Open the app

API for your lending pipeline

Everything a staff member does in the app, your system can do via the API: create a check, send a link to the borrower, get the summary and PDF. The result arrives by webhook, so there is no need to poll the service.

Principles

  • Version in the path

    All methods live under /api/v1. Breaking changes ship as a new version, and the old one keeps working.

  • Uniform response

    Every method returns success, code, error and value. Errors come as text in the language from Accept-Language.

  • Idempotency

    Repeating a check creation with the same Idempotency-Key after a timeout returns the check that was already created.

  • Your own application number

    Pass your system’s externalReferenceId into the check and find the check by it without storing our identifiers.

Access

Your system acts on behalf of an organization. Two methods are available, and both use the same API key and the same access rights.

  • API key

    X-API-Key and VeriCore-Organization-Id headers. The key secret is generated on the server, shown once and stored only as a hash.

  • OAuth2 client credentials

    The key is exchanged for a short-lived token at /api/v1/oauth/token. Suitable for systems that expect the standard OAuth2 flow.

  • Access rights

    Eleven permission areas: checks, documents, provider checks, manual review, activity history, usage tracking and organization settings, for reading and writing.

  • IP allowlist

    An organization can restrict the addresses its keys are accepted from. An empty list means no restrictions.

A check through the API

Six calls from application to summary. The scanning, parsing and checking steps can be run by the platform orchestrator without your involvement.

  1. 01POST/api/v1/verification-cases

    Create a check: borrower and report country, applicant type, your application number

  2. 02POST/verification-cases/{id}/upload-link

    Issue the borrower a one-time link to the upload portal

  3. 03POST/verification-cases/{id}/documents/signed-upload-url

    Or upload the file yourself via a signed link

  4. 04POST/verification-cases/{id}/provider-checks/start-session

    Start a KYC or KYB session for the borrower

  5. 05POST/verification-cases/{id}/summary/generate

    Build the summary: identity match, authenticity, flags, recommendation

  6. 06GET/verification-cases/{id}/summary/pdf

    Get the summary PDF with a QR code

Creating a check

The response immediately contains the borrower portal address. Send the link by SMS or messenger, or show it as a QR code on screen.

POST /api/v1/verification-cases
X-API-Key: vk_live_…
VeriCore-Organization-Id: 7c1f…
Idempotency-Key: 5b0e8f2a-…

{
  "externalReferenceId": "LOAN-2026-104233",
  "applicantType": "Individual",
  "applicantCountryCode": "UZ",
  "reportCountryCode": "UZ"
}
{
  "success": true,
  "code": 200,
  "value": {
    "id": "c4d1…",
    "status": "AwaitingApplicant",
    "applicantUploadUrl": "https://app.vericore.a3.solutions/apply/…"
  }
}

Webhooks

Subscribe an endpoint to the events you need. Each delivery is signed with HMAC-SHA256 over the timestamp and request body, retried on failure and saved in the delivery log.

case.status_changed

The check moved to a new status

document.uploaded

The borrower or your system uploaded a document

document.status_changed

The document processing status changed

manual_review.status_changed

A manual review task changed

summary.generated

The underwriting summary was generated

How to verify the signature

Recompute HMAC-SHA256 over the string “timestamp, dot, request body” with the endpoint secret and compare it with the X-VeriCore-Signature header. Reject requests with a timestamp that is too old.

X-VeriCore-Event: summary.generated
X-VeriCore-Delivery: 9a71…
X-VeriCore-Timestamp: 1791964800
X-VeriCore-Signature: 3f6c…

Verifying an issued report

The QR code in the PDF leads to a public verification address. You can embed it in your own “verify report” interface: the response shows whether the report was issued by the platform and whether it has been altered.

QR-verifiable report

API protection

  • Rate limiting on public endpoints, with a separate strict limit on opening a report by password
  • Webhook addresses are validated: private networks and insecure schemes are rejected
  • Documents are transferred via signed links with a limited lifetime
  • The file storage key is derived by the server, so a client cannot point to another party’s file
  • API documentation in production is closed to anonymous access

Documentation and sandbox

An OpenAPI 3.1 specification with a Scalar interface in six languages and a free sandbox with test checks for debugging your integration.

API documentationStart with the sandbox