generated: '2026-08-05'
method: searched
source:
- https://snappt-enterprise-api.readme.io/docs/getting-started-fraud-detection
- https://snappt-enterprise-api.readme.io/docs/webhook-delivery-retry-behavior
- https://snappt-enterprise-api.readme.io/docs/webhook-snappt-signature-v2
- openapi/snappt-enterprise-api-openapi-original.yml
authentication:
  style: partner API key as HTTP bearer token
  header: 'Authorization: Bearer <partner API key>'
  scheme_name: bearerAuth
  session_auth:
    header: x-unauthenticated-session-token
    scheme_name: snapptSessionAuth
    obtained_from: POST /session (partner key) or POST /session/public
    lifetime: 24 hours, or until the application is submitted — whichever comes first
    note: >-
      Session tokens are intentionally short-lived and scoped to a single applicant session, and are
      safe to hand to client-side JavaScript for a bring-your-own document upload portal.
  see: authentication/snappt-authentication.yml
idempotency:
  request_idempotency: false
  idempotency_key_header: null
  note: >-
    Snappt documents NO request-side idempotency contract — there is no Idempotency-Key header or
    parameter anywhere in the OpenAPI, and repeating a POST creates a new record. Idempotency is
    documented only for the CONSUMER side of webhooks (see webhooks.idempotency below). No
    Idempotency pointer is wired in apis.yml, because the provider does not offer one.
pagination:
  style: page-number
  params:
  - {name: page, type: number, default: 0, description: The current page}
  - {name: rowsPerPage, type: number, default: 50, description: Total number of rows to respond with}
  applies_to: [GET /applicants, GET /properties, GET /id-verification/applicants]
  note: Some collection endpoints use limit/offset instead; see the per-operation parameters in the spec.
filtering_and_sort:
  sort:
    param: sort
    allowed_fields: [result, status, insertedAt, firstName, lastName, email, externalId]
  filter:
    param: filter
    operators: ['=', '<=', '>=', '!=', '<', '>', '@>', '!@>']
    semantics: >-
      "@>" is the equivalent of an "in" operator and "!@>" of "not in", taking a pipe-separated list
      of values. IS_NULL is a keyword for null / not-null filtering (email=IS_NULL, email!=IS_NULL).
    examples: ['firstName=example,status=READY', 'status@>READY|PENDING', 'externalId=PROSPECT-123']
  search:
    param: q
    description: Free-text filter over applicant name, email address, or property.
external_correlation:
  fields:
  - {name: externalId, type: string, max: 255 characters, description: Partner identifier for the applicant, echoed back on every applicant-scoped webhook}
  - {name: externalMetadata, type: object, max: 10 KB serialized JSON, description: Arbitrary partner key/values, stored and echoed back verbatim}
  set_on:
  - POST /properties/{propertyId}/generate-applicant-link
  - POST /embedded/generate-embed-link (Embedded SDK)
  returned_on:
  - the generate-link response
  - GET /applicants/{applicantId}
  - webhooks APPLICATION_SUBMITTED, REPORT_READY, REPORT_UPDATED
  not_returned_on: [IDV_REPORT_READY]
  note: >-
    externalId is for attribution only — Snappt does not link or dedupe sessions by externalId.
    Snappt's own linking key across multiple submissions by one applicant is applicantDetailId.
media_types:
  request: [application/json, 'multipart/form-data (document upload, field name `upload`, PDF only)']
  response: [application/json, application/pdf, application/zip, image/png]
error_envelope:
  format: custom (not RFC 9457)
  content_type: application/json
  schema: ErrorResponse
  fields:
  - {name: statusCode, type: number}
  - {name: error, type: string, required: true}
  - {name: failedChecks, type: array of string, description: Populated when a document upload fails synchronous checks}
  see: errors/snappt-problem-types.yml
versioning:
  api_versioning: none in the request path — the base URL carries no version segment
  spec_version: 1.75.3
  changelog_scheme: semver, published as dated release notes (v0.8.1 through v0.12.0)
  embedded_sdk_versioning: URL path version on the loader script (embedded/v1.0.0.js)
  see: lifecycle/snappt-lifecycle.yml
rate_limits:
  documented: false
  note: Snappt publishes no rate-limit policy or rate-limit response headers in the docs or the OpenAPI.
request_tracing:
  request_id_header: null
  documented: false
webhooks:
  registration: POST /webhooks (per-event subscription via an `events` array)
  signing:
    header: Snappt-Signature-v2
    algorithm: HMAC-SHA256
    encoding: base64url (RFC 4648 §5)
    signed_payload: '<timestamp>.<raw body>'
    timestamp: Unix milliseconds, in the `t=` component of the header
    key: webhook signing secret, whsec_-prefixed, from POST /webhooks or GET /webhooks/{id}/signing-secret
    recommended_tolerance: reject signatures older than 5 minutes
    legacy_header: Snappt-Signature (v1, HMAC-SHA256 keyed on the API Key ID) — deprecated, sent in parallel during transition, to be removed
    raw_body_required: true
  delivery:
    content_type: application/json
    body_format: compact JSON with no whitespace — the signature is computed over these exact bytes
    timeout: 30 seconds
    success: HTTP 200 only
    redirects_followed: false
    ordering: not guaranteed
  idempotency:
    consumer_side: true
    recommended_key: data.id (entry/applicant id) + eventType
    reason: REPORT_READY is retried, so the same event may be delivered more than once
  see: asyncapi/snappt-enterprise-api-webhooks.yml
cross_links:
  authentication: authentication/snappt-authentication.yml
  errors: errors/snappt-problem-types.yml
  lifecycle: lifecycle/snappt-lifecycle.yml
  webhooks: asyncapi/snappt-enterprise-api-webhooks.yml
  sandbox: sandbox/snappt-sandbox.yml