Skip to content
VerifiX — secured by ITSEC

Developers

Integrate once. Change policy without a deploy.

Compliance owns the journey; you own the integration. The API stays stable while thresholds, lists, and rules move in the console.

Request sandboxTalk to an engineer
POST /v1/verifications
curl -X POST https://api.verifix.ae/v1/verifications \
  -H "Authorization: Bearer $VERIFIX_API_KEY" \
  -H "Idempotency-Key: onb_9f2a41" \
  -H "Content-Type: application/json" \
  -d '{
    "journey": "uae_vara_retail_individual",
    "subject": {
      "type": "individual",
      "reference": "cust_10241",
      "country": "AE"
    },
    "redirect_url": "https://app.example.ae/onboarding/return"
  }'

Principles

What you can rely on

Sandbox first

Every account starts with a sandbox key and deterministic test subjects, so you can build the full happy path and every failure branch before go-live.

One API, four pillars

KYC, KYB, AML screening, and KYT are resources on the same API with the same auth, error envelope, and pagination.

Signed webhooks

Decisions, escalations, and rescreening hits arrive as HMAC-signed events with replay protection and at-least-once delivery.

Idempotent writes

Every write accepts an Idempotency-Key, so a retried onboarding never creates a duplicate case or double-bills a verification.

Quickstart

From key to live decision

  1. 1

    Get a sandbox key

    Create an account, open the console, and issue a sandbox key. No sales call is needed to start integrating.

  2. 2

    Pick a journey preset

    Reference a preset by its identifier instead of assembling checks yourself. Compliance can edit the preset later without a code change.

  3. 3

    Create a verification

    POST the subject and get back a hosted URL, or drive each check yourself if you own the capture UI.

  4. 4

    Handle the webhook

    Verify the signature, store the decision and the evidence bundle reference against your customer record, and continue your flow.

  5. 5

    Go live

    Swap the sandbox key for a live key after the production checklist is signed off — We walk through the go-live checklist with you before you switch to live keys.

201 Created
{
  "id": "ver_01HZY8QK3M4T",
  "status": "awaiting_subject",
  "journey": "uae_vara_retail_individual",
  "hosted_url": "https://flow.verifix.ae/s/8Qk3M4T",
  "expires_at": "2026-03-04T09:12:00Z",
  "checks": [
    { "type": "document", "status": "pending" },
    { "type": "liveness", "status": "pending" },
    { "type": "sanctions_pep", "status": "pending" },
    { "type": "risk_score", "status": "pending" }
  ]
}
POST your webhook endpoint
{
  "type": "verification.completed",
  "created_at": "2026-03-04T09:19:44Z",
  "data": {
    "id": "ver_01HZY8QK3M4T",
    "subject_reference": "cust_10241",
    "decision": "approved",
    "risk": { "score": 24, "band": "low" },
    "checks": [
      { "type": "document", "status": "passed" },
      { "type": "liveness", "status": "passed" },
      { "type": "sanctions_pep", "status": "no_match" },
      { "type": "risk_score", "status": "passed" }
    ],
    "evidence_bundle_url": "/v1/verifications/ver_01HZY8QK3M4T/evidence"
  }
}

Webhook security

Verify every event before you trust it

Signatures are HMAC-SHA256 over the raw request body. Compare in constant time and reject anything that fails.

verify-webhook.ts
import { createHmac, timingSafeEqual } from "crypto";

export function verifyWebhook(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

Event catalog, retry schedule, and rate limits: "documented in the developer reference"

Reference

Full documentation

Complete endpoint reference, SDK packages, Postman collection, and the sandbox test-subject matrix are published in the developer portal — https://api.verifix.ae/v1

Want to see the API against your own flow?

Bring your onboarding funnel and we will map the journey and the webhook contract on the call.

Book a demoRequest sandbox