> For the complete documentation index, see [llms.txt](https://finext.gitbook.io/one-kyc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://finext.gitbook.io/one-kyc/api.md).

# Tenant API (KYC)

OneKYC exposes two public HTTP APIs for tenant-server integration:

* **Tenant API (KYC)** — manages individual (applicant) verification: creating sessions and verification links, fetching results, OCR data, AML screening, **manual review tasks**, statistics, and audit data.
* **KYB API** — a separate surface for business verification (including **KYB review tasks**). See [KYB API](/one-kyc/kyb.md).

Both surfaces are served from your tenant API domain. The Tenant API is mounted at `/tenant/v1/kyc/...`, the KYB API at `/tenant/v1/kyb/...`.

## Authentication

All server-to-server requests are signed with **HMAC-SHA256**.

Required headers:

* `Authorization: HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>`
* `X-Timestamp: <unix_seconds>` — allowed clock drift versus the server is ±5 minutes.

The string to sign: `timestamp\nmethod\npath\nbody_hash`, where `body_hash` is the lowercase hex SHA256 digest of the raw request body. For bodyless requests, use an empty string.

For the full algorithm description, JavaScript / Python / Go examples, key identifier formats (`kyc_live_*` / `kyc_test_*` / `kyb_live_*` / `kyb_test_*`), and the list of scopes, see [Authentication](/one-kyc/api/authentication.md).

## Environments

| Environment | Key prefix                | Purpose                                    |
| ----------- | ------------------------- | ------------------------------------------ |
| Production  | `kyc_live_` / `kyb_live_` | Real verifications, billing, real webhooks |
| Test        | `kyc_test_` / `kyb_test_` | Sandbox sessions, isolated data, no charge |

## Section structure

* [Authentication](/one-kyc/api/authentication.md) — HMAC, scopes, key rotation.
* [Sessions](/one-kyc/api/sessions.md) — create, fetch, and cancel verification sessions.
* [Applicants](/one-kyc/api/applicants.md) — applicant records, history, AML data.
* [Documents and media](/one-kyc/api/documents-and-media.md) — supported document types, presigned URLs.
* [Flows](/one-kyc/api/flows.md) — verification scenario reference (managed in the [admin panel](/one-kyc/admin/flows.md)).
* [Verification links](/one-kyc/api/verification-links.md) — generating links and QR codes for end users.
* [Review tasks](/one-kyc/api/review.md) — manual review queue and decisions for integrators (HMAC).
* [Webhooks](/one-kyc/api/webhooks.md) — asynchronous event notifications, signature format, retry policy.
* [Metrics and analytics](/one-kyc/api/metrics.md) — session aggregates, conversion, export.
* [Audit](/one-kyc/api/audit.md) — log of API-side actions.
* [Errors and limits](/one-kyc/api/errors-and-limits.md) — error codes, rate limits, OTP parameters.
* [API reference (Swagger / OpenAPI)](/one-kyc/api/api-reference.md) — machine-readable specification.