The API is included in the plan. The account owner creates keys in the developer settings. For a test account, email hello@storebay.co.uk.

Developers
Compliance

Ask a customer to check their ID online

Emails the customer a link to check their ID online: a photo of their ID and a live selfie, which a specialist provider checks for them. Nothing is created until the customer agrees on the link's page, so this answers with the request and not an identity verification; the check then arrives on `GET /identity-verifications` and as the `identity_verification.*` webhooks. The answer never carries the link or the address it went to. Each call emails a new link, so send an `Idempotency-Key` to make a retry safe. Answers `409` when the operator has not turned online ID checks on (`id_check_link` names why) and `422` when the customer has no email address.

POST
/identity-verifications

Emails the customer a link to check their ID online: a photo of their ID and a live selfie, which a specialist provider checks for them. Nothing is created until the customer agrees on the link's page, so this answers with the request and not an identity verification; the check then arrives on GET /identity-verifications and as the identity_verification.* webhooks. The answer never carries the link or the address it went to. Each call emails a new link, so send an Idempotency-Key to make a retry safe. Answers 409 when the operator has not turned online ID checks on (id_check_link names why) and 422 when the customer has no email address.

Authorization

AuthorizationBearer <token>

Present an API key (sb_live_… / sb_test_…), an OAuth2 access token, or a static token as a Bearer credential. The operator is implied by the credential; it is never in the path. Only a SHA-256 hash of an API key is stored server-side.

In: header

Header Parameters

Idempotency-Key?string

A unique key that makes this mutation safe to retry. Repeats replay the stored response; reuse with a different body returns 409 idempotency_conflict.

Lengthlength <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/identity-verifications" \  -H "Content-Type: application/json" \  -d '{    "contact_id": "f245e2a3-e141-4d41-912c-b1c1f5bd5598"  }'
{  "data": {    "object": "identity_verification_request",    "contact_id": "f245e2a3-e141-4d41-912c-b1c1f5bd5598",    "agreement_id": "67dd069b-637c-4b8e-8d92-17a313d06fb8",    "expires_at": "2019-08-24T14:15:22Z"  }}
{  "error": {    "code": "unauthorized",    "message": "Missing or invalid credential."  }}
{  "error": {    "code": "insufficient_scope",    "message": "The credential lacks a scope required by this endpoint."  }}
{  "error": {    "code": "conflict",    "message": "The request conflicts with current resource state."  }}
{  "error": {    "code": "validation_error",    "message": "One or more fields are invalid.",    "details": [      {        "field": "email",        "issue": "must be a valid email address"      }    ]  }}
{  "error": {    "code": "rate_limited",    "message": "Rate limit exceeded. Retry after 7s."  }}
{  "error": {    "code": "validation_error",    "message": "string",    "details": [      {        "field": "string",        "issue": "string"      }    ]  }}