Applications

Start the applicant's identity verification

Starts an identity verification attempt for the application’s applicant and returns url, a hosted verification page. Send the applicant to it: they complete the identity check there, with no Zuba dashboard session, and the outcome reaches Zuba by webhook; read it back from GET /v2/applications//identity-verification. The link is valid until the session expires under the verification workflow’s expiry, and is returned only here, so start a new session for a new link. A new attempt replaces an earlier one, a waived outcome included, which then reads pending and no longer satisfies POST /v2/applications//submit until the attempt passes. A start is refused (409) while an attempt is still being decided by the verification provider or a reviewer, for an applicant already verified, and when the attempt changes while starting. A verified or waived outcome satisfies the identity requirement of POST /v2/applications//submit.

POST

applications

{id}

identity-verification

session

Start the applicant's identity verification

curl --request POST \
  --url https://api.example.com/v2/applications/{id}/identity-verification/session \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.example.com/v2/applications/{id}/identity-verification/session"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v2/applications/{id}/identity-verification/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/applications/{id}/identity-verification/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/applications/{id}/identity-verification/session"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/applications/{id}/identity-verification/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "sessionId": "<string>",
  "status": "pending",
  "submittedAt": "2023-11-07T05:31:56Z",
  "url": "<string>"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

Authorizations

Authorization

string

header

required

Enter Auth0 JWT token

Path Parameters

string<uuid>

required

Response

sessionId

string | null

required

The attempt's session id. Null in the sandbox, where starting a session verifies the applicant at once.

status

enum<string>

required

pending until the applicant completes the link and the outcome arrives; read it back from GET /v2/applications/{id}/identity-verification. verified in the sandbox, where starting a session verifies the applicant at once.

Available options:

pending,

verified

submittedAt

string<date-time> | null

required

When the attempt reached its outcome: null while it is pending, set in the sandbox, where the attempt is verified at once.

url

string | null

required

The hosted verification page for this attempt. Send the applicant to it: they complete the identity check there, and the outcome reaches Zuba by webhook. Valid until the session expires under the verification workflow’s expiry. It is returned only here and never stored, so start a new session for a new link. Null in the sandbox, where starting a session verifies the applicant at once.

Start the applicant's identity verification

curl --request POST \
  --url https://api.example.com/v2/applications/{id}/identity-verification/session \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.example.com/v2/applications/{id}/identity-verification/session"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.example.com/v2/applications/{id}/identity-verification/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v2/applications/{id}/identity-verification/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v2/applications/{id}/identity-verification/session"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v2/applications/{id}/identity-verification/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "sessionId": "<string>",
  "status": "pending",
  "submittedAt": "2023-11-07T05:31:56Z",
  "url": "<string>"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}

{
  "error": "BAD_REQUEST",
  "message": "Bad Request",
  "path": "/v1/resource",
  "statusCode": 400,
  "timestamp": "2024-01-15T10:30:00.000Z"
}