API Reference (Quick Index)
Base URL: https://api.attestid.io (production). All routes below are prefixed /v1.
Auth column: API key = API-Key + Access-Key-Id; SDK token = Authorization: Bearer <sdk_token>; Dashboard session = Authorization: Bearer <access_token> from registration/login.
Account & company management (/v1/account)
| Method | Path | Auth | Purpose |
|---|---|---|---|
| POST | /account/register | none | Register your company. Returns access_key_id, api_key (shown once), dashboard access_token. |
| GET | /account/me | API key or SDK token | Get your authenticated company's details. |
| POST | /account/me/keys | API key or dashboard session | Issue an additional API key (test or live). Shown once. |
| GET | /account/me/keys | API key or dashboard session | List key prefixes/metadata (no secrets). |
| DELETE | /account/me/keys/{key_id} | API key or dashboard session | Revoke a key irreversible. |
| DELETE | /account/me/data?user_id=... | API key or dashboard session | Schedule erasure of a user's PII/photos within 72h (POPIA/data protection). |
See Creating a Company & Getting Your Keys for full request/response bodies.
KYC verification (/v1/kyc)
| Method | Path | Auth | Purpose |
|---|---|---|---|
| POST | /kyc/session | API key | Exchange your API key for a 10-minute sdk_token bound to one user_id. Call only from your backend. |
| GET | /kyc/liveness-credentials | SDK token | Get the credentials needed by the client-side liveness detector component. |
| POST | /kyc/start | SDK token | Upload the ID photo (multipart/form-data: user_id, id_type, id_photo, consent_given_at, processing_purpose). Returns verification_id + liveness_session_token. Rate-limited. |
| POST | /kyc/complete | SDK token | Complete verification after liveness passes (verification_id form field). Returns the full result: verified, document, checks, failure_reason. Rate-limited. |
| GET | /kyc/{verification_id} | SDK token | Retrieve a verification result. |
| GET | /kyc/{verification_id}/documents | SDK token | Time-limited download links (15-minute expiry) for the captured ID photo and selfie. Only your company can access these. |
See Authentication & SDK Token Generation for the full sdk_token flow. The JavaScript/React SDK and Flutter SDK both wrap all of these calls for you.
Webhooks (/v1/webhooks)
| Method | Path | Auth | Purpose |
|---|---|---|---|
| POST | /webhooks/configure | API key or SDK token | Set or update your webhook URL and signing secret. |
| GET | /webhooks/configure | API key or SDK token | Get your current webhook URL (secret is never returned, only whether one is set). |
| DELETE | /webhooks/configure | API key or SDK token | Remove your webhook URL and secret; stops delivery. |
| GET | /company/webhook/deliveries | Dashboard session | List recent webhook delivery attempts and their status. |
See Webhooks for event types, payload shapes, delivery/retry behavior, and how to verify the AttestID-Signature header.
Key/token format cheat sheet
| Value | Format | Where it's used |
|---|---|---|
access_key_id | ak_live_... / ak_test_... | Paired with api_key on every API-key-authenticated request |
api_key | sk_live_... / sk_test_... | API-Key header; shown to you only once, at creation |
sdk_token | Short-lived signed token, 10-minute expiry | Authorization: Bearer header on all /kyc/* SDK calls |
access_token (dashboard) | Signed session token, 8-hour expiry | Dashboard login sessions, not used by the SDK |
Support
For API keys, onboarding, or technical support: support@brimsage.com