openapi: 3.0.1
info:
  title: Shufti Pro Verification Status API
  description: Specification of the Shufti Pro identity-verification API. A single REST endpoint accepts a verification request containing one or more service objects - document, face, address, consent, background_checks, and kyb - to run KYC, KYB, and AML compliance across 240+ countries and territories. Companion endpoints retrieve verification status and proofs and delete verification data. Requests authorize via HTTP Basic Auth (Client ID as username, Secret Key as password) or a short-lived Bearer access token.
  termsOfService: https://shuftipro.com/terms-conditions/
  contact:
    name: Shufti Pro Support
    url: https://shuftipro.com/contact-us/
  version: '1.0'
servers:
- url: https://api.shuftipro.com
tags:
- name: Status
paths:
  /status:
    post:
      operationId: getVerificationStatus
      tags:
      - Status
      summary: Get verification status and proofs.
      description: Retrieves the current status, event, and proof URLs for a previously submitted verification by posting its reference.
      security:
      - basicAuth: []
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StatusRequest'
      responses:
        '200':
          description: Status response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationResponse'
  /delete:
    post:
      operationId: deleteVerification
      tags:
      - Status
      summary: Delete verification data.
      description: Deletes the stored verification data for a completed request by reference. Returns request.deleted on success or request.invalid if the reference is unknown or already deleted.
      security:
      - basicAuth: []
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StatusRequest'
      responses:
        '200':
          description: Delete response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteResponse'
components:
  schemas:
    DeleteResponse:
      type: object
      properties:
        reference:
          type: string
          example: '17374217'
        event:
          type: string
          enum:
          - request.deleted
          - request.invalid
          example: request.deleted
    VerificationResponse:
      type: object
      properties:
        reference:
          type: string
          example: '17374217'
        event:
          type: string
          description: Current verification event.
          enum:
          - request.received
          - request.pending
          - request.invalid
          - request.timeout
          - request.unauthorized
          - request.deleted
          - verification.accepted
          - verification.declined
          - verification.cancelled
          - verification.status.changed
        email:
          type: string
        country:
          type: string
        verification_url:
          type: string
          format: uri
          description: Onsite verification URL, when applicable.
        verification_result:
          type: object
          additionalProperties: true
          description: Per-service pass/fail result map.
        verification_data:
          type: object
          additionalProperties: true
          description: Extracted data per service.
        declined_reason:
          type: string
        declined_codes:
          type: array
          items:
            type: string
    StatusRequest:
      type: object
      required:
      - reference
      properties:
        reference:
          type: string
          description: Reference of the verification to query or delete.
          example: '17374217'
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
      description: HTTP Basic Auth using your Client ID as the username and your Secret Key as the password.
    bearerAuth:
      type: http
      scheme: bearer
      description: Bearer access token shared with the client; valid for 10 minutes and single use.