Certivant Developer Documentation
Build with the Certivant API — KYC, KYB, document upload, hosted sessions, and webhook events.
Welcome to the Certivant developer docs. This is the technical reference for integrating Certivant's KYC and KYB platform into your own product.
If you are looking for how to use Certivant in the browser, see the tenant documentation instead — this site assumes you are writing code that talks to the REST API.
What you can build
- Run an identity verification (KYC) from your own app — submit an applicant, collect documents through a hosted session or your own UI, and receive an approve / reject / escalate decision.
- Run a business verification (KYB) — submit company details, directors, and ultimate beneficial owners, and check them against registries and sanctions lists.
- Receive real-time webhooks when a request changes state, a document is uploaded, or a check completes.
- Manage requests from the dashboard via your own automation — the same endpoints power Certivant's web UI.
- Attribute requests to your own customers (partner mode) — run verifications for many end customers inside one organization, tag each request with a sub-tenant name + external id, and filter or route by it across the API and webhooks.
At a glance
| Base URL | https://app.certivant.com/api/v1/kyc |
| Authentication | Authorization: Bearer ck_live_… or ck_test_… (API key, per organization; older kyk_… keys still work) |
| Content type | application/json (or multipart/form-data for document upload) |
| Rate limit | Plan-based — see Rate limits |
| Webhook signature | X-Certivant-Signature-V2: t=…,v1=… (HMAC-SHA256 over timestamp.body, 300 s tolerance) — see Signature verification |
| Interactive reference | API reference, or open /api/v1/docs directly — public, generated from the OpenAPI schema |
| OpenAPI schema | /api/v1/openapi.json — public OpenAPI 3.1, no sign-in |
One host, not a subdomain per tenant. On the hosted service every
organization shares the same host, app.certivant.com — there is no
your-org.certivant.com, so use app.certivant.com in these examples
as-is. (Self-hosted deployments use whatever domain the operator
configured; certivant.com itself is the marketing site, not the app.)
For the API, your organization is identified by your API key, never
by the URL: the base path is /api/v1/kyc with no org slug in it. The
slug only appears where a human browses — the dashboard at
/app/{org-slug} and hosted form/session links like /forms/{slug}. A
white-label custom domain can
put those human-facing links on your own domain, but the API host is
unchanged.
The interactive reference and the raw OpenAPI schema are public:
no sign-in or API key is needed, and they describe only the
integration (/api/v1) endpoints. See
API reference.
Get started
Reference
- Forms — list the tenant's KYC & KYB forms so you can pick which one to run a verification against.
- KYC requests — create, list, fetch, submit, decide, resubmit.
- KYB requests — business verification with directors and UBOs.
- Documents — upload identity documents, fetch signed download URLs.
- Hosted sessions — generate a short-lived URL where the applicant completes the flow.
- Blocklist — add and remove blocked emails, phone numbers, document numbers and IP addresses, or block the face, device and IP behind a verification.
- Age check — estimate from a selfie whether someone is old enough, with a fall back to the ID date of birth.
- Reused verifications — let an applicant who already passed a Certivant verification elsewhere reuse it with you (individuals and businesses).
- Embed in your site or app — show a verification in your own page with one script tag, or in a React Native or Flutter WebView.
- API reference (OpenAPI) — the public OpenAPI 3.1 document and the interactive reference.
- Live verification — schedule, track, reschedule or cancel a human-hosted live ID verification session and get the decision back by webhook.
- Live ID Validation — biometric logon: match a returning user's live selfie against their verified KYC face.
- MCP server — connect an AI assistant to your verification queue over the Model Context Protocol.
- Webhooks — register a URL, verify signatures, handle retries.
- Errors — error codes, HTTP status mapping, validation field shape.
- Rate limits — quotas, headers, retry strategy.
- Schemas — enums, status values, request/response shapes you'll see often.