KYC API for automated identity verification
KYC API embeds remote customer identification into onboarding, account opening and enhanced-review workflows. Unlike an AML API, which analyzes crypto addresses and transactions, KYC verifies the user and their identity evidence.
KYC API capabilities
- passport and identity-document recognition;
- document-photo and live-face matching;
- liveness checks against photos and recordings;
- data-completeness and verification status;
- delivery of results to an internal compliance system.
KYC and AML have different purposes
KYC establishes who the customer is. AML and KYT assess source of funds and transaction risk. A complete compliance process uses both without treating them as interchangeable.
Integration
Before launch, configure consent, retention periods, access controls and manual-review scenarios. Contact AMLKYC to test and integrate the service.
Call sequence
A verification is not completed in a single request. It is created, the customer goes through it, and only then is the result collected. The order matters because between those steps a person photographs a document and takes a selfie — outside your code.
| Step | Call | What happens |
|---|---|---|
| Create the verification | PUT /webapi/kyc | A case is opened; the response carries its identifier |
| Submit document data | POST /webapi/kyc/user/{uuid}/check | Entered details are matched against the document |
| Collect the result | GET /webapi/kyc/user/{uuid} | Parsed document fields, captured images, match confidence |
| List verifications | GET /webapi/kyc | Everything opened so far |
What you can restrict at creation
Rules are set on the case rather than on the account, because two products of the same company rarely share the same requirements.
- Countries.
country_restriction_modesets the mode andallowed_countriesthe list — for exampleruandkzonly. - Document types.
allowed_document_typesdecides what is accepted, say passports alone. - Customer address.
emailties the case to a person and delivers the link they use to complete it.
What comes back
The response has three parts. images holds the captures, the selfie among them. document holds the parsed fields. info holds derived attributes — age, gender and confidence, the measure of how firmly the face was matched to the document.
The response contains personal data and photographs of a person. Retention periods, access rights and the lawful basis for processing belong in the design phase, not in the review after the first verification.
Decisions to make before connecting
- The
confidencethreshold below which a case goes to manual review. Declining automatically on a low score is risky: poor lighting produces the same number as an actual mismatch. - What a rejected customer is told. A bare “verification failed” generates repeat attempts and support tickets.
- How many attempts are allowed, and what happens once they run out.
- Who inside the company may open the captured images, and on what grounds. These are personal data, not routine attachments.
Frequently asked questions
The KYC API answers who the customer is by working with a document and a face. The AML API answers where the funds came from by analyzing crypto addresses and transactions. Compliance needs both, and neither replaces the other.
Yes, at creation time. country_restriction_mode sets the mode and allowed_countries the list. Because the restriction sits on the case rather than the account, different products of the same company can apply different rules.
The set is defined by allowed_document_types when the verification is created — passports only, for instance. The restriction is worth using whenever internal policy does not accept every document type.
It measures how firmly the selfie was matched to the photograph in the document. A low value is not proof of fraud: poor lighting or image quality produce the same effect, which is why such cases belong in manual review rather than automatic rejection.
Yes — captured images of the customer and the parsed document fields. That makes the lawful basis for processing, the retention period and the list of staff with access decisions to settle before integrating.
Screen your first 5 addresses for free
Sign up and get 5 free AML checks. A full report with a risk score and sources of funds — in seconds.
The AMLKYC app — checks at your fingertips
Check addresses and transactions from your phone: Telegram bot, RuStore and App Store.
Have a question? Write to us
Fill in the form and we will get back to you.