MCPInstall

sumsub-manage-applicant-tags

by sumsubBackend & APIs

Add, replace, or remove tags on a Sumsub applicant profile via the public API — POST /resources/applicants/{applicantId}/tags/add (additive), POST .../tags (overwrite the full set), DELETE .../tags (remove), read-back via GET .../one. TRIGGER when the user asks to "tag / untag an applicant", "add / remove / clear applicant tags", "label an applicant profile", or "replace an applicant's tag set". SKIP for transaction tags, tag definitions with scoring weights, or applicant risk assessment (use sumsub-create-kyt-rules), for automated tagging inside verification workflows (use sumsub-create-workflow), and for subscribing to tag-change webhooks (use sumsub-manage-webhooks).

Installs
635
Last 24h
+16
Trending rank
#6659
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/sumsub/agent-skills --skill sumsub-manage-applicant-tags
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads sumsub-manage-applicant-tags automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Sumsub — Manage Applicant Tags

Adds, replaces, and removes tags on an applicant profile, always followed by a read-back. Tags are free-form labels used for filtering and classification in the applicant list; they are also readable as applicant.tags in workflow routing and TM rule expressions.

Endpoints

VerbPathPurpose
POST/resources/applicants/{applicantId}/tags/addAdd tags on top of the existing set. Additive; repeat adds of an existing tag are deduped server-side. Body: bare JSON array of strings.
POST/resources/applicants/{applicantId}/tagsOverwrite — replaces the entire tag set with the body. [] clears all tags. Destructive: requires the confirm step below.
DELETE/resources/applicants/{applicantId}/tagsRemove only the tags listed in the body; the rest stay.
GET/resources/applicants/{applicantId}/oneRead-back. Tags come back in the tags field of the applicant — there is no dedicated tags GET.

All writes return {"ok": 1} on success. Tag names not seen before are auto-created on both the add and the overwrite endpoint (sandbox-verified; the docs' claim that overwrite requires pre-existing tags is outdated).

Tag definitions — renaming a tag, picking its color, or the "include tag in applicant summary report" flag — are Sumsub dashboard UI only (Applicant tags page); there is no public-API surface for them.

Auth — App Token + secret (sandbox only)

This skill talks to the public Sumsub API and signs each request per the authentication reference. The full how-it-works writeup lives in the sumsub-api-auth skill — read it if you hit 401 Invalid signature.

⚠️ Sandbox tokens only. Do not accept or use a production App Token here. If the user offers one, refuse and ask them to generate a sandbox pair at https://cockpit.sumsub.com/checkus/home?sbx=true (Connect Sumsub to your AI agent -> Build & configure -> Generate token). Token + secret are shown once — copy both before closing the dialog. The helper script enforces this — it rejects tokens that don't start with sbx:.

VarExample
SUMSUB_APP_TOKENsbx:... — sandbox App Token from the dashboard.
SUMSUB_SECRET_KEYThe paired secret shown once at token creation.
SUMSUB_BASEOptional. Defaults to https://api.sumsub.com.

If the user has already supplied credentials in conversation, reuse them; otherwise ask once before running. Never echo the secret back.

Procedure

  1. Pick the operation. Default to the additive add — it is safe and deduped. Use overwrite only when the user explicitly wants to replace the whole set (or clear it); use remove to take specific tags off. Do not pre-GET before add or remove — the endpoints are targeted and idempotent, the read-back in step 3 is the verification.

  2. Overwrite only — confirm first. GET the applicant, show the user the current tags that will be lost, and get explicit confirmation before POSTing the replacement set. Same gate applies to clearing all tags (overwrite with []).

  3. Run the write via the orchestrator (it appends the read-back automatically):

    bash scripts/manage_applicant_tags.sh list      <applicantId>
bash scripts/manage_applicant_tags.sh add       <applicantId> "High Risk" "VIP"
bash scripts/manage_applicant_tags.sh overwrite <applicantId> "Compliance Reviewed"   # after the confirm step!
bash scripts/manage_applicant_tags.sh remove    <applicantId> "Legacy KYC"

  4. Compare the read-back to what was requested. An empty set comes back with the tags field absent from GET /one — that is the normal "no tags" state, not an error. On a mismatch, report it — do not retry automatically. Surface 4xx errors verbatim.

  5. Report, names first. Lead with the applicant's name and the resulting tag list, then the dashboard link (https://cockpit.sumsub.com/checkus/applicant/<applicantId> — render as a clickable markdown link), and put the applicant id on its own last line.

Gotchas

  • 30-tag cap per applicant. Exceeding it (existing + new) fails the whole request with HTTP 400 "Too many applicant tags" — atomically, nothing is applied. Report the 30-tag limit and stop there: do not trim the list and retry, and never delete or overwrite existing tags to make room in the same run — freeing up slots is a destructive decision the user must make explicitly, in a fresh request.
  • Tag names are case-sensitive — "High Risk" and "high risk" are two different tags. Match the user's existing casing when removing.
  • Overwrite replaces everything. POST .../tags with any body wipes tags not listed in it. When the user says "add", never use the overwrite endpoint.
  • Empty = absent. After clearing tags, GET /one has no tags field at all. Read-back logic must treat a missing field as an empty set.
  • Unknown applicant → HTTP 404 "Applicant with id ... not found (anf)" (not 400). Ask the user to re-check the id.
  • Tag changes fire the applicantTagsChanged webhook — relevant if the tenant subscribes to it (see sumsub-manage-webhooks).

See also

FAQ

What does the sumsub-manage-applicant-tags skill do?

Add, replace, or remove tags on a Sumsub applicant profile via the public API — POST /resources/applicants/{applicantId}/tags/add (additive), POST .../tags (overwrite the full set), DELETE .../tags (remove), read-back via GET .../one. TRIGGER when the user asks to "tag / untag an applicant", "add / remove / clear applicant tags", "label an applicant profile", or "replace an applicant's tag set". SKIP for transaction tags, tag definitions with scoring weights, or applicant risk assessment (use sumsub-create-kyt-rules), for automated tagging inside verification workflows (use sumsub-create-workflow), and for subscribing to tag-change webhooks (use sumsub-manage-webhooks).

How do I install sumsub-manage-applicant-tags?

Run npx skills add https://github.com/sumsub/agent-skills --skill sumsub-manage-applicant-tags in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sumsub-manage-applicant-tags/ (personal) or .claude/skills/sumsub-manage-applicant-tags/ (project).

Which AI agents can use sumsub-manage-applicant-tags?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is sumsub-manage-applicant-tags safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains sumsub-manage-applicant-tags?

It is published by sumsub in sumsub/agent-skills. It has 635 recorded installs.

More from sumsub/agent-skills

View all →

sumsub-api-auth

sumsub/agent-skills

Authenticate to the Sumsub API with an App Token + secret key (HMAC-SHA256 request signing). TRIGGER when the user asks to "call / sign / authenticate Sumsub API requests", debugs 401 Unauthorized / signature errors against api.sumsub.com, or needs a working request example with X-App-Token / X-App-Access-Sig / X-App-Access-Ts headers. SKIP only when a more specific skill in this repo (questionnaire/level/workflow/POA-preset/generic) already covers the user's actual task — those skills sign requests the same way and only need this one for auth deep dives.

Backend & APIs1.2K installs

sumsub-api-generic

sumsub/agent-skills

Catch-all fallback for any Sumsub API task that does NOT match a more specific skill (e.g. create-sumsub-level, sumsub-create-questionnaire, sumsub-api-auth). TRIGGER when the user wants to call, inspect, or debug a Sumsub API endpoint not otherwise covered — fetching applicants, listing levels, reviewing AML hits, exporting data, generating SDK tokens, anything against api.sumsub.com. The procedure — locate the right endpoint in the OpenAPI schema, read its request/response shape, build the payload, sign with App Token, and validate. SKIP whenever a narrower Sumsub skill already covers the request.

Backend & APIs1.2K installs

sumsub-check-skills-version

sumsub/agent-skills

Verify that the locally installed Sumsub agent-skills package is compatible with the published version before doing any Sumsub work. TRIGGER at the start of any task that touches Sumsub — Sumsub Dev MCP tools (mcpSumsubDev), KYC/AML workflows, applicants, checks, transactions, verification levels, verification links, questionnaires, fraud network, VASP lists, or anything Sumsub-related — so the user is warned before a stale skills package produces wrong results. Also use this skill when the user explicitly asks "are my Sumsub skills up to date / current", "is there a newer version of the Sumsub skills", or similar. Skip the actual update (the user runs npx skills add sumsub/agent-skills --all themselves) and skip any other Sumsub API or entity task — those have their own skills.

AI & Agents1.2K installs

sumsub-create-poa-preset

sumsub/agent-skills

Create or update a Sumsub Proof-of-Address (POA) preset. POST /resources/api/agent/poaStepSettings to create new, PATCH same path to update (id in body), GET /resources/api/agent/poaStepSettings/{id} to read one back. TRIGGER when the user asks to "create / add / build / configure / update / edit a POA preset" or "PoA step settings", configure which proof-of-address document types are accepted (utility bills, bank statements, tax bills, etc.), set validity periods per provider type, enable POI-as-POA (accept identity doc as proof of address), tune the cross-validator (name/address fuzzy match between POI and POA), or add per-country POA overrides. SKIP for attaching a preset to a level (set poaStepSettingsId on the level instead, via sumsub-create-level), or for non-POA presets (cross-check presets, permission presets, etc.).

Backend & APIs1.2K installs

sumsub-manage-webhooks

sumsub/agent-skills

Manage Sumsub clientWebhooks (event subscriptions for applicantReviewed / applicantPending / kytTxn / etc.) — reads via /resources/api/clientWebhooks, writes via /resources/api/agent/clientWebhooks. Sandbox only — production webhooks must be created by a human directly in the Sumsub dashboard. TRIGGER when the user asks to "list / retrieve / show webhooks", "create / add / register a webhook", or "update / edit / change a webhook target / event list / secret / signature algorithm" against their sandbox tenant. SKIP for production webhook setup (refer the user to the dashboard), for unrelated webhook surfaces (Stripe / videoIdent / Fireblocks / NFC / partner-specific receive paths under /resources/webhooks/...), for testing one-off delivery (use the inspectionCallbacks/testWebhook endpoint directly), and for KYT-only webhook routing (that's managed in the Sumsub dashboard's KYT section). The public API does not expose delete or per-webhook delivery stats — for those, refer

Backend & APIs1.2K installs

sumsub-integrate-websdk

sumsub/agent-skills

End-to-end recipe for adding Sumsub KYC to a website or web app via the Sumsub WebSDK. TRIGGER when the user asks to "integrate / embed / add Sumsub", "show the KYC widget", "add WebSDK", "verify users with Sumsub on the frontend", supplies an existing levelName they want to plug into a page, or asks how to wire up access tokens / lifecycle events / webhooks for Sumsub verification in an arbitrary project. Covers the whole loop — level setup, server-side access-token signing, snsWebSdk init (vanilla canonical, React recipe), client lifecycle events, token refresh, source-of-truth via webhooks + applicant GET, sandbox testing, go-live checklist. SKIP for building the level/questionnaire/POA-preset payload itself (use the sibling skills), or for backend-only API calls with no frontend (use sumsub-api-generic).

Backend & APIs1.2K installs

Popular backend & apis skills

View category →

find-skills

vercel-labs/skills

Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.

OfficialBackend & APIs4.1M installs

entra-app-registration

microsoft/azure-skills

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

OfficialBackend & APIs566.7K installs

google-agents-cli-adk-code

google/agents-cli

This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).

Backend & APIs514.8K installs

embedded-captions

heygen-com/hyperframes

Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.

Backend & APIs453.3K installs

entra-agent-id

microsoft/azure-skills

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

OfficialBackend & APIs336.6K installs

neon

neondatabase/agent-skills

Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.

Backend & APIs237.1K installs