API & webhooks
Build verification into your own product
curl -X POST $SV_API/v1/verifications \ -H "Authorization: Bearer $SV_KEY" \ -d type=identity external_id=cust_1042 # 201 Created { "id": "VR-24871", "status": "created" } # webhook → verification.approved
Integration
Three calls to a verified customer
Create an API key
In your dashboard, create a key with the scopes you need and add a webhook endpoint.
Create a verification
POST the customer’s details and your own reference. You get back a personal link to send.
Receive the result
We POST signed events to your endpoint as the customer progresses and when a decision is made.
Built for production
The details developers care about
Scoped API keys
Read, write and file-access scopes, so each integration gets only what it needs.
Idempotent requests
Send an Idempotency-Key header and retries never create duplicate verifications.
Signed webhooks
HMAC-SHA256 signatures and timestamps let you verify every event and reject replays.
Reliable delivery
Events are written to an outbox in the same transaction and retried until your server confirms.
Your own references
Attach your customer ID and metadata — they come back in every response and webhook.
Test events
Send a test webhook from the dashboard to check your endpoint before going live.
Reference
API at a glance
Base URL and authentication
All requests go to https://app.securelyverify.io/api/v1 with the header Authorization: Bearer <API key>. Create keys in your dashboard under API & webhooks and choose their scopes. Keys are shown once and are meant for server-to-server use only.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| POST | /verifications | Create an identity or document verification and get the customer link |
| GET | /verifications | List verifications, filtered by status or your external ID |
| GET | /verifications/{id} | Get status, decision and result summary |
| POST | /verifications/{id}/link | Issue a new link (for example after expiry) |
| POST | /verifications/{id}/send | Email the link to the customer |
| POST | /verifications/{id}/cancel | Cancel the verification and revoke its link |
| GET | /events | Read the event log (useful for reconciling webhooks) |
Webhook events
| Event | When it fires |
|---|---|
verification.created | A verification request was created |
verification.opened | The customer opened the link for the first time |
verification.submitted | The customer finished and submitted |
verification.review_ready | Automated checks are complete and the case is waiting for a decision |
verification.approved / rejected | A reviewer made a decision |
verification.retry_requested | A reviewer asked the customer to redo it or add documents |
verification.expired / cancelled | The link expired or was cancelled |
Every webhook is signed with HMAC-SHA256 using your endpoint’s signing secret, retried with backoff if your server doesn’t respond, and delivered from an outbox so an event is never lost.
Ready to integrate?
