Tenant API (KYC)
OneKYC exposes two public HTTP APIs for tenant-server integration:
Tenant API (KYC) — manages individual (applicant) verification: creating sessions and verification links, fetching results, OCR data, AML screening, manual review tasks, statistics, and audit data.
KYB API — a separate surface for business verification (including KYB review tasks). See KYB API.
Both surfaces are served from your tenant API domain. The Tenant API is mounted at /tenant/v1/kyc/..., the KYB API at /tenant/v1/kyb/....
Authentication
All server-to-server requests are signed with HMAC-SHA256.
Required headers:
Authorization: HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>X-Timestamp: <unix_seconds>— allowed clock drift versus the server is ±5 minutes.
The string to sign: timestamp\nmethod\npath\nbody_hash, where body_hash is the lowercase hex SHA256 digest of the raw request body. For bodyless requests, use an empty string.
For the full algorithm description, JavaScript / Python / Go examples, key identifier formats (kyc_live_* / kyc_test_* / kyb_live_* / kyb_test_*), and the list of scopes, see Authentication.
Environments
Production
kyc_live_ / kyb_live_
Real verifications, billing, real webhooks
Test
kyc_test_ / kyb_test_
Sandbox sessions, isolated data, no charge
Section structure
Authentication — HMAC, scopes, key rotation.
Sessions — create, fetch, and cancel verification sessions.
Applicants — applicant records, history, AML data.
Documents and media — supported document types, presigned URLs.
Flows — verification scenario reference (managed in the admin panel).
Verification links — generating links and QR codes for end users.
Review tasks — manual review queue and decisions for integrators (HMAC).
Webhooks — asynchronous event notifications, signature format, retry policy.
Metrics and analytics — session aggregates, conversion, export.
Audit — log of API-side actions.
Errors and limits — error codes, rate limits, OTP parameters.
API reference (Swagger / OpenAPI) — machine-readable specification.
Last updated