Build verification into your own systems
Most firms never need this: StackGo runs inside the software you already use, so the workflows work without code. The API is for starting a verification from your own systems.
What the API covers
Six endpoints, all under /api/v1/verification. They start a verification, retrieve its result, and fetch the images captured during it.
That is deliberately the whole public surface. The application exposes far more routes, but they are the web app's own session-authenticated internals. Documenting them would be documenting our plumbing, and it would break the moment we changed it.
Endpoints
| Method | Path | Scope | What it does |
|---|---|---|---|
POST | /api/v1/verification/create | verification.create | Start a verification for an individual. |
POST | /api/v1/verification/sms | verification.create | Start a verification and invite by SMS. |
POST | /api/v1/verification/namescan/kyb | verification.create | Start a business (KYB) check. |
POST | /api/v1/verification/tranche2 | verification.create | Start a Tranche 2 workflow. |
GET | /api/v1/verification/info/:id | verification.info | Retrieve a verification and its result. |
GET | /api/v1/verification/image/:verificationId/:imageId | verification.image | Retrieve a captured document or selfie image. |
Three scopes exist in total — verification.create, verification.info and verification.image. A key carries a fixed set of them, chosen when the key is minted and frozen thereafter.
Authentication
Every request carries an API key in the Authorization header:
Authorization: Basic <API_KEY>Keys are prefixed key- and are created by a user with the developer permission. The quickstart walks through creating one.
Bearer tokens are the web application's own session auth. They are not part of this API and should not be used against it.
Results
Verification is asynchronous. A person completes their part in their own time, so a create call returns an identifier rather than a result. There are two ways to get the outcome:
- Webhooks — the outcome is pushed to you when it lands. Recommended, and documented here.
- Polling — call
GET /api/v1/verification/info/:id. Workable, but you are guessing at the interval.
Still being written
Per-endpoint request and response fields are not published yet. They exist and they are stable; they have not been documented to a standard we are willing to put our name to, and a half-accurate API reference is worse than none because it gets copied into someone's integration.
If you are building against this now, get in touch and we will send you the field-level detail directly while the reference is finished.