# Update Merchant Application > Complete the merchant application with encrypted form submission containing detailed company and representative information. **Content-Type**: `application/json` **Authentication**: `X-API-Key` header required **Request Body**: JSON structure containing RSA-encrypted complete onboarding form **Note**: TThis endpoint completes the onboarding process with all required business and representative information. **Encrypted Payload Structure (before encryption)** **company_information**: (object, required)
See details below | Field Name | Type | Required | Description | |------------|--------|----------|-------------| | main_url | string | Yes | Company website URL (valid URL, max 255 chars) | | legal_name | string | Yes | Legal company name (max 512 chars) | | trading_name | string | Yes | Trading/DBA name (max 512 chars) | | business_type | string | Yes | Business type:
`Individual or Sole Proprietorship`,
`Private Corporation`,
`Limited Liability Corporation`,
`Publicly Traded Corporation`,
`Limited Partnership`,
`Non-Profit Entity`,
`Government Agency`,
`Regulated Financial Institution`,
`SEC Registered Entity`,
`CFTC Registered Entity` | | business_registration_number | string | No | Business registration number (max 255 chars) | | date_of_incorporation | string | No | Date of incorporation (max 255 chars) | | industry | string | Yes | Industry category. Must be one of: `Fashion & Apparel`, `Apparel & Accessories`, `Automotive`, `Beauty & Skincare`, `Electronics`, `Flowers, Gifts, & Specialty Stores`, `Food & Beverage`, `Furniture, Appliances, & Equipment`, `General Retail`, `Health & Wellness`, `Hobbies, Arts, & Crafts`, `Home & Garden`, `Industrial Retail`, `Jewelry & Watches`, `Pet Supplies`, `Sporting Goods & Fitness`, `Toys & Games`, `Gaming`, `Wineries & Breweries`, `Nutraceutical`, `Other` | | documents | object | Yes | Company documents object | | documents.tax_verification | object | Yes | Tax verification document | | documents.tax_verification.type | string | Yes | Document type: `EIN Letter` | | documents.tax_verification.front | string | Yes | File ID from attachment upload | | documents.bank_verification | object | Yes | Bank verification document | | documents.bank_verification.type | string | Yes | Document type: `Bank Statement` | | documents.bank_verification.front | string | Yes | File ID from attachment upload | | documents.address_verification | object | No | Address verification document | | bank_information | object | Yes | Bank account information | | bank_information.account_number | string | Yes | Bank account number (5-17 chars) | | bank_information.routing_number | string | Yes | Bank routing number (9 chars) | **company_representatives**: (object, required)
See details below | Field Name | Type | Required | Description | |------------|--------|----------|-------------| | primary_business_owner | array | Yes | Array of primary business owners | | primary_business_owner[].employee_id | string | No | Employee ID (max 128 chars) | | primary_business_owner[].first_name | string | Yes | First name (max 255 chars) | | primary_business_owner[].middle_name | string | No | Middle name (max 255 chars) | | primary_business_owner[].last_name | string | Yes | Last name (max 255 chars) | | primary_business_owner[].job_title | string | Yes | Job title: `Chief Executive Officer`, `Chief Financial Officer`, `Chief Operating Officer`, etc. | | primary_business_owner[].ownership_percentage | integer | No | Ownership percentage | | primary_business_owner[].date_of_birth | string | Yes | Date of birth (max 255 chars) | | primary_business_owner[].country_of_birth | string | Yes | Country of birth (max 255 chars) | | primary_business_owner[].national_id_number | string | Yes | National ID number (4-50 chars) | | primary_business_owner[].email_address | string | Yes | Email address (valid email) | | primary_business_owner[].phone | string | Yes | Phone number (9-15 chars) | | primary_business_owner[].address | object | Yes | Address object (same structure as company addresses) | | primary_business_owner[].documents | object | Yes | Representative documents | | primary_business_owner[].documents.identity_verification | object | Yes | Identity verification document | | primary_business_owner[].documents.identity_verification.type | string | Yes | Document type: `Passport`, `National Identity Card`, `Driving License`, `Citizen Card`, `Residence Permit`, `Electoral ID` | | primary_business_owner[].documents.identity_verification.front | string | Yes | File ID from attachment upload | | primary_business_owner[].documents.identity_verification.back | string | No | File ID from attachment upload (if applicable) | | authorized_signatory | object | No | Authorized signatory (same structure as primary_business_owner) | | control_person | object | No | Control person (same structure as primary_business_owner) | **platform_info**: (object, required)
See details below | Field Name | Type | Required | Description | |------------|--------|----------|-------------| | sub_merchant_id | string | Yes | Sub-merchant identifier (max 255 chars) | **acknowledgement**: (boolean, required) | Field Name | Type | Required | Description | |------------|--------|----------|-------------| | acknowledgement | boolean | Yes | Terms and conditions acknowledgement | Source: https://help.boltapp.com/api-reference/merchant-onboarding/merchant-applications/update-merchant-application `PUT /v1/merchant_applications/{merchant_application_id}` ## OpenAPI definition This endpoint as it appears in the OpenAPI document, with every schema it references included. ```json { "openapi": "3.2.0", "info": { "title": "Bolt Connect Merchant Onboarding API", "version": "1.0.0", "description": "## Overview\nThis collection provides comprehensive access to Bolt's Platform Connected Merchant Onboarding APIs, designed to enable platform platforms to onboard their sub-merchants seamlessly. The APIs support two primary workflows:\n1. **Direct Onboarding**: Platforms can directly onboard sub-merchants using the merchant application APIs\n2. **Self-Onboarding**: Platforms can generate sharable links for sub-merchants to complete their own onboarding\n\n## API Workflow\nThe typical onboarding workflow follows these steps:\n1. **Get Public Key** (`GET /v1/merchant-application/public-key`):
\nRetrieve RSA public key for encrypting \nsensitive data\n2. **Create Application** (`POST /v1/merchant_applications`):
\nCreate a new merchant application with encrypted company information\n3. **Upload Attachments** (`POST /v1/merchant_applications/{id}/attachments`): Upload required documents (tax verification, bank statements, etc.)\n4. **Update Application** (`PUT /v1/merchant_applications/{id}`):
\nComplete the application with encrypted form submission\n5. **Generate Link** (Optional) (`POST /v1/merchant_applications/onboarding-link`):\nGenerate self-onboarding link for sub-merchants\n\n## Encryption\n Sensitive data in requests must be encrypted using RSA-4096 encryption with the public key obtained from the public key endpoint.\n\n ### Node.js encryption example\n ```javascript\n const crypto = require('crypto');\n const axios = require('axios');\n // Function to fetch public key and encrypt JSON payload\nasync function encryptPayload(baseUrl, apiKey, jsonPayload) {\n try {\n // Step 1: Fetch the public key\n const publicKeyResponse = await axios.get(`${baseUrl}/v1/merchant-application/public-key`);\n const publicKeyBase64 = publicKeyResponse.data.public_key;\n // Step 2: Decode the base64-encoded PEM public key\n const publicKeyPEM = Buffer.from(publicKeyBase64, 'base64').toString('utf8');\n // Step 3: Convert JSON payload to string\n const payloadString = JSON.stringify(jsonPayload);\n // Step 4: Encrypt the payload using RSA-OAEP with SHA-256\n const encryptedBuffer = crypto.publicEncrypt({\n key: publicKeyPEM,\n padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,\n oaepHash: 'sha256'\n }, Buffer.from(payloadString, 'utf8'));\n // Step 5: Encode the encrypted data as base64\n const encryptedPayloadBase64 = encryptedBuffer.toString('base64');\n return {\n encrypted_payload: encryptedPayloadBase64\n };\n } catch (error) {\n console.error('Encryption failed:', error);\n throw error;\n }\n}\n// Example usage:\nconst payload = {\n company_information: {\n email_address: \"company@example.com\",\n phone_number: \"+1234567890\",\n registered_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n billing_address: {\n address_line1: \"123 Main St\",\n city: \"San Francisco\",\n state: \"CA\",\n zip: \"94105\",\n country: \"US\"\n },\n annual_processing_volume: 1000000,\n average_transaction_value: 5000,\n highest_transaction_value: 10000\n }\n};\n// Encrypt and send request\nencryptPayload('https://api.boltapp.com', 'your-api-key', payload)\n .then(encryptedData => {\n // Use encryptedData in your API request\n return axios.post(`${baseUrl}/v1/merchant_applications`, encryptedData, {\n headers: {\n 'Content-Type': 'application/json',\n 'X-API-Key': 'your-api-key'\n }\n });\n})\n.then(response => {\n console.log('Merchant application created:', response.data);\n})\n.catch(error => {\n console.error('Request failed:', error);\n});\n ```\n" }, "servers": [ { "url": "https://api.boltapp.com" } ], "paths": { "/v1/merchant_applications/{merchant_application_id}": { "put": { "parameters": [ { "name": "merchant_application_id", "in": "path", "required": true, "description": "Identifier returned when the merchant application was created.", "schema": { "type": "string" }, "examples": { "default": { "value": "scoped_merchant_app_id_12345" } } } ], "operationId": "update_merchant_application", "summary": "Update Merchant Application", "description": "Complete the merchant application with encrypted form submission\ncontaining detailed company and representative information.\n\n\n**Content-Type**: `application/json`\n\n**Authentication**: `X-API-Key` header required\n\n\n**Request Body**: JSON structure containing RSA-encrypted complete onboarding\nform\n\n\n**Note**: TThis endpoint completes the onboarding process with all required business and representative information.\n\n**Encrypted Payload Structure (before encryption)**\n\n**company_information**: (object, required)
\nSee details below\n\n| Field Name | Type | Required | Description |\n|------------|--------|----------|-------------|\n| main_url | string | Yes | Company website URL (valid URL, max 255 chars) |\n| legal_name | string | Yes | Legal company name (max 512 chars) |\n| trading_name | string | Yes | Trading/DBA name (max 512 chars) |\n| business_type | string | Yes | Business type:
`Individual or Sole Proprietorship`,
`Private Corporation`,
`Limited Liability Corporation`,
`Publicly Traded Corporation`,
`Limited Partnership`,
`Non-Profit Entity`,
`Government Agency`,
`Regulated Financial Institution`,
`SEC Registered Entity`,
`CFTC Registered Entity` |\n| business_registration_number | string | No | Business registration number (max 255 chars) |\n| date_of_incorporation | string | No | Date of incorporation (max 255 chars) |\n| industry | string | Yes | Industry category. Must be one of: `Fashion & Apparel`, `Apparel & Accessories`, `Automotive`, `Beauty & Skincare`, `Electronics`, `Flowers, Gifts, & Specialty Stores`, `Food & Beverage`, `Furniture, Appliances, & Equipment`, `General Retail`, `Health & Wellness`, `Hobbies, Arts, & Crafts`, `Home & Garden`, `Industrial Retail`, `Jewelry & Watches`, `Pet Supplies`, `Sporting Goods & Fitness`, `Toys & Games`, `Gaming`, `Wineries & Breweries`, `Nutraceutical`, `Other` |\n| documents | object | Yes | Company documents object |\n| documents.tax_verification | object | Yes | Tax verification document |\n| documents.tax_verification.type | string | Yes | Document type: `EIN Letter` |\n| documents.tax_verification.front | string | Yes | File ID from attachment upload |\n| documents.bank_verification | object | Yes | Bank verification document |\n| documents.bank_verification.type | string | Yes | Document type: `Bank Statement` |\n| documents.bank_verification.front | string | Yes | File ID from attachment upload |\n| documents.address_verification | object | No | Address verification document |\n| bank_information | object | Yes | Bank account information |\n| bank_information.account_number | string | Yes | Bank account number (5-17 chars) |\n| bank_information.routing_number | string | Yes | Bank routing number (9 chars) |\n\n**company_representatives**: (object, required)
\nSee details below\n\n| Field Name | Type | Required | Description |\n|------------|--------|----------|-------------|\n| primary_business_owner | array | Yes | Array of primary business owners |\n| primary_business_owner[].employee_id | string | No | Employee ID (max 128 chars) |\n| primary_business_owner[].first_name | string | Yes | First name (max 255 chars) |\n| primary_business_owner[].middle_name | string | No | Middle name (max 255 chars) |\n| primary_business_owner[].last_name | string | Yes | Last name (max 255 chars) |\n| primary_business_owner[].job_title | string | Yes | Job title: `Chief Executive Officer`, `Chief Financial Officer`, `Chief Operating Officer`, etc. |\n| primary_business_owner[].ownership_percentage | integer | No | Ownership percentage |\n| primary_business_owner[].date_of_birth | string | Yes | Date of birth (max 255 chars) |\n| primary_business_owner[].country_of_birth | string | Yes | Country of birth (max 255 chars) |\n| primary_business_owner[].national_id_number | string | Yes | National ID number (4-50 chars) |\n| primary_business_owner[].email_address | string | Yes | Email address (valid email) |\n| primary_business_owner[].phone | string | Yes | Phone number (9-15 chars) |\n| primary_business_owner[].address | object | Yes | Address object (same structure as company addresses) |\n| primary_business_owner[].documents | object | Yes | Representative documents |\n| primary_business_owner[].documents.identity_verification | object | Yes | Identity verification document |\n| primary_business_owner[].documents.identity_verification.type | string | Yes | Document type: `Passport`, `National Identity Card`, `Driving License`, `Citizen Card`, `Residence Permit`, `Electoral ID` |\n| primary_business_owner[].documents.identity_verification.front | string | Yes | File ID from attachment upload |\n| primary_business_owner[].documents.identity_verification.back | string | No | File ID from attachment upload (if applicable) |\n| authorized_signatory | object | No | Authorized signatory (same structure as primary_business_owner) |\n| control_person | object | No | Control person (same structure as primary_business_owner) | \n\n**platform_info**: (object, required)
\nSee details below\n\n| Field Name | Type | Required | Description |\n|------------|--------|----------|-------------|\n| sub_merchant_id | string | Yes | Sub-merchant identifier (max 255 chars) |\n\n**acknowledgement**: (boolean, required)\n\n| Field Name | Type | Required | Description |\n|------------|--------|----------|-------------|\n| acknowledgement | boolean | Yes | Terms and conditions acknowledgement |\n", "responses": { "200": { "description": "Success Response" }, "400": { "description": "Missing Acknowledgement Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Missing Acknowledgement Error": { "value": { "errors": [ { "code": 1000001, "message": "Acknowledgement is required", "field": "acknowledgement" } ] } } } } } }, "401": { "description": "Unauthorized - Invalid or missing API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Unauthorized - Invalid or missing API key": { "value": { "errors": [ { "code": 18, "message": "This action is forbidden", "field": "" } ] } } } } } }, "404": { "description": "Merchant application not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Merchant application not found": { "value": { "errors": [ { "code": 24, "message": "The requested entity was not found", "field": "merchant_application_id" } ] } } } } } }, "422": { "description": "Invalid encryption or payload format", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Invalid encryption or payload format": { "value": { "errors": [ { "code": 10, "message": "Failed to decrypt payload", "field": "" } ] } } } } } }, "429": { "description": "Rate limit exceeded", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Rate limit exceeded": { "value": { "errors": [ { "code": 35, "message": "Rate limit reached. Please retry after a while", "field": "" } ] } } } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Internal Server Error": { "value": { "errors": [ { "code": 46, "message": "Internal error", "field": "" } ] } } } } } } }, "tags": [ "Merchant Applications" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "encrypted_data": { "type": "string", "description": "Base64-encoded encrypted payload" }, "nonce": { "type": "string", "description": "Base64-encoded 32-byte nonce (if applicable)" }, "public_key": { "type": "string", "description": "Base64-encoded public key PEM (if payload includes key reference)" } }, "required": [ "encrypted_data" ] }, "examples": { "default": { "value": { "encrypted_data": "", "nonce": "", "public_key": "" } } } }, "application/octet-stream": {} }, "description": "Complete onboarding with encrypted form. JSON wrapper or raw binary supported per integration notes." }, "security": [ { "ApiKeyAuth": [] } ] } } }, "components": { "schemas": { "ErrorResponse": { "type": "object", "properties": { "errors": { "type": "array", "items": { "type": "object", "properties": { "code": { "type": "integer", "description": "Numeric error code" }, "message": { "type": "string", "description": "Human-readable error message" }, "field": { "type": "string", "description": "Field related to the error, if applicable" } } } } } } }, "securitySchemes": { "ApiKeyAuth": { "type": "apiKey", "in": "header", "name": "X-API-Key", "description": "API key used to authorize requests for non-public endpoints." } } } } ```