Server
https://api.yoti.com/idverify/v1

Production Base URL

https://api.yoti.com/sandbox/idverify/v1

Sandbox Base URL

Server Variables

Signed request performed by back-end SDKs that includes a X-Yoti-Auth-Digest.

Generate signed request Yoti API endpoints are authenticated through signed requests. To create a signed request:

  1. Concatenate the following elements using the '&' character:

    • HTTP method
    • Path
    • Query string (enriched with a timestamp and a nonce parameter)
    • Base64 encoded request body (if available)
  2. Apply SHA256withRSA to the resulting string, using your PEM private key generated from the Yoti Hub.

  3. Base64 encode the result from step 2.

Example GET request:

GET&/sessions?sdkId=b88ad843-13cc-44ba-a3e0-053f71d89b1f&nonce=b88ad843-13cc-44ba-a3e0-053f71d89b1f&timestamp=1480509893

Example POST request:

POST&/sessions?sdkId=b88ad843-13cc-44ba-a3e0-053f71d89b1f&nonce=b88ad843-13cc-44ba-a3e0-053f71d89b1f&timestamp=1480509893&ew0KImlkIiA6IDEsDQoibmFtZSIgOiBpdGVtDQoNCn0=

Parameters:

  • SDK ID: UUID generated when producing your Yoti keys
  • nonce: UUID strings
  • Timestamp: UNIX timestamps (number of elapsed seconds since Jan 1st 1970)

Fields
KeyIn
X-Yoti-Auth-DigestHeader

Get all the supported documents

Auth
Query String
includeNonLatinboolean

Controls whether or not the documents returned should include non-latin documents

GET /supported-documents
Copy
Responses
200

OK

objectobject
supported_countriesarray[object]
codestring
supported_documentsarray[object]
typestring
is_strictly_latinboolean
requirementsobject
date_fromstring
Response
Copy

Create a new session

Auth
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

Request Body
POST /sessions
Responses
201

Session created

objectobject

Create Session Response Body

client_session_token_ttlinteger

remaining time the user has to complete the session

client_session_tokenuuid

client token to be used for auth of any calls made by client for this session

sessionIduuid
400

Payload validation error or malformed request

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

The application for provided sdk id does not exist

503

The service is unavailable

Response
Copy

Retrieve the entire Session

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}
Copy
Responses
200

OK

400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

Session or App not found

Response
Copy

Delete the session and everything associated with it

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

DELETE /sessions/{sessionId}
Copy
Responses
204

Session deleted

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

App not found

409

The checks are not finished

Response
Copy

Retrieve media content

Retrieves a specific media

Auth
Headers
X-Yoti-Device-Metastring

X-Yoti-Device-Meta header containing a base64 encoded JSON with DeviceMetadata (as per the schema)

Path Params
sessionIdstring
mediaIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}/media/{mediaId}/content
Copy
Responses
200

OK. Response body depends on Content-Type of the media

No response body
204

OK. Regulations prevent us from returning the media content

400

Bad Request

401

Unauthorised request (wrong key or signature)

404

Session, Media or App not found

Response
Copy

Delete media content

Deletes a specific media content

Auth
Headers
X-Yoti-Device-Metastring

X-Yoti-Device-Meta header containing a base64 encoded JSON with DeviceMetadata (as per the schema)

Path Params
sessionIdstring
mediaIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

DELETE /sessions/{sessionId}/media/{mediaId}/content
Copy
Responses
204

No content

No response body
400

Bad Request

401

Unauthorised request (wrong key or signature)

404

Session, Media or App not found

409

Session is locked (session in progress before triggering checks) or Resource is locked (session in progress with checks triggered)

Response
Copy

Fetch the configuration for a specified sdk application ID

Auth
Path Params
sdkIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /apps/{sdkId}/response-config
Copy
Responses
200

OK

400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

App not found

Response
Copy

Update the configuration for a specified sdk application ID

Auth
Path Params
sdkIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

Request Body
PUT /apps/{sdkId}/response-config
Responses
200

Updated configuration successfully

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

App not found

503

The service is unavailable

Response
Copy

Get the configured config for a specified session ID

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

GET /sessions/{sessionId}/response-config
Copy
Responses
200

OK

400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

404

Session or App not found

Response
Copy

Update the configuration for a specified session ID

Auth
Path Params
sessionIdstring
Query String
sdkIdstring

Required if using a Signed Request as the authentication scheme

timestampstring

Required if using a Signed Request as the authentication scheme

noncestring

Required if using a Signed Request as the authentication scheme

Request Body
PUT /sessions/{sessionId}/response-config
Responses
200

Updated configuration successfully

No response body
400

Invalid payload or request missing headers or query params

401

Unauthorised request (wrong key or signature)

403

Unauthorised request (app is disabled or has no associated organisation_id)

404

App not found

503

The service is unavailable

Response
Copy