Server
https://api.yoti.com/idverify/v1

Production Base URL

https://api.yoti.com/sandbox/idverify/v1

Sandbox Base URL

Server Variables

Signed request performed by back-end SDKs that includes a X-Yoti-Auth-Digest.

Generate signed request Yoti API endpoints are authenticated through signed requests. To create a signed request:

  1. Concatenate the following elements using the '&' character:

    • HTTP method
    • Path
    • Query string (enriched with a timestamp and a nonce parameter)
    • Base64 encoded request body (if available)
  2. Apply SHA256withRSA to the resulting string, using your PEM private key generated from the Yoti Hub.

  3. Base64 encode the result from step 2.

Example GET request:

GET&/sessions?sdkId=b88ad843-13cc-44ba-a3e0-053f71d89b1f&nonce=b88ad843-13cc-44ba-a3e0-053f71d89b1f&timestamp=1480509893

Example POST request:

POST&/sessions?sdkId=b88ad843-13cc-44ba-a3e0-053f71d89b1f&nonce=b88ad843-13cc-44ba-a3e0-053f71d89b1f&timestamp=1480509893&ew0KImlkIiA6IDEsDQoibmFtZSIgOiBpdGVtDQoNCn0=

Parameters:

  • SDK ID: UUID generated when producing your Yoti keys
  • nonce: UUID strings
  • Timestamp: UNIX timestamps (number of elapsed seconds since Jan 1st 1970)

Fields
KeyIn
X-Yoti-Auth-DigestHeader

Get all the supported documents

Auth
Query String
includeNonLatinboolean

Controls whether or not the documents returned should include non-latin documents

Default: false

GET /supported-documents
Copy
Responses
200

OK

objectobject
supported_countries2 fieldsarray[object]
Response
Copy

Create a new session

Auth
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

Request Body
objectobject

Create Session Payload

client_session_token_ttlinteger

Number of seconds for the user to complete the whole flow.

Default: 600

session_deadlinestring

The point-in-time by which the user must complete the whole flow. Expressed as a date, time and time-zone in RFC3339 format. This field may not be used with a client_session_token_ttl field.

resources_ttlinteger

Retention period for uploaded documents/images in number of seconds.

minimum: 86700

Default: 87000

ttlinteger

Retention period for a generated import_token, in seconds

user_tracking_idstring

Allows to track the same user across multiple sessions. Should not contain any personal identifiable information.

block_biometric_consentboolean

Allows the relying business to block the collection of biometric consent

Default: false

notifications4 fieldsobject
requested_checks

Mutually exclusive with identity_profile_requirements

objectobject
typestring

Enum: ID_DOCUMENT_AUTHENTICITY

config2 fieldsobject
requested_tasks

Mutually exclusive with identity_profile_requirements

objectobject
typestring

Enum: ID_DOCUMENT_TEXT_DATA_EXTRACTION

configobject
manual_checkstring

Acceptable values vary for each check type, but may be one of: [NEVER, FALLBACK, ALWAYS]

Enum: NEVER,FALLBACK,ALWAYS

chip_datastring

Enum: DESIRED,IGNORE

required_documents

Allows the Relying Business to require multiple documents and filter the list of allowable document countries/types. Mutually exclusive with identity_profile_requirements

objectobject
typestring

Enum: ID_DOCUMENT

filter

Any filters that results in an empty list of allowed documents will be rejected

objectobject
typestring

Enum: ORTHOGONAL_RESTRICTIONS

allow_non_latin_documentsboolean
allow_expired_documentsboolean
country_restrictionobject
inclusionstring

Acceptable values are (case-insensitive): [INCLUDE, EXCLUDE]. WHITELIST and BLACKLIST are deprecated, but are still accepted and mapped to INCLUDE or EXCLUDE

Enum: INCLUDE,EXCLUDE

country_codesarray[string]
type_restrictionobject
inclusionstring

Acceptable values are (case-insensitive): [INCLUDE, EXCLUDE]. WHITELIST and BLACKLIST are deprecated, but are still accepted and mapped to INCLUDE or EXCLUDE

Enum: INCLUDE,EXCLUDE

document_typesarray[string]
sdk_config11 fieldsobject
POST /sessions
Copy
Responses
201

Session created

objectobject

Create Session Response Body

client_session_token_ttlinteger

remaining time the user has to complete the session

client_session_tokenuuid

client token to be used for auth of any calls made by client for this session

sessionIduuid
400

Payload validation error or malformed request

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

The application for provided sdk id does not exist

503

The service is unavailable

Response
Copy

Retrieve the entire Session

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}
Copy
Responses
200

OK

objectobject
sessionIduuid
client_session_token_ttlinteger

remaining time the user has to complete the session

import_token2 fieldsobject
user_tracking_idstring
biometric_consentdate-time
statestring

The current state of the session

Enum: ONGOING,COMPLETED,EXPIRED

client_session_tokenuuid

client token to be used for auth of any calls made by client for this session

resources4 fieldsobject
checks
objectobject
iduuid
typestring

Enum: ID_DOCUMENT_AUTHENTICITY

statestring

The current state of the Check

Enum: CREATED,READY,PENDING,DONE,INTERNAL_ERROR

resources_usedarray[string]
generated_mediaarray[object]
iduuid
typestring

Enum: IMAGE,JSON,BINARY,PDF

report2 fieldsobject
createddate-time

Uses the ISO8601 standard representation of date times

last_updateddate-time

Uses the ISO8601 standard representation of date times

400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

Session or App not found

Response
Copy

Delete the session and everything associated with it

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

DELETE /sessions/{sessionId}
Copy
Responses
204

Session deleted

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

App not found

409

The checks are not finished

Response
Copy

Retrieve media content

Retrieves a specific media

Auth
Headers
X-Yoti-Device-Metastring

X-Yoti-Device-Meta header containing a base64 encoded JSON with DeviceMetadata (as per the schema)

Path Params
sessionIdstring
mediaIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}/media/{mediaId}/content
Copy
Responses
200

OK. Response body depends on Content-Type of the media

No response body
204

OK. Regulations prevent us from returning the media content

400

Bad Request

401

Unauthorised request (wrong key or signature)

404

Session, Media or App not found

Response
Copy

Delete media content

Deletes a specific media content

Auth
Headers
X-Yoti-Device-Metastring

X-Yoti-Device-Meta header containing a base64 encoded JSON with DeviceMetadata (as per the schema)

Path Params
sessionIdstring
mediaIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

DELETE /sessions/{sessionId}/media/{mediaId}/content
Copy
Responses
204

No content

No response body
400

Bad Request

401

Unauthorised request (wrong key or signature)

404

Session, Media or App not found

409

Session is locked (session in progress before triggering checks) or Resource is locked (session in progress with checks triggered)

Response
Copy

Fetch the configuration for a specified sdk application ID

Auth
Path Params
sdkIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /apps/{sdkId}/response-config
Copy
Responses
200

OK

objectobject

Configuration Response

task_results2 fieldsobject
check_reports8 fieldsobject
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

App not found

Response
Copy

Update the configuration for a specified sdk application ID

Auth
Path Params
sdkIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

Request Body
objectobject

Configuration Payload

task_results2 fieldsobject

Task Results Payload

check_reports8 fieldsobject
PUT /apps/{sdkId}/response-config
Copy
Responses
200

Updated configuration successfully

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

App not found

503

The service is unavailable

Response
Copy

Get the configured config for a specified session ID

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}/response-config
Copy
Responses
200

OK

objectobject

Configuration Response

task_results2 fieldsobject
check_reports8 fieldsobject
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

Session or App not found

Response
Copy

Update the configuration for a specified session ID

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

Request Body
objectobject

Configuration Payload

task_results2 fieldsobject

Task Results Payload

check_reports8 fieldsobject
PUT /sessions/{sessionId}/response-config
Responses
200

Updated configuration successfully

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

App not found

503

The service is unavailable

Response