Platform API

The Platform API allows clients to drive the eKYC journey programmatically via direct HTTP calls, without using WebView or mobile SDKs.

Base endpoint:

• PH: https://ekyc-platform-ph-staging.trustingsocial.com/api
• VN: https://ekyc-platform-vn-staging.trustingsocial.com/api
• IN: https://ekyc-platform-in-staging.trustingsocial.com/api
• MX: https://ekyc-platform-mx-staging.trustingsocial.com/api

Authentication Mechanism

• Call Initialization API first to obtain an access_token.
• Pass access_token as a Bearer token in subsequent calls:

  Authorization: Bearer <access_token>
  

Initialization API

Initializes an eKYC session from the client-generated encrypted token. This single call handles token parsing, application creation (or lookup), bootstrap configuration, and access token issuance.

1. Request

Query Parameters:

2. Response

Success (200):

{
  "data": {
    "token": "<unique_token>",
    "access_token": "<JWT>",
    "bootstrap": {
      "lender_code": "lender_vn",
      "lender_country": "VN",
      "lender_language": "vi",
      "ui_version": "4.0",
      "masked_phone_number": "09*****123",
      "required_steps": [],
      "flow_selected_at": 1700000000,
      "lead_source": "sms",
      "client_custom_settings": {}
    }
  },
  "message": "platform init successfully",
  "time": "2026-01-01T00:00:00Z",
  "verdict": "success"
}

ID Verification API

Uploads ID card images (and optional QR images), runs OCR and tampering checks, and returns the final verification result synchronously.

1. Request

Request Body:

2. Response

Success (200):

{
  "data": {
    "status": "success",
    "error_code": "",
    "error_message": {},
    "label": "vn.national_id.front",
    "next_action": "",
    "application_state": ""
  },
  "message": "verify id card completed",
  "time": "2026-01-01T00:00:00Z",
  "verdict": "success"
}

Response data fields:

Selfie Verification API

Uploads selfie images, runs liveness detection and face matching, and returns the final verification result synchronously. The last image in the images array is treated as the primary selfie.

1. Request

Request Body:

2. Response

Success (200):

{
  "data": {
    "status": "success",
    "error_code": "",
    "error_message": {},
    "label": "portrait",
    "next_action": "",
    "application_state": ""
  },
  "message": "verify selfie completed",
  "time": "2026-01-01T00:00:00Z",
  "verdict": "success"
}

Response data fields are identical to the ID Verification API.

Onboard API

Bundles the three calls above (Init → ID Verification → Selfie Verification) into a single synchronous request. It imports a complete dossier, runs the configured ID and selfie checks in sequence (waiting for each), drives the application to a terminal state so the configured Post-check / AML / Government checks run, and returns the full TS-native result — the same shape as API Application Detail — in the response.

Use this when you already hold a user's ID/selfie assets (e.g. captured on another channel or by another vendor) and want to re-check them through the TrustVision pipeline in one call, without driving Init / Verify ID / Verify Selfie separately.

Authentication: unlike Verify ID / Verify Selfie, this endpoint does not require a prior Init or a Bearer access_token — it authenticates with the encrypted_token in the body (the same token as Init). The response still returns an access_token you can use to re-pull API Application Detail later.

Note: the request blocks until all checks finish (ID + selfie run sequentially), so allow a generous client timeout.

1. Request

Request Body:

At least one of image1 (ID) or selfies (selfie) must be present — supply only one group for an ID-only or selfie-only re-check. Put liveness frames in videos, not in selfies.

2. Response

The endpoint blocks until all checks complete, then returns the full result — the same TS-native shape as API Application Detail (overall verdict plus each module's status). Conditional blocks (ekyc_ocr / ekyc_face / id_tampering / file_ids / form_data / client_metadata) appear only when the corresponding data exists.

Success (200):

{
  "data": {
    "verdict": "approve",
    "application_id": 10,
    "application_unique_token": "ad083945-...",
    "application_user_id": "0123456789",
    "ekyc_ocr": {
      "card_info": {},
      "process_status": "success",
      "sanity_check_status": "success"
    },
    "ekyc_face": {
      "compare_status": "matched",
      "compare_score": 0.98,
      "liveness_status": "live",
      "search_face_status": "not_found"
    },
    "id_tampering": { "score": 0.01, "verdict": "genuine" },
    "client_metadata": {
      "applicant_name": "Jane Doe",
      "gender": "female"
    },
    "access_token": "<JWT>"
  },
  "message": "onboard completed",
  "time": "2026-01-01T00:00:00Z",
  "verdict": "success"
}

Response data fields:

See API Application Detail for the full field reference (the verdict, file_ids, and form_data mappings).

Dedupe / indexing-only mode: when enabled for the lender (client_custom_settings.onboard_dedupe_only), the endpoint runs only face index/search, leaves data.verdict as pending, and returns the match result on data.ekyc_face.search_face_result / search_face_status (the Post-check / AML / verdict pipeline is skipped).