and read total.
• Filter by status with status, for example ?status=open&status=reopened.
• Pages hold 20 RFIs by default and at most 100 (limit); page starts at 1.
• Get Onboarding also returns openRfiCount.

While an application is in review, an open RFI also changes the sub-merchant’s onboarding status to action_required. A live sub-merchant stays approved.

2. Open the RFI

Mint an embed session for the sub-merchant exactly as for onboarding (see step 2 of the integration guide), then load the RFI page with the token in the URL fragment:

<iframe
  id="coinflow-rfi"
  src="https://sandbox-merchant.coinflow.cash/embed/rfi/6720f1c2a4b5c6d7e8f90123#token=EMBED_SESSION_TOKEN"
  title="Coinflow information request"
  allow="camera; microphone; clipboard-write"
  style="width: 100%; border: 0;"
></iframe>

• The same session works for onboarding and RFIs. It can only read, answer, upload files to and submit the RFIs of the sub-merchant it was minted for.
• One RFI per iframe. There’s no RFI list inside the iframe; build the list in your product from List RFIs.
• Submitted, completed and cancelled RFIs open read-only with their status. A reopened RFI highlights the questions underwriting wants answered again.
• An id that isn’t one of the sub-merchant’s RFIs, or one that was never sent, shows “Request not found” and posts rfi.error with code not_found.

You can also open an RFI as a full page instead of an iframe. See Opening onboarding as a link.

3. React to submission

When the sub-merchant submits its answers:

• the iframe posts rfi.submitted (see Embed Events), so you can refresh your RFI list
• Coinflow sends the Sub-merchant RFI Submitted webhook to your server

If underwriting needs more, the RFI is reopened and Sub-merchant RFI Sent fires again with the same rfiId.