Didit

No entries match these filters. Clear filters

1. 3.0.0 Nov 1, 2026 · issue 127

   API surface changed: +25 endpoints, 51 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +25 endpoints, 51 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /v3/session/{sessionId}/kyb/parties/drafts/{draftId}/
   • + GET /v3/organization/{organization_id}/application/{application_id}/analytics/today/
   • + GET /v3/session/{sessionId}/files-export/{exportId}/
   • + GET /v3/session/{sessionId}/kyb/extracted-parties/
   • + GET /v3/session/{sessionId}/kyb/parties/drafts/
   • + GET /v3/travel-rule/networks/
   • + GET /v3/travel-rule/networks/questionnaire/
   • + GET /v3/travel-rule/unmatched/
   • + GET /v3/travel-rule/wallet-proofs/
   • + PATCH /v3/session/{sessionId}/kyb/parties/drafts/{draftId}/
   • + POST /v3/address-validation/
   • + POST /v3/id-verification/wallets/google-wallet/
   • + POST /v3/id-verification/wallets/verifications/{request_id}/response/
   • + POST /v3/session/{sessionId}/files-export/
   • + POST /v3/session/{sessionId}/kyb/documents/
   • + POST /v3/session/{sessionId}/kyb/parties/drafts/
   • + POST /v3/session/{sessionId}/kyb/parties/submit/
   • + POST /v3/travel-rule/networks/questionnaire/submit/
   • + POST /v3/travel-rule/networks/{network}/request/
   • + POST /v3/travel-rule/unmatched/{transaction_uuid}/match/
   • + POST /v3/travel-rule/wallet-proofs/{proof_uuid}/decision/
   • + POST /v3/travel-rule/widget/{token}/proofs/
   • + POST /v3/travel-rule/widget/{token}/proofs/{proof_id}/verify/
   • + POST /v3/travel-rule/widget/{token}/vasps/
   • + PUT /v3/travel-rule/networks/questionnaire/
   • ~ GET /v3/id-verification/wallets/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/aml/: response schema changed
   • ~ GET /v3/session/{sessionId}/aml-screening-history/: param month (query) added; response schema changed
   • ~ GET /v3/session/{sessionId}/aml-screening-history/export/: param month (query) added; response schema changed
   • ~ GET /v3/session/{sessionId}/decision/: response schema changed
   • ~ GET /v3/session/{sessionId}/webhook/{webhook_uuid}: response schema changed
   • ~ GET /v3/session/{sessionId}/webhooks/: response schema changed
   • ~ GET /v3/sessions/: param decided_from (query) added; param decided_to (query) added; param tags (query) added
   • ~ GET /v3/transactions/: param assignee (query) added
   • ~ GET /v3/travel-rule/settings/: response schema changed
   • ~ GET /v3/travel-rule/widget/{token}/: response schema changed
   • ~ GET /v3/travel-rule/workspace/: response schema changed
   • ~ GET /v3/webhook/: response schema changed
   • ~ GET /v3/webhook/destinations/: response schema changed
   • ~ GET /v3/webhook/destinations/{destination_uuid}/: response schema changed
   • ~ GET /v3/webhook/destinations/{destination_uuid}/deliveries/: response schema changed
   • ~ GET /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/: response schema changed
   • ~ GET /v3/workflows/{settings_uuid}/: response schema changed
   • ~ PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/: response schema changed
   • ~ PATCH /v3/session/{sessionId}/update-status/: request body changed
   • ~ PATCH /v3/transactions/{transaction_id}/travel-rule/: request body changed
   • ~ PATCH /v3/webhook/: request body changed; response schema changed
   • ~ PATCH /v3/webhook/destinations/{destination_uuid}/: request body changed; response schema changed
   • ~ PATCH /v3/workflows/{settings_uuid}/: response schema changed
   • ~ POST /v3/aml/: response schema changed
   • ~ POST /v3/database-validation/: request body changed
   • ~ POST /v3/email/check/: request body changed; response schema changed
   • ~ POST /v3/email/risk/: response schema changed
   • ~ POST /v3/id-verification/: response schema changed
   • ~ POST /v3/kyb/search/: response schema changed
   • ~ POST /v3/kyb/select/: response schema changed
   • ~ POST /v3/kyb/shareholders/: response schema changed
   • ~ POST /v3/kyb/ubo/: response schema changed
   • ~ POST /v3/phone/check/: request body changed; response schema changed
   • ~ POST /v3/phone/risk/: response schema changed
   • ~ POST /v3/session/: request body changed; response schema changed
   • ~ POST /v3/session/import-shared/: response schema changed
   • ~ POST /v3/session/{sessionId}/decision-email-preview/: response schema changed
   • ~ POST /v3/session/{sessionId}/resubmission-preview/: request body changed; response schema changed
   • ~ POST /v3/session/{sessionId}/signatures/{nodeId}/validate/: response schema changed
   • ~ POST /v3/session/{sessionId}/webhook/{webhook_uuid}/resend: response schema changed
   • ~ POST /v3/travel-rule/workspace/billing/: response schema changed
   • ~ POST /v3/travel-rule/workspace/claim/: response schema changed
   • ~ POST /v3/travel-rule/workspace/domain/confirm/: response schema changed
   • ~ POST /v3/travel-rule/workspace/domain/dns/: response schema changed
   • ~ POST /v3/users/delete/: request body changed
   • ~ POST /v3/wallet-screening/: request body changed; response schema changed
   • ~ POST /v3/webhook/destinations/: response schema changed
   • ~ POST /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/resend/: response schema changed
   • ~ POST /v3/workflows/: response schema changed
   • ~ PUT /v3/travel-rule/settings/: response schema changed
   • New endpoint DELETE /v3/session/{sessionId}/kyb/parties/drafts/{draftId}/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/analytics/today/
   • New endpoint GET /v3/session/{sessionId}/files-export/{exportId}/
   • New endpoint GET /v3/session/{sessionId}/kyb/extracted-parties/
   • New endpoint GET /v3/session/{sessionId}/kyb/parties/drafts/

   +5 more show less

   • New endpoint GET /v3/travel-rule/networks/
   • New endpoint GET /v3/travel-rule/networks/questionnaire/
   • New endpoint GET /v3/travel-rule/unmatched/
   • New endpoint GET /v3/travel-rule/wallet-proofs/
   • New endpoint PATCH /v3/session/{sessionId}/kyb/parties/drafts/{draftId}/

   10 details in Everything

2. docs update Nov 1, 2026 · issue 127

   Didit adds an AI agent skill at https://docs.didit.me/skill.md for wiring identity verification into projects via Claude Code, Cursor, or any coding agent⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Bootstrap Didit identity verification in a new project by prompting your coding agent — no manual SDK wiring needed.
   📍Read https://docs.didit.me/skill.md and follow it to add Didit identity verification to this project. Start with a sandbox application.
3. 3.0.0 Oct 28, 2026 · issue 123

   API surface changed: +11 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +11 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /v3/organization/{organization_id}/application/{application_id}/transactions/delete/
   • + GET /v3/import-jobs/
   • + GET /v3/import-jobs/active/
   • + GET /v3/organization/bank-verification-pricing/
   • + GET /v3/session/imports/providers/
   • + POST /v3/session/imports/providers/check/
   • + POST /v3/session/imports/{importId}/cancel/
   • + POST /v3/session/imports/{importId}/pause/
   • + POST /v3/session/imports/{importId}/resume/
   • + POST /v3/session/imports/{importId}/retry/
   • + POST /v3/session/imports/{importId}/start/
   • ~ DELETE /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/: response schema changed
   • ~ DELETE /v3/organization/{organization_id}/application/{application_id}/regulatory-reports/{report_uuid}/: request body changed; response schema changed
   • ~ DELETE /v3/session/{sessionId}/delete/: response schema changed
   • ~ GET /v3/session/imports/{importId}/: response schema changed
   • ~ GET /v3/session/{sessionId}/decision/: response schema changed
   • ~ GET /v3/workflows/{settings_uuid}/: response schema changed
   • ~ PATCH /v3/workflows/{settings_uuid}/: response schema changed
   • ~ POST /v3/businesses/delete/: response schema changed
   • ~ POST /v3/session/import-shared/: response schema changed
   • ~ POST /v3/session/imports/: request body changed; response schema changed
   • ~ POST /v3/sessions/delete/: response schema changed
   • ~ POST /v3/users/delete/: response schema changed
   • ~ POST /v3/workflows/: response schema changed
   • New endpoint DELETE /v3/organization/{organization_id}/application/{application_id}/transactions/delete/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new GET /v3/import-jobs/ and GET /v3/import-jobs/active/ endpoints.
   • New endpoint GET /v3/organization/bank-verification-pricing/
   • Adds new GET /v3/session/imports/providers/ and POST /v3/session/imports/providers/check/ endpoints.
   • Adds new POST /v3/session/imports/{importId}/cancel/, POST /v3/session/imports/{importId}/pause/, POST /v3/session/imports/{importId}/resume/, POST /v3/session/imports/{importId}/retry/ and POST /v3/session/imports/{importId}/start/ endpoints.

   5 details in Everything

4. 3.0.0 Oct 25, 2026 · issue 120

   API surface changed: +82 endpoints, 60 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +82 endpoints, 60 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /v3/events/{event_uuid}/delete/
   • + DELETE /v3/lists/{list_uuid}/
   • + DELETE /v3/lists/{list_uuid}/entries/{entry_uuid}/
   • + DELETE /v3/travel-rule/counterparty-contacts/{contact_uuid}/
   • + GET /v3/aml/dataset-freshness/
   • + GET /v3/blocklist/
   • + GET /v3/events/
   • + GET /v3/events/enrichment-metrics/
   • + GET /v3/events/subjects/{vendor_data}/
   • + GET /v3/events/{event_uuid}/
   • + GET /v3/investigator/activity/
   • + GET /v3/investigator/activity/export/
   • + GET /v3/investigator/dashboard/
   • + GET /v3/investigator/guardrails/
   • + GET /v3/investigator/performance/
   • + GET /v3/investigator/queue/
   • + GET /v3/investigator/runs/{run_id}/
   • + GET /v3/investigator/settings/
   • + GET /v3/investigator/summary/
   • + GET /v3/investigator/transactions/{transaction_id}/
   • + GET /v3/lists/
   • + GET /v3/lists/{list_uuid}/
   • + GET /v3/lists/{list_uuid}/entries/
   • + GET /v3/organization/{organization_id}/application/{application_id}/analytics/
   • + GET /v3/organization/{organization_id}/application/{application_id}/businesses/{business_session_id}/pdf/
   • + GET /v3/organization/{organization_id}/application/{application_id}/transactions/{transaction_uuid}/pdf/
   • + GET /v3/session/{sessionId}/aml-screening-history/
   • + GET /v3/session/{sessionId}/aml-screening-history/export/
   • + GET /v3/session/{sessionId}/events/
   • + GET /v3/session/{sessionId}/features/overrides/
   • + GET /v3/session/{sessionId}/webhook/{webhook_uuid}
   • + GET /v3/session/{sessionId}/webhooks/
   • + GET /v3/status/
   • + GET /v3/transactions/{transaction_id}/notes/
   • + GET /v3/transactions/{transaction_id}/related/
   • + GET /v3/travel-rule/counterparty-contacts/
   • + GET /v3/travel-rule/join/{token}/
   • + GET /v3/travel-rule/transfers/
   • + GET /v3/travel-rule/workspace/
   • + GET /v3/webhook/
   • + GET /v3/webhook/destinations/{destination_uuid}/analytics/
   • + GET /v3/webhook/destinations/{destination_uuid}/deliveries/
   • + GET /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/
   • + PATCH /v3/document-ai/{sessionId}/documents/{documentUuid}/
   • + PATCH /v3/investigator/settings/
   • + PATCH /v3/lists/{list_uuid}/
   • + PATCH /v3/session/{sessionId}/add-images/
   • + PATCH /v3/session/{sessionId}/update-aml-status/
   • + PATCH /v3/webhook/
   • + POST /v3/bank/account-check/
   • + POST /v3/blocklist/add/
   • + POST /v3/blocklist/remove/
   • + POST /v3/events/
   • + POST /v3/events/batch/
   • + POST /v3/events/sdk-token/
   • + POST /v3/investigator/runs/batch-accept/
   • + POST /v3/investigator/runs/{run_id}/accept/
   • + POST /v3/investigator/runs/{run_id}/override/
   • + POST /v3/lists/
   • + POST /v3/lists/{list_uuid}/entries/
   • + POST /v3/lists/{list_uuid}/entries/face-upload/
   • + POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/requests/{request_uuid}/remind/
   • + POST /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/tags/add/
   • + POST /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/tags/remove/
   • + POST /v3/session/{sessionId}/decision-email-preview/
   • + POST /v3/session/{sessionId}/features/overrides/{overrideId}/cancel/
   • + POST /v3/session/{sessionId}/kyb/parties/{partyUuid}/regenerate/
   • + POST /v3/session/{sessionId}/sandbox/simulate/
   • + POST /v3/session/{sessionId}/simulate/
   • + POST /v3/session/{sessionId}/webhook/{webhook_uuid}/resend
   • + POST /v3/transactions/{transaction_id}/notes/
   • + POST /v3/travel-rule/counterparty-contacts/
   • + POST /v3/travel-rule/join/{token}/
   • + POST /v3/travel-rule/join/{token}/verify/
   • + POST /v3/travel-rule/test-vasp/inbound/
   • + POST /v3/travel-rule/wallet-addresses/import/
   • + POST /v3/travel-rule/workspace/billing/
   • + POST /v3/travel-rule/workspace/claim/
   • + POST /v3/travel-rule/workspace/domain/code/
   • + POST /v3/travel-rule/workspace/domain/confirm/
   • + POST /v3/travel-rule/workspace/domain/dns/
   • + POST /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/resend/
   • ~ DELETE /v3/travel-rule/wallet-addresses/{entry_uuid}/: response schema changed
   • ~ GET /v1/transactions/{transaction_id}/: response schema changed
   • ~ GET /v3/customization/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/cases/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/aml/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/events/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/networks/: param assignee (query) added; param has_case (query) added; param priority (query) added; param risk_min (query) added; param scope (query) added; param summary (query) added; response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/: response schema changed
   • ~ GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/timeline/: param contract (query) added; param cursor (query) added; param event_type (query) added; param limit (query) added; response schema changed
   • ~ GET /v3/session/{sessionId}/decision/: response schema changed
   • ~ GET /v3/sessions/: response schema changed
   • ~ GET /v3/sessions/{session_id}/reviews/: response schema changed
   • ~ GET /v3/transactions/: response schema changed
   • ~ GET /v3/transactions/{transaction_id}/: response schema changed
   • ~ GET /v3/travel-rule/pickup/{token}/: param contact (query) added; response schema changed
   • ~ GET /v3/travel-rule/vasps/: response schema changed
   • ~ GET /v3/travel-rule/vasps/{vasp_id}/: response schema changed
   • ~ GET /v3/travel-rule/wallet-addresses/: response schema changed
   • ~ GET /v3/webhook/destinations/: response schema changed
   • ~ GET /v3/webhook/destinations/{destination_uuid}/: response schema changed
   • ~ GET /v3/workflows/{settings_uuid}/: response schema changed
   • ~ PATCH /v3/businesses/{vendor_data}/: request body changed
   • ~ PATCH /v3/businesses/{vendor_data}/update-status/: request body changed
   • ~ PATCH /v3/customization/: request body changed; response schema changed
   • ~ PATCH /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/: request body changed; response schema changed
   • ~ PATCH /v3/session/{sessionId}/bulk-update-aml-hit-status/: response schema changed
   • ~ PATCH /v3/session/{sessionId}/features/{nodeId}/update-status/: request body changed; response schema changed
   • ~ PATCH /v3/session/{sessionId}/update-aml-hit-status/: response schema changed
   • ~ PATCH /v3/session/{sessionId}/update-status/: response schema changed
   • ~ PATCH /v3/transactions/{transaction_id}/travel-rule/: request body changed; response schema changed
   • ~ PATCH /v3/users/{vendor_data}/: request body changed
   • ~ PATCH /v3/users/{vendor_data}/update-status/: request body changed
   • ~ PATCH /v3/webhook/destinations/{destination_uuid}/: request body changed; response schema changed
   • ~ PATCH /v3/workflows/{settings_uuid}/: response schema changed
   • ~ POST /v1/transactions/: response schema changed
   • ~ POST /v3/kyb/search/: request body changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/bulk/status/: request body changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/approve/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/assign/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/escalate/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/reject-approval/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/reopen/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/request-info/: response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/resolve/: request body changed; response schema changed
   • ~ POST /v3/organization/{organization_id}/application/{application_id}/cases/{case_uuid}/transfer/: response schema changed
   • ~ POST /v3/session/: response schema changed
   • ~ POST /v3/session/import-shared/: response schema changed
   • ~ POST /v3/session/{sessionId}/resubmission-preview/: request body changed; response schema changed
   • ~ POST /v3/sessions/delete/: request body changed
   • ~ POST /v3/transactions/: request body changed; response schema changed
   • ~ POST /v3/transactions/{transaction_id}/travel-rule/ownership/: response schema changed
   • ~ POST /v3/travel-rule/inbound/: request body changed; response schema changed
   • ~ POST /v3/travel-rule/pickup/{token}/respond/: param contact (query) added; request body changed; response schema changed
   • ~ POST /v3/travel-rule/wallet-addresses/: request body changed; response schema changed
   • ~ POST /v3/users/create/: request body changed; response schema changed
   • ~ POST /v3/wallet-screening/: request body changed
   • ~ POST /v3/webhook/destinations/: response schema changed
   • ~ POST /v3/workflows/: response schema changed
   • New endpoint DELETE /v3/events/{event_uuid}/delete/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint DELETE /v3/lists/{list_uuid}/
   • New endpoint DELETE /v3/lists/{list_uuid}/entries/{entry_uuid}/
   • New endpoint DELETE /v3/travel-rule/counterparty-contacts/{contact_uuid}/
   • New endpoint GET /v3/aml/dataset-freshness/

   +5 more show less

   • New endpoint GET /v3/blocklist/
   • New endpoint GET /v3/events/
   • New endpoint GET /v3/events/enrichment-metrics/
   • New endpoint GET /v3/events/subjects/{vendor_data}/
   • New endpoint GET /v3/events/{event_uuid}/

   10 details in Everything

5. changelog Oct 23, 2026 · issue 118

   Batch Session Delete gains async job polling, delete_all with filter_* narrowing, and child-verification counts in results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Bulk-delete all failed sessions older than a given date and poll the background job until it finishes.
   copy

   $ # 1. Trigger filtered bulk deletion
   curl -X POST https://api.didit.me/sessions/batch-delete \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"delete_all": true, "filter_status": "FAILED", "filter_date_from": "2026-01-01"}'
   
   # 2. Poll the returned job until COMPLETED or FAILED
   curl https://api.didit.me/sessions/deletion-jobs/<job_id> \
     -H 'Authorization: Bearer <token>'

   └──▷ BREAKING ON UPGRADE

   • !Queued webhook deliveries and their retries for a deleted session are now dropped; previously the changelog stated they would still arrive after deletion.
6. updated seen Oct 23, 2026 · issue 117

   Didit adds async batch-delete jobs, filtered select-all deletion, and child-verification counts in deletion results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Purge all failed sessions in bulk and poll until the background job finishes — useful for large compliance-driven data-deletion runs.
   copy

   $ # Step 1: Kick off the filtered select-all deletion
   curl -X POST https://api.didit.me/management-api/sessions/batch-delete \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"delete_all": true, "filter_status": "FAILED"}'
   # Returns 202 with a deletion job ID
   
   # Step 2: Poll until COMPLETED or FAILED
   curl https://api.didit.me/management-api/sessions/get-deletion-job/<job_id> \
     -H 'Authorization: Bearer <token>'

   • Adds async deletion job workflow: Batch Delete Sessions returns HTTP 202 when more than 20 sessions match, and callers poll Get Session Deletion Job until the job reports COMPLETED or FAILED.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds delete_all: true to Batch Delete Sessions to delete every session matching a filter set, narrowed with filter_-prefixed parameters (e.g. filter_status, filter_date_from) mirroring the List Sessions filters — invalid or unreadable filter values are rejected before any deletion begins.
   • Deletion results now include deleted_child_verifications, reporting how many key-person and company verifications were deleted as children of a business verification.
   • Adds async deletion job workflow: Batch Delete Sessions returns HTTP 202 when more than 20 sessions match, and callers poll Get Session Deletion Job until the job reports COMPLETED or FAILED.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

7. 3.0.0 Oct 22, 2026 · issue 116

   API surface changed: 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ~ DELETE /v3/travel-rule/wallet-addresses/{entry_uuid}/: response schema changed
   • ~ GET /v3/session/{sessionId}/decision/: response schema changed
   • ~ GET /v3/transactions/: param travel_rule_status (query) added; response schema changed
   • ~ GET /v3/travel-rule/wallet-addresses/: response schema changed
   • ~ PATCH /v3/transactions/{transaction_id}/travel-rule/: response schema changed
   • ~ PATCH /v3/travel-rule/wallet-addresses/{entry_uuid}/: response schema changed
   • ~ POST /v1/transactions/: response schema changed
   • ~ POST /v3/kyb/search/: response schema changed
   • ~ POST /v3/transactions/: response schema changed
   • ~ POST /v3/transactions/{transaction_id}/travel-rule/ownership/: request body changed; response schema changed
   • ~ POST /v3/travel-rule/inbound/: response schema changed
   • ~ POST /v3/travel-rule/pickup/{token}/respond/: response schema changed
   • ~ POST /v3/travel-rule/wallet-addresses/: response schema changed
   • ~ POST /v3/travel-rule/widget-session/: request body changed; response schema changed
   • GET /v3/transactions/: param travel_rule_status (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

8. updated seen Oct 21, 2026 · issue 115

   Didit adds KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. data tiers, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows./monitoring APIs, digital-ID wallet production launch, Face Search toggle, iGaming TM presets, and Copilot undo/slash skills.

   • Updated integrationAdds POST /v3/users/aml-monitoring/ and POST /v3/businesses/aml-monitoring/ to toggle ongoing AML monitoring for up to 1,000 profiles at a time, with dry-run and async batch support.
   • New integrationAdds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ for three-tier KYB registry data (Lite, Shareholders, UBOs) with per-response tier confirmation.
   • Adds GET /v3/users/{vendor_data}/generate-pdf/ to return a branded PDF of a user's 20 most recent completed sessions.
   • Adds sandbox_scenario on POST /v3/aml/ to simulate AML hits in sandbox without an end-user session.
   • Exposes workflow_terminal_node_id on the decision API via include=events to show which node ended a session.

   +7 more show less

   • Adds face_search_enabled switch on Liveness and Age Estimation Rules tabs to toggle Face Search per workflow.
   • Adds skip_liveness_and_face_match per-country switch to control whether liveness and face match run after a database lookup.
   • New detectionAdds detected_codes field to Proof of Address and Document AI results for QR codes and barcodes found on documents.
   • New compliance frameworkAdds iGaming rule presets to the Transaction Monitoring rules library (bonus abuse, chip dumping) and current-value velocity filters.
   • Adds Didit Copilot slash-skill templates and undo capability with a per-turn change card.
   • Adds SMS sender name field in a new SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. tab under Customization for branded verification-code messages.
   • Deprecates X-Signature-Simple; webhook verification moves to X-Signature-V2.

   12 details in Everything

   • New integration Digital-ID wallet integrations: MitID, Finnish Trust Network, Smart-ID, Mobile-ID, BankID Sweden
   • New detection Document liveness scoring (portrait replacement, printed copy, screen replay) on every decision API result
   • New detection Emulated/virtualized device detection for liveness captures
   • New detection Workflow branch contradiction validation flags routing errors before publish
   • New integration Didit MCP tools for session explanation and webhook management
   └──▷ BREAKING ON UPGRADE

   • !X-Signature-Simple is deprecated — verify webhooks with X-Signature-V2 instead.
9. 3.0.0 Oct 19, 2026 · issue 113

   API surface changed: +18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /v3/travel-rule/vasps/{vasp_id}/decision/
   • + GET /v3/session/{sessionId}/signatures/{nodeId}/documents/{documentId}/file/
   • + GET /v3/session/{sessionId}/signatures/{nodeId}/evidence/
   • + GET /v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/
   • + GET /v3/transactions/{transaction_id}/travel-rule/messages/
   • + GET /v3/travel-rule/pickup/{token}/messages/
   • + GET /v3/travel-rule/vasps/{vasp_id}/
   • + GET /v3/travel-rule/vasps/{vasp_id}/decision/
   • + GET /v3/travel-rule/vasps/{vasp_id}/questionnaires/
   • + GET /v3/travel-rule/vasps/{vasp_id}/screening/
   • + GET /v3/travel-rule/widget/{token}/vasps/
   • + POST /v3/session/{sessionId}/signatures/{nodeId}/validate/
   • + POST /v3/transactions/{transaction_id}/travel-rule/messages/
   • + POST /v3/travel-rule/pickup/{token}/messages/
   • + POST /v3/travel-rule/settings/compliance-email/confirmation/
   • + POST /v3/travel-rule/vasps/{vasp_id}/questionnaires/
   • + POST /v3/travel-rule/vasps/{vasp_id}/screening/
   • + PUT /v3/travel-rule/vasps/{vasp_id}/decision/
   • ~ GET /v1/transactions/{transaction_id}/: response schema changed
   • ~ GET /v3/session/{sessionId}/decision/: response schema changed
   • ~ GET /v3/transactions/{transaction_id}/: response schema changed
   • ~ GET /v3/travel-rule/settings/: response schema changed
   • ~ GET /v3/travel-rule/vasps/: param jurisdiction (query) added; param kind (query) added; param network (query) added; param reachable (query) added; param responsiveness (query) added; param risk (query) added; response schema changed
   • ~ GET /v3/travel-rule/widget/{token}/: response schema changed
   • ~ PATCH /v3/transactions/{transaction_id}/travel-rule/: response schema changed
   • ~ PATCH /v3/workflows/{settings_uuid}/: request body changed
   • ~ POST /v1/transactions/: response schema changed
   • ~ POST /v3/email/send/: response schema changed
   • ~ POST /v3/session/: request body changed
   • ~ POST /v3/transactions/: response schema changed
   • ~ POST /v3/transactions/{transaction_id}/travel-rule/ownership/: response schema changed
   • ~ POST /v3/travel-rule/inbound/: response schema changed
   • ~ POST /v3/workflows/: request body changed
   • ~ PUT /v3/travel-rule/settings/: request body changed; response schema changed
   • New endpoint DELETE /v3/travel-rule/vasps/{vasp_id}/decision/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint GET /v3/session/{sessionId}/signatures/{nodeId}/documents/{documentId}/file/
   • New endpoint GET /v3/session/{sessionId}/signatures/{nodeId}/evidence/
   • New endpoint GET /v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/
   • New endpoint GET /v3/transactions/{transaction_id}/travel-rule/messages/

   +5 more show less

   • New endpoint GET /v3/travel-rule/pickup/{token}/messages/
   • New endpoint GET /v3/travel-rule/vasps/{vasp_id}/
   • New endpoint GET /v3/travel-rule/vasps/{vasp_id}/decision/
   • New endpoint GET /v3/travel-rule/vasps/{vasp_id}/questionnaires/
   • New endpoint GET /v3/travel-rule/vasps/{vasp_id}/screening/

   10 details in Everything

10. 3.0.0 Oct 11, 2026 · issue 102

    API surface changed: +1 endpoint, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +1 endpoint, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + GET /v3/sessions/delete/{job_id}/
    • ~ DELETE /v3/session/{sessionId}/delete/: response schema changed
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/: response schema changed
    • ~ POST /v3/kyb/select/: response schema changed
    • ~ POST /v3/kyb/shareholders/: response schema changed
    • ~ POST /v3/kyb/ubo/: response schema changed
    • ~ POST /v3/sessions/delete/: response schema changed
    • ~ POST /v3/transactions/: request body changed
    • ~ POST /v3/wallet-screening/: request body changed
    • New endpoint GET /v3/sessions/delete/{job_id}/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

11. announced Oct 10, 2026 · issue 103
    • New integration Vietnam CCCD / thẻ căn cước NFC chip verification
    • New supported platform Vietnam identity card (CCCD / 2024 thẻ căn cước) document support
12. docs update Oct 8, 2026 · issue 097

    Didit adds scoped API keys with per-resource access, IP allowlists, workflow limits, and a 24-hour rotation overlap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Create a read-only partner key locked to approved sessions of one workflow and a specific IP range — so your payout provider can only read results it is entitled to see.
    📍In the Business Console, go to Developers -> API keys and click Create key. 1. Name: payout-provider 2. Preset: Read only 3. Under Resources, set Media to None (URLs will return null) 4. Under Limits, enable Only approved sessions, set Workflows to your payout workflow ID, and add the provider's IP range (e.g. 203.0.113.0/24) 5. Set Expiry to 90 days 6. Review the access summary, then copy the secret into your secrets manager — it is shown only once.
    • Adds named API keys alongside the primary secret, each scoped to specific resources (Sessions, Decisions, Media, People, Companies, Transactions, Workflows, Webhooks, Application settings, Analytics, API keys) with None, Read, or Write granularity per resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports three access presets — Full access, Read only, and Custom — selectable at key creation and editable later without redeploying (new access applies within one minute).
    • Introduces an Only approved sessions limit that hides declined, in-review, and unfinished sessions from a key.
    • Supports key expiry set to never, 30 days, 90 days, one year, or a custom date (expired keys stop working at end of that UTC day).
    • Adds key rotation with a 24-hour overlap window so the old secret remains valid while the new one is deployed, including for the primary secret.

    +6 more show less

    • A key without Media read receives session decisions with all image, video, and PDF URLs set to null.
    • A key without Sessions write receives null for a session's verification link and session token.
    • Exposes per-key usage analytics: request counts over the last 30 days, error rate, latency, and recent requests with status codes including limit-refused calls.
    • Every API key call appears in the organization's audit logs attributed to the named key that made it.
    • Key management is gated on an API keys permission (read to view, write to create/edit/rotate/revoke), integrated with Didit's roles-and-permissions system.
    • Keys are accessible in the Business Console under Developers -> API keys with status, 30-day request count, creator, access scope, and last-used time per key.

    11 details in Everything

13. docs update Oct 8, 2026 · issue 097

    Didit blocklist now covers document-capture selfies separately, including sessions where users stopped before liveness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Blocklist a user who abandoned the flow before reaching the liveness step by selecting their document-capture selfie.
    📍In the console, open the session, click Add to blocklist, then select the front-camera document-capture selfie(s) shown — each displayed with its picture and capture origin.
    • Enables blocklisting of selfies captured by the front camera during document capture — not just the liveness selfie — so users who abandon before the liveness step can still be flagged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds FRONT_CAMERA_FACE_IN_BLOCKLIST and POSSIBLE_FRONT_CAMERA_FACE_IN_BLOCKLIST result codes: new sessions compare each document-capture selfie against the blocklist at document evaluation time, with the latter indicating a near match routed to review.
    • Extends blocklist matching so every blocklisted face (liveness or document-capture origin) is checked against both the liveness selfie and all document-capture selfies in new sessions.
    • Adds per-face selection UI in the console: open a session, choose Add to blocklist, and pick individual faces shown with their picture and capture origin.
    • Enables blocklisting of selfies captured by the front camera during document capture — not just the liveness selfie — so users who abandon before the liveness step can still be flagged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds FRONT_CAMERA_FACE_IN_BLOCKLIST and POSSIBLE_FRONT_CAMERA_FACE_IN_BLOCKLIST result codes: new sessions compare each document-capture selfie against the blocklist at document evaluation time, with the latter indicating a near match routed to review.

    2 more in Everything

14. docs update Oct 8, 2026 · issue 097

    Didit Networks gains PDF and CSV export, private team notes, and shared fraud-signal intelligence views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Export a network's full investigation record as a PDF for offline review or handoff to legal/compliance.
    📍In the network detail pane, click Download PDF in the detail header. The file includes review status, connected accounts (up to 500), source references (up to six per account), and shared signals — but excludes global intelligence and private notes.
    Pull the account list into a spreadsheet for bulk triage or further analysis.
    📍In the network detail pane, open the overflow menu on the Accounts view and choose Export CSV.
    Coordinate a fraud investigation with your team without leaking notes into shared intelligence.
    📍In the network detail header, open Notes and add your observations. Ensure team members have the read:networks permission to read notes and write:networks to contribute.
    • Adds Download PDF export for a network, covering review status, connected accounts, source references, and shared signals; account and signal lists are capped at 500 entries and the PDF excludes global intelligence and private notes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Export CSV via the overflow menu for the account list inside a network.
    • Adds a Notes panel in the network detail header for team-scoped investigation discussion; notes never enter shared intelligence, require read:networks to read and write:networks to add, and survive network merges.
    • Adds a Shared intelligence view inside network detail to surface aggregate fraud-signal evidence from your organization's sharing participation; participation is managed in Organization settings under Fraud signals.
    • Exposes six structured views inside the network detail pane: Overview, Connections, Accounts, Geography, Activity timeline, and Shared intelligence.

    +1 more show less

    • Introduces network signal types for cross-account linking: device fingerprint, IP address, document number, phone or email, physical address, and biometric face similarity.

    6 details in Everything

15. docs update Oct 8, 2026 · issue 097

    Didit manual review gains resubmission workflow with email preview, branding controls, and ?include=resubmissions on the Retrieve Session API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve a session including all earlier resubmission data to audit the full history of user check attempts.
    copy

    $ curl -X GET 'https://api.didit.me/sessions/<session_id>?include=resubmissions' \
      -H 'Authorization: Bearer <token>'

    Trigger a manual resubmission request from the console, preview the localized email before sending, and edit the recipient or checks if needed.
    📍1. Open the session in the Didit console and open the session status control. 2. Choose the resubmission action, then select Continue. 3. Select Preview to review recipient, sender, subject, and localized email content. 4. Optionally select Edit to change checks, recipient, or language and regenerate the preview. 5. Confirm to send the resubmission request email.
    • Adds ?include=resubmissions query parameter to the Retrieve Session API endpoint to return all earlier submission data alongside the current session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports multiple numbered resubmission requests on a single session, each preserving who requested it, why, and all prior check results under per-step submission tabs (Submission 2 · latest, Submission 1).
    • Adds email preview step before sending a resubmission request, showing recipient, sender, subject, and localized content — with white-label sessions using configured branding and verified sender.
    • Allows editing checks, recipient, or language after previewing before generating a fresh resubmission request, without altering the session or sending mail until confirmed.

    4 details in Everything

16. docs update Oct 8, 2026 · issue 097

    Didit: Supports optional per-key restrictions: limit to specific workflows, approved sessions only, an IP address allowlist, or an expiry date.

    └──▷ HOW TO FIND IT
    Issue a scoped key to a partner that needs read-only access to sessions and decisions, locked to their IP range — navigate in the Didit console to create and configure it.
    📍Developers -> API keys -> Create a new key -> set Sessions: read, Decisions: read, all others: none -> add IP allowlist -> set expiry date -> Save
    • Enables key rotation with a 24-hour overlap window, and immediate revocation of any scoped key.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Keys created before scoped access existed keep full access — they are not automatically downscoped on upgrade.
17. docs update Oct 8, 2026 · issue 097

    Didit launches an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://mcp.didit.me/mcp with 156 tools spanning sessions, workflows, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. checks, lists, cases, reports, and webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Hit the MCP health check to verify your self-hosted or cloud instance is reachable before wiring it into an agent.
    copy

    $ curl -s https://mcp.didit.me/healthz

    • Adds a stateless Streamable HTTP MCPStreamable HTTP MCPA transport variant of the Model Context Protocol (MCP) that carries tool-call messages over HTTP with optional streaming, letting cyber tools expose AI-callable functions without maintaining a persistent connection. server at POST https://mcp.didit.me/mcp with a public health check at GET https://mcp.didit.me/healthz, requiring no session affinity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Exposes 156 tools across sessions, workflows, standalone checks, transaction monitoring, lists, cases, reports, and webhooks for agent-driven automation.
    • Authenticates via OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. with PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. (Log in with Didit) — no API keys or secrets in config; headless stdio runs accept a user Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else..
    • Supports per-client MCP setup for Claude, Cursor, VS Code, Windsurf, and Zed, plus a self-hosting path.
    • Enables agents to screen wallets for AML risk and add them to a blocklist in a single workflow, and to register webhook destinations for status updates.

    5 details in Everything

18. changelog Oct 5, 2026 · issue 095

    Didit adds digital ID wallets, KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. data tiers, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. monitoring APIs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and a Web SDK 0.4.0 with transaction submission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Bulk-enable ongoing AML monitoring for up to 1,000 users in a single API call, with a dry run first to estimate scope.
    copy

    $ curl -X POST https://api.didit.me/v3/users/aml-monitoring/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"user_ids": ["u_1", "u_2", "u_3"], "monitoring": true, "dry_run": true}'

    Fetch a branded PDF audit report of a user's 20 most recent completed sessions for compliance evidence.
    copy

    $ curl -X GET 'https://api.didit.me/v3/users/<vendor_data>/generate-pdf/' \
      -H 'Authorization: Bearer <token>' \
      --output user_report.pdf

    Simulate an AML hit in sandbox to test your alert-handling workflow without a real end-user session.
    copy

    $ curl -X POST https://api.didit.me/v3/aml/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"session_id": "<session_id>", "sandbox_scenario": "hit"}'

    • Adds AML monitoring APIs (POST /v3/users/aml-monitoring/, /v3/businesses/aml-monitoring/) supporting batch operations for up to 1,000 profiles, with dry-run mode and async job support; adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for shareholder and UBOUBOuBlock Origin, a browser extension maintained by Raymond Hill that blocks ads and trackers using filter lists; cyber tools embed or reference it to strip unwanted content from web traffic or scraped pages. data; adds GET /v3/users/{vendor_data}/generate-pdf/ for branded session PDFs
    • Adds sandbox_scenario parameter to simulate AML hits in sandbox, workflow_terminal_node_id field to expose workflow decision paths, and X-Signature-V2 webhook verification header (deprecating X-Signature-Simple)
    • Adds Didit MCP tools for AI-agent-driven session debugging and workflow building: didit_session_explain_decision, didit_session_webhooks, didit_session_webhook_resend, didit_workflow_build_graph, didit_workflow_get_kyb_registry_catalog, plus webhook delivery management
    • Adds document_liveness scores (portrait replacement, printed copy, screen replay) to all decision API results, face_search_enabled switch to control Face Search per workflow, and skip_liveness_and_face_match per-country switch for government-register lookups that return portraits
    • Adds live digital ID wallet verification for MitID (Denmark), Finnish Trust Network (Finland), Smart-ID (Estonia, Latvia, Lithuania, Belgium), Mobile-ID (Estonia, Lithuania), and BankID Sweden; adds per-country source selection and on-demand wallet screening from the console

    +6 more show less

    • Adds Web SDK 0.4.0 features: submitTransaction() method for browser-based transaction monitoring with scoped tokens and device intelligence, plus wallet-ownership check support with callback reporting
    • Adds three-tier KYB registry data purchasing (Lite, Shareholders, UBOs) with per-country pricing; adds iGaming rule presets for Transaction Monitoring and current-value velocity filters
    • Adds workflow graph validation flagging contradicting branches, branch-on-document-subtype routing, and covered-critical-field warnings for obscured document fields
    • Adds detected_codes field surfacing QR/barcodes on documents, DOCUMENT_BACK_SIDE_NOT_AVAILABLE warning, and ongoing-monitoring evidence display on AML results
    • Adds ID document support: police ID cards (Argentina, Brunei, Colombia, Philippines), Alberta DL/ID (2026), Moldova DL (2026), NYC ID (2019), back-side capture for Brazilian/Thai DLs and Canadian passport Page B
    • Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. branding customization with sender name field and live preview; adds Web SDK modal support for Bosnian, Kazakh, Kyrgyz, and Albanian

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !X-Signature-Simple is deprecated — migrate webhook signature verification to X-Signature-V2.
19. changelog Oct 4, 2026 · issue 094

    Didit: Adds white-label branding to wallet sign-in pages, with Smart-ID and Mobile-ID running inside the same verification design.

    └──▷ TRY IT
    Simulate an AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. hit in sandbox to test your alert-handling logic without involving a real end-user session.
    copy

    $ curl -X POST https://api.didit.me/v3/aml/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"vendor_data": "test-user-42", "sandbox_scenario": "hit"}'

    • Adds per-country source selection for database lookups where more than one lookup source is available.
    • Adds session timeline display of each branch decision and terminal status node in workflow sessions.
    • Adds liveness video analysis option to decline a session outright (not only report) on non-live recordings.
    • Adds emulated/virtualized device detection during liveness capture as an actionable risk signal.
    • Adds retry control (one to five attempts, default one) for database lookups, counting only attempts the source actually answered.

    +6 more show less

    • Adds detailed per-field match breakdown to lookup results, showing what the user provided, what the source held, and whether it matched, plus source-error details.
    • Adds Copilot capability to switch organization or application, rename applications, duplicate/rename/archive/link workflows, open member/role/webhook/list dialogs, and block a user or download a session PDF.
    • Adds reply-language selection, Word and plain-text file attachment, and full conversation-history deletion to the Copilot.
    • Adds drag-and-drop attachment upload and self-service ticket closure (with reply-to-reopen) in the support console.
    • Adds sandbox environment label to transactions evaluated on sandbox applications in Transaction Monitoring.
    • Adds expanded currency picker listing every circulating currency in Transaction Monitoring, with per-currency decimal formatting in transaction PDFs.
    • Adds per-country source selection for database lookups where more than one lookup source is available.
    • Adds session timeline display of each branch decision and terminal status node in workflow sessions.
    • Adds emulated/virtualized device detection during liveness capture as an actionable risk signal.
    • Adds retry control (one to five attempts, default one) for database lookups, counting only attempts the source actually answered.
    • Adds detailed per-field match breakdown to lookup results, showing what the user provided, what the source held, and whether it matched, plus source-error details.

    +2 more show less

    • Adds drag-and-drop attachment upload and self-service ticket closure (with reply-to-reopen) in the support console.
    • Adds sandbox environment label to transactions evaluated on sandbox applications in Transaction Monitoring.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !X-Signature-Simple is deprecated — verify webhooks with X-Signature-V2 instead.
20. docs update Oct 4, 2026 · issue 094

    Didit adds canonical KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. registry ownership/shareholding schemas and expands phone OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. delivery to WhatsApp, SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels., Telegram, voice, RCSRCSRich Communication Services, a messaging protocol standard maintained by the GSMA that replaces SMS with richer features like read receipts, file transfer, and group chat over carrier or IP networks., Viber, and Zalo.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Send an OTP via WhatsApp with a branded SMS fallback name, so users in countries where WhatsApp is unavailable still receive a recognisable SMS.
    copy

    $ curl -X POST https://api.didit.me/v3/phone/send/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{
        "phone_number": "+14155550123",
        "options": {
          "preferred_channel": "whatsapp",
          "sms_sender_name": "Acme Bank",
          "use_white_label_customization": true
        }
      }'

    Poll the decision for a phone OTP session to get the final verification outcome and lifecycle events in a backend workflow.
    copy

    $ curl -X GET https://api.didit.me/v3/session/<request_id>/decision/ \
      -H 'x-api-key: <your-api-key>'

    Read canonical ownership tier and UBOUBOuBlock Origin, a browser extension maintained by Raymond Hill that blocks ads and trackers using filter lists; cyber tools embed or reference it to strip unwanted content from web traffic or scraped pages. shareholding from a KYB registry response without coupling to the raw, source-specific payload.
    copy

    $ curl -X GET https://api.didit.me/v3/session/<sessionId>/decision/ \
      -H 'x-api-key: <your-api-key>' \
      | jq '{
          tier_requested: .company.ownership.tier_requested,
          tier_delivered:  .company.ownership.tier_delivered,
          status:          .company.ownership.status,
          beneficial_owners: [.company.beneficial_owners[] | {name: .name, shareholding: .shareholding}]
        }'

    • Adds POST /v3/phone/send/ endpoint to send OTP codes via whatsapp (default), sms, telegram, voice, rcs, viber, or zalo, with automatic SMS fallback when the preferred channel is unavailable for the destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds options.preferred_channel field on phone-send requests to select the OTP delivery channel.
    • Adds options.sms_sender_name field (1–30 chars, max 30) to sign a specific SMS with a custom sender name instead of the application default, allowing up to two new names per day per application.
    • Adds options.use_white_label_customization boolean field to fall back to the white-label public name when no SMS sender name is set.
    • Adds KYBRegistryOwnership schema exposing status, tier_requested, tier_delivered, and unavailable_reason for registry ownership lookups, available across all registry response shapes.

    +5 more show less

    • Adds KYBRegistryShareholding schema providing share_class, number_of_shares, currency, nominal_value, total_value, and percentage (to four decimal places) in a single canonical shape across all countries and registry sources.
    • Adds KYBRegistryAddress schema normalising every registry-stated address — including type, full_address, street, city, postal_code, region, and country_code — into one shape regardless of country or source.
    • Adds KYBRegistryIndustry schema normalising company activity classifications across UK SIC 2007, US SIC, NACE Rev. 2, NACE Rev. 2.1, NAF Rev. 2, CNAE, SBI, NOGA 2008, CAE Rev. 4, Canada SIC 1977, and other national systems, with code, description, scheme, and is_primary fields.
    • Adds registry_tier fields (basic, shareholders, or ubo) on KYB registry responses, mirrored in ownership.tier_requested and ownership.tier_delivered.
    • Phone verification sessions are now persisted as API-type sessions: request_id is a real session ID usable with GET /v3/session/{sessionId}/decision/, visible in the Business Console, and triggering status.updated webhooks.
    • Adds POST /v3/phone/send/ endpoint to send OTP codes via whatsapp (default), sms, telegram, voice, rcs, viber, or zalo, with automatic SMS fallback when the preferred channel is unavailable for the destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds options.preferred_channel field on phone-send requests to select the OTP delivery channel.
    • Adds options.sms_sender_name field (1–30 chars, max 30) to sign a specific SMS with a custom sender name instead of the application default, allowing up to two new names per day per application.
    • Adds options.use_white_label_customization boolean field to fall back to the white-label public name when no SMS sender name is set.
    • Adds KYBRegistryOwnership schema exposing status, tier_requested, tier_delivered, and unavailable_reason for registry ownership lookups, available across all registry response shapes.

    +4 more show less

    • Adds KYBRegistryShareholding schema providing share_class, number_of_shares, currency, nominal_value, total_value, and percentage (to four decimal places) in a single canonical shape across all countries and registry sources.
    • Adds KYBRegistryAddress schema normalising every registry-stated address — including type, full_address, street, city, postal_code, region, and country_code — into one shape regardless of country or source.
    • Adds KYBRegistryIndustry schema normalising company activity classifications across UK SIC 2007, US SIC, NACE Rev. 2, NACE Rev. 2.1, NAF Rev. 2, CNAE, SBI, NOGA 2008, CAE Rev. 4, Canada SIC 1977, and other national systems, with code, description, scheme, and is_primary fields.
    • Adds registry_tier fields (basic, shareholders, or ubo) on KYB registry responses, mirrored in ownership.tier_requested and ownership.tier_delivered.

    1 more in Everything

21. docs update Oct 4, 2026 · issue 094
    • New compliance framework EU AML Regulation (EU) 2024/1624 compliance guide
22. docs update Oct 2, 2026 · issue 092

    Didit: Deprecates X-Signature-Simple webhook verification header in favor of X-Signature-V2.

    └──▷ TRY IT
    Retrieve a full branded PDF history for a user to attach to a compliance case file, without opening the console.
    copy

    $ curl -X GET 'https://api.didit.me/v3/users/<vendor_data>/generate-pdf/' \
      -H 'Authorization: Bearer <token>' \
      --output user_history.pdf

    • Adds database-lookup (non-document) identity verification against government registers, credit bureaus, and other authoritative sources — no document photograph or upload required.
    • Adds per-country selfie-plus-portrait matching for government registers that return a photograph (South Africa, Nigeria, Argentina, Panama), included in the lookup price.
    • Adds Argentina lookup option without a selfie at the same price from the national register.
    • Adds Brazil lookup option using a source that confirms the selfie belongs to the CPF holder, with the verified selfie reused in a later Face Match step.
    • Adds AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. step capability to screen any person found by an earlier Document AI step, with per-step choice of which entity to screen.

    +2 more show less

    • Adds Didit Copilot change cards after workflow edits, with an Undo action to revert changes.
    • Adds slash-command skill templates ('/') in the Copilot composer, scoped to the current console page.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !X-Signature-Simple is deprecated — verify webhooks with X-Signature-V2 instead.
23. updated seen Oct 2, 2026 · issue 092

    Didit adds digital ID wallets, KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. data tiers, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. monitoring APIs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and expanded workflow controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve a user's branded session history PDF via API to attach to a compliance record or audit package
    copy

    $ curl -X GET 'https://api.didit.me/v3/users/<vendor_data>/generate-pdf/' \
      -H 'Authorization: Bearer <token>' \
      --output session-history.pdf

    Simulate an AML hit in sandbox to validate your alert-handling workflow before going live
    copy

    $ curl -X POST https://api.didit.me/v3/aml/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"vendor_data": "test-user-42", "sandbox_scenario": "hit"}'

    • Adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for standalone business ownership data; response names the tier requested and the tier delivered, with Lite as fallback when ownership data is unavailable⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v3/users/aml-monitoring/ and POST /v3/businesses/aml-monitoring/ to turn ongoing AML monitoring on or off for up to 1,000 profiles at a time, with a dry-run estimate mode and background job support for large batches
    • Adds GET /v3/users/{vendor_data}/generate-pdf/ to return a branded PDF of a user's 20 most recent completed sessions
    • Adds sandbox_scenario parameter on POST /v3/aml/ to simulate an AML hit in sandbox without an end-user session
    • Adds face_search_enabled switch on the Rules tabs for Liveness and Age Estimation steps to disable Face Search per workflow

    +33 more show less

    • Exposes workflow_terminal_node_id on the decision API with include=events to surface which branch path and terminal node ended a session
    • Adds document_liveness scores (portrait replacement, printed copy, screen replay) to every decision API result, even when no warning fired
    • Adds detected_codes field to Proof of Address and Document AI results, returning QR codes and barcodes found on the document
    • Adds DOCUMENT_BACK_SIDE_NOT_AVAILABLE informational warning to ID Verification results when only a front side could be collected
    • Adds submitTransaction() to the web SDK for submitting transactions for monitoring using a scoped transaction token, with automatic device intelligence collection
    • Adds defaultDocumentCamera, defaultLivenessCamera, showDocumentCameraSwitchButton and showLivenessCameraSwitchButton options to the JavaScript SDK for kiosk and operator-facing camera control; also available as query parameters liveness_camera=back and liveness_camera_switch=false
    • Adds didit_session_explain_decision MCP tool to trace why a session ended Approved, Declined or In Review
    • Adds didit_session_webhooks MCP tool to list a session's webhook deliveries and optionally wait for the first one, and didit_session_webhook_resend to resend a specific delivery
    • Adds didit_workflow_build_graph MCP tool to turn a plain feature list (with countries named exactly) into a complete, validated workflow graph
    • Adds didit_workflow_get_kyb_registry_catalog MCP tool to return registry tiers and prices per country
    • Adds per-country skip_liveness_and_face_match switch (on by default) to control whether liveness and face-match steps run after a database lookup
    • Introduces digital ID wallet verification in production: MitID (Denmark), Finnish Trust Network (Finland), Smart-ID (Estonia, Latvia, Lithuania, Belgium), Mobile-ID (Estonia, Lithuania), and BankID Sweden
    • Adds KYB data tiers — Lite, Shareholders, or UBOs — selectable per country in the KYB Registry Check step and in one-off checks, with price shown before selection
    • Adds branch-on-document-subtype routing in the workflow editor to route sessions on exact document subtypes (e.g. national ID card vs. residence permit)
    • Adds contradiction detection to the workflow editor: branches whose condition contradicts their destination node get a warning badge on the canvas and in the graph-validation API
    • Enables liveness video analysis to decline a session (not only report), and flags liveness captures from emulated or virtualized devices as an actionable risk
    • Adds a Same face, different document control to configure what happens when a face already approved on another identity document reappears
    • Adds covered-critical-field warning: a document whose number or another critical field is obscured raises a configurable warning, including on the standalone ID Verification API
    • Adds wallet screening as a single on-demand console check (now labelled Wallet Verification & Screening) without requiring a full session
    • Adds AML screening of any person named by an earlier Document AI step (e.g. from a tax certificate or articles of incorporation)
    • Adds iGaming rule presets (bonus abuse, chip dumping, and others) to the Transaction Monitoring rules library
    • Adds current-value velocity filters to Transaction Monitoring rule conditions
    • Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. sender name customization via the new SMS tab in Customization, with live preview
    • Adds Didit Copilot slash skills: type '/' in the composer to browse page-specific action templates
    • Adds undo for Copilot workflow edits: a change card lists what changed and Undo reverts it
    • Adds wallet-ownership check support to the web SDK: when a transaction requires a wallet-ownership check, the SDK runs it and reports completion via callback
    • Adds four additional modal languages to the web SDK: Bosnian, Kazakh, Kyrgyz, and Albanian
    • Adds webhook delivery listing and resend capability from the Didit MCP
    • Adds source selection per country in the Countries tab for non-document lookups where multiple sources exist (including Argentina without selfie and Brazil with verified selfie)
    • Adds support for Police ID cards from Argentina, Brunei, Colombia, and the Philippines
    • Adds Alberta driving licence and ID card (2026) with barcode validation, Moldova driving licence (2026), and NYC Identification Card (2019)
    • Adds back-side capture for Brazilian state driving licences, Thai driving licences, and Canadian passport Page B
    • Adds expired-document resubmission emails that specify the document expired, customizable via the Texts tab
    • Adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for standalone business ownership data; response names the tier requested and the tier delivered, with Lite as fallback when ownership data is unavailable⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v3/users/aml-monitoring/ and POST /v3/businesses/aml-monitoring/ to turn ongoing AML monitoring on or off for up to 1,000 profiles at a time, with a dry-run estimate mode and background job support for large batches
    • Adds GET /v3/users/{vendor_data}/generate-pdf/ to return a branded PDF of a user's 20 most recent completed sessions
    • Adds sandbox_scenario parameter on POST /v3/aml/ to simulate an AML hit in sandbox without an end-user session
    • Adds face_search_enabled switch on the Rules tabs for Liveness and Age Estimation steps to disable Face Search per workflow

    +29 more show less

    • Exposes workflow_terminal_node_id on the decision API with include=events to surface which branch path and terminal node ended a session
    • Adds document_liveness scores (portrait replacement, printed copy, screen replay) to every decision API result, even when no warning fired
    • Adds detected_codes field to Proof of Address and Document AI results, returning QR codes and barcodes found on the document
    • Adds DOCUMENT_BACK_SIDE_NOT_AVAILABLE informational warning to ID Verification results when only a front side could be collected
    • Adds submitTransaction() to the web SDK for submitting transactions for monitoring using a scoped transaction token, with automatic device intelligence collection
    • Adds defaultDocumentCamera, defaultLivenessCamera, showDocumentCameraSwitchButton and showLivenessCameraSwitchButton options to the JavaScript SDK for kiosk and operator-facing camera control; also available as query parameters liveness_camera=back and liveness_camera_switch=false
    • Adds didit_session_explain_decision MCP tool to trace why a session ended Approved, Declined or In Review
    • Adds didit_session_webhooks MCP tool to list a session's webhook deliveries and optionally wait for the first one, and didit_session_webhook_resend to resend a specific delivery
    • Adds didit_workflow_build_graph MCP tool to turn a plain feature list (with countries named exactly) into a complete, validated workflow graph
    • Adds didit_workflow_get_kyb_registry_catalog MCP tool to return registry tiers and prices per country
    • Adds per-country skip_liveness_and_face_match switch (on by default) to control whether liveness and face-match steps run after a database lookup
    • Introduces digital ID wallet verification in production: MitID (Denmark), Finnish Trust Network (Finland), Smart-ID (Estonia, Latvia, Lithuania, Belgium), Mobile-ID (Estonia, Lithuania), and BankID Sweden
    • Adds KYB data tiers — Lite, Shareholders, or UBOs — selectable per country in the KYB Registry Check step and in one-off checks, with price shown before selection
    • Adds branch-on-document-subtype routing in the workflow editor to route sessions on exact document subtypes (e.g. national ID card vs. residence permit)
    • Adds contradiction detection to the workflow editor: branches whose condition contradicts their destination node get a warning badge on the canvas and in the graph-validation API
    • Adds a Same face, different document control to configure what happens when a face already approved on another identity document reappears
    • Adds covered-critical-field warning: a document whose number or another critical field is obscured raises a configurable warning, including on the standalone ID Verification API
    • Adds wallet screening as a single on-demand console check (now labelled Wallet Verification & Screening) without requiring a full session
    • Adds AML screening of any person named by an earlier Document AI step (e.g. from a tax certificate or articles of incorporation)
    • Adds iGaming rule presets (bonus abuse, chip dumping, and others) to the Transaction Monitoring rules library
    • Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. sender name customization via the new SMS tab in Customization, with live preview
    • Adds Didit Copilot slash skills: type '/' in the composer to browse page-specific action templates
    • Adds undo for Copilot workflow edits: a change card lists what changed and Undo reverts it
    • Adds wallet-ownership check support to the web SDK: when a transaction requires a wallet-ownership check, the SDK runs it and reports completion via callback
    • Adds webhook delivery listing and resend capability from the Didit MCP
    • Adds source selection per country in the Countries tab for non-document lookups where multiple sources exist (including Argentina without selfie and Brazil with verified selfie)
    • Adds support for Police ID cards from Argentina, Brunei, Colombia, and the Philippines
    • Adds Alberta driving licence and ID card (2026) with barcode validation, Moldova driving licence (2026), and NYC Identification Card (2019)
    • Adds expired-document resubmission emails that specify the document expired, customizable via the Texts tab

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !X-Signature-Simple is deprecated — webhooks must now be verified with X-Signature-V2
24. changelog Sep 26, 2026 · issue 086

    Didit: Adds liveness_camera and liveness_camera_switch query parameters to the verification URL for controlling camera selection and switcher visibility when opening the flow directly without the SDK.

    └──▷ USE IT
    Lock a kiosk or operator-facing device to the rear camera for liveness capture and hide the in-capture switcher so the user cannot switch lenses.
    json copy

    {
      "defaultLivenessCamera": "back",
      "showLivenessCameraSwitchButton": false,
      "defaultDocumentCamera": "back",
      "showDocumentCameraSwitchButton": false
    }

    Open the verification URL directly with rear-camera liveness and the switcher disabled, without going through the SDK.
    copy

    $ https://verify.didit.me/session/<session_id>?liveness_camera=back&liveness_camera_switch=false

25. changelog Sep 25, 2026 · issue 085

    Web SDK 0.4.0 adds native camera-control options — defaultDocumentCamera, defaultLivenessCamera, and switcher-hide flags — plus matching URL query parameters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Apply the same rear-camera, no-switcher behaviour when opening the verification URL directly without the SDK.
    copy

    $ https://verify.didit.me/session/<session_id>?liveness_camera=back&liveness_camera_switch=false

    • Adds defaultDocumentCamera, defaultLivenessCamera, showDocumentCameraSwitchButton, and showLivenessCameraSwitchButton options to the Web SDK, bringing camera-control parity with the native SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

26. changelog Sep 24, 2026 · issue 084
    └──▷ TRY IT
    Open a direct verification URL with rear-camera liveness locked and the switcher disabled, for flows that don't use the SDK.
    copy

    $ https://verify.didit.me/session/<session_id>?liveness_camera=back&liveness_camera_switch=false

27. docs update Sep 24, 2026 · issue 084

    Didit adds Smart-ID and Mobile-ID as wallet-based identity verification methods for supported countries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable Smart-ID or Mobile-ID for a verification workflow and retain document capture as a fallback if the wallet sign-in fails.
    📍1. In the console, open your workflow and select the verification node. 2. Open the country editor and locate the target country. 3. Select Smart-ID or Mobile-ID only if it is shown as available. 4. Leave document capture enabled to serve as a fallback if wallet sign-in fails. 5. Choose the failure behaviour, then save and publish the workflow. 6. Start a new verification session with that workflow and inspect the completed session card to confirm the result.
    • Adds Smart-ID and Mobile-ID as wallet sign-in verification methods, selectable per workflow node in the console, with configurable fallback to document capture when wallet sign-in fails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

28. changelog Sep 23, 2026 · issue 083

    Didit: Adds liveness_camera and liveness_camera_switch (and equivalent document) query parameters for direct verification URLs, enabling the same camera control without going through the SDK.

    └──▷ USE IT
    Lock a kiosk or operator device to the rear camera for liveness capture and hide the switcher so the subject cannot flip to the front lens.
    javascript copy

    didit.init({
      defaultLivenessCamera: 'back',
      showLivenessCameraSwitchButton: false,
      defaultDocumentCamera: 'back',
      showDocumentCameraSwitchButton: false
    });

    Open the verification URL directly (without the SDK) and force rear-camera liveness with the switcher hidden.
    copy

    $ https://verify.didit.me/session/<session_id>?liveness_camera=back&liveness_camera_switch=false

29. changelog Sep 22, 2026 · issue 082

    Didit Web SDK 0.4.0 brings native camera-control options to the browser, including rear-camera and switcher-hide flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Open a verification session on the rear camera with the switcher hidden when linking users directly to the verification URL instead of using the SDK.
    copy

    $ https://verify.didit.me/session/<session_id>?liveness_camera=back&liveness_camera_switch=false

    • Adds defaultDocumentCamera and defaultLivenessCamera SDK options to the Web SDK, allowing the document and face-capture steps to open on the rear camera by default (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ for kiosk or operator-assisted flows).
    • Adds showDocumentCameraSwitchButton and showLivenessCameraSwitchButton SDK options to the Web SDK to hide the in-capture camera switcher and lock users to the chosen lens.
    • Adds defaultDocumentCamera and defaultLivenessCamera SDK options to the Web SDK, allowing the document and face-capture steps to open on the rear camera by default (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ for kiosk or operator-assisted flows).

    1 more in Everything

30. updated seen Sep 20, 2026 · issue 080

    Web SDK 0.4.0 gains camera control options; Mobile SDKs 4.8.0 add national ID-number lookup and digital ID wallet sign-in on native entry screens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Lock a kiosk or operator-facing device to the rear camera for liveness capture and hide the in-capture switcher so the user cannot switch lenses.
    copy

    $ https://verify.didit.me/session/<session-id>?liveness_camera=back&liveness_camera_switch=false

    • Adds defaultDocumentCamera, defaultLivenessCamera, showDocumentCameraSwitchButton, and showLivenessCameraSwitchButton options to the web SDK (@didit-protocol/sdk-web 0.4.0), matching the camera controls already available in native SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds liveness_camera and liveness_camera_switch query parameters to the direct verification URL for camera control without the SDK.
    • Adds national ID-number lookup and digital ID wallet sign-in as verification methods on the native SDK entry screen (iOS, Android, React Native, Flutter 4.8.0), with on-device field validation and optional fallback to document capture.

    3 details in Everything

31. docs update Sep 16, 2026 · issue 076

    Didit adds social-footprint add-on for email/phone risk APIs, document-liveness scores, PDF compliance reports, and expanded session event payloads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Download a compliance-ready PDF audit trail for an approved KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. session to attach to a SAR or archive after manual review.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/{sessionId}/generate-pdf/' \
      -H 'x-api-key: <your-api-key>' \
      --max-time 60 \
      -o session_report.pdf

    Retrieve full workflow routing history and cost breakdown for a KYC session to debug a branching decision in your verification workflow.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/{sessionId}/decision/?include=events' \
      -H 'x-api-key: <your-api-key>'

    • Adds enable_social: true request field to the Email Risk API endpoint to return an email_social block containing online-platform registrations, per-category counts, and profile details for a screened address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds enable_social: true request field to the Phone Risk API endpoint to return a phone_social block containing online-platform registrations, per-category counts, and profile details for a screened number.
    • Adds critical_field_occlusion_action parameter to the document-verification endpoint to control session outcome when a critical printed field (identity number, name, date of birth, or expiry date) is physically covered — defaults to Decline; REVIEW returns 400.
    • Adds document_or_personal_number_format_mismatch_action parameter to the document-verification endpoint to control outcome on DOCUMENT_NUMBER_FORMAT_MISMATCH / PERSONAL_NUMBER_FORMAT_MISMATCH warnings — defaults to NO_ACTION.
    • Adds GET /v3/session/{sessionId}/generate-pdf/ endpoint to render and download a compliance-ready PDF report for finished KYC sessions (Approved, Declined, In Review, Kyc Expired) and KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. sessions (Approved, Declined, In Review), covering all executed verification features.

    +5 more show less

    • Exposes compatibility alias email.enrichment alongside the existing email.email_intelligence field in Email Risk API responses; both keys carry identical normalized intelligence data.
    • Exposes compatibility alias phone.enrichment alongside the existing phone.phone_intelligence field in Phone Risk API responses; both keys carry identical normalized intelligence data.
    • Adds last_ongoing_screening_at and last_ongoing_screening_datasets_updated_at fields to AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows./ongoing-screening session data.
    • Adds date_of_birth_year (max 9999) and date_of_birth_month (max 12) fields to officer and beneficial-owner registry objects for partial birth-date reporting when the full date is unavailable.
    • Adds voting_min_shares and voting_max_shares fields to shareholder/beneficial-owner registry objects.
    • Adds enable_social: true request field to the Email Risk API endpoint to return an email_social block containing online-platform registrations, per-category counts, and profile details for a screened address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds enable_social: true request field to the Phone Risk API endpoint to return a phone_social block containing online-platform registrations, per-category counts, and profile details for a screened number.
    • Adds critical_field_occlusion_action parameter to the document-verification endpoint to control session outcome when a critical printed field (identity number, name, date of birth, or expiry date) is physically covered — defaults to Decline; REVIEW returns 400.
    • Adds document_or_personal_number_format_mismatch_action parameter to the document-verification endpoint to control outcome on DOCUMENT_NUMBER_FORMAT_MISMATCH / PERSONAL_NUMBER_FORMAT_MISMATCH warnings — defaults to NO_ACTION.
    • Adds GET /v3/session/{sessionId}/generate-pdf/ endpoint to render and download a compliance-ready PDF report for finished KYC sessions (Approved, Declined, In Review, Kyc Expired) and KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. sessions (Approved, Declined, In Review), covering all executed verification features.

    5 more in Everything

32. docs update Sep 15, 2026 · issue 075

    Manual review can now send localized email notifications with direct resume links and per-locale customizable wording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Customize the manual-review email copy for a specific locale so users see branded, translated messaging instead of the default text.
    📍In the console, go to White Label → Texts, select the target locale, and edit the manual-review notification strings (step reason labels and expired-document message).
    • Sends localized email notifications to users when manual review requests additional steps, including a direct link to resume and a per-step reason in the message body.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Detects when all requested steps are due to an expired document and replaces the generic retry prompt with a targeted message asking for a valid document.
    • Allows per-locale customization of notification wording via White Label → Texts in the console.

    3 details in Everything

33. docs update Sep 15, 2026 · issue 075

    Didit workflows gain flexible AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. Screening with custom field mapping, rich branch logic for metadata, and a session event audit trail via API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit exactly which branch a workflow took — and why a session landed in In Review — without opening the console.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/{id}/decision/?include=events' \
      -H 'Authorization: Bearer <token>'

    Gate approval on a US-state field only when it was actually sent at session creation — prevents an omitted key from silently passing a negative comparison.
    📍In the Console workflow editor, open the branching node, add a branch with conditions: 1. metadata.credential_state is not empty 2. metadata.credential_state not in [IL, MA, NJ] Set the fallback branch to In Review so sessions with an absent key are held for manual review.
    • Adds metadata.<key> as a first-class branch condition, letting workflows compare session-creation metadata against fixed values or other session fields (e.g. metadata.min_age <= Age), with numbers compared numerically so 18 and '18' behave identically.
    • Exposes full workflow routing history via GET /v3/session/{id}/decision/?include=events, returning a timeline of every branch decision, matched condition, next node, and outcome node — including fallback edges and the status node that set In Review.

    2 details in Everything

34. docs update Sep 15, 2026 · issue 075

    Didit adds email/phone risk intelligence endpoints, social footprint add-on, PDF report generation, and expanded session event data⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Download a compliance-ready PDF audit report for a finished KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. session to archive after a manual review decision.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/<sessionId>/generate-pdf/' \
      -H 'x-api-key: <your_api_key>' \
      --max-time 60 \
      -o session_report.pdf

    Retrieve full session event timeline and workflow routing history for a KYC session to reconstruct the exact decision path in your audit log.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/<sessionId>/decision/?include=events' \
      -H 'x-api-key: <your_api_key>'

    • Adds an email risk endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.; responds with email.enrichment (aliased as email.email_intelligence) and a top-level status of Approved, In Review, or Declined.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a phone risk endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTP; responds with phone.enrichment (aliased as phone.phone_intelligence) and a top-level status of Approved, In Review, or Declined.
    • Adds include=events query parameter to the session retrieval endpoint, expanding the response with the event timeline (events), activity log (activity_reviews), blocklist flags (blocklisted), per-session cost_breakdown, workflow metadata (workflow_type, workflow_version, workflow_version_id, workflow_terminal_node_id), and session metadata (api_service, session_type, has_device_nfc_support); limited to KYC sessions only.
    • Adds document_liveness object to session responses with portrait_replace, printed_copy, and screen_replay sub-scores (front, back, overall score, decline_threshold, review_threshold, and bucket) for document presentation-attack detection.
    • Exposes AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. screening full_name field minimum of 2 characters and identity_document_number golden-key matching (exact match overrides match_score to 100; valid range for provider filtering is 2–50 characters) in the standalone AML screening endpoint.
    • Adds an email risk endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.; responds with email.enrichment (aliased as email.email_intelligence) and a top-level status of Approved, In Review, or Declined.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a phone risk endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTP; responds with phone.enrichment (aliased as phone.phone_intelligence) and a top-level status of Approved, In Review, or Declined.
    • Adds document_liveness object to session responses with portrait_replace, printed_copy, and screen_replay sub-scores (front, back, overall score, decline_threshold, review_threshold, and bucket) for document presentation-attack detection.

    2 more in Everything

35. 3.0.0 Sep 14, 2026 · issue 074

    Didit: New endpoint GET /v3/users/{vendor_data}/generate-pdf/

    API change

    Didit: New endpoint GET /v3/users/{vendor_data}/generate-pdf/

    • + GET /v3/aml-monitoring/jobs/{job_id}/
    • + GET /v3/users/{vendor_data}/generate-pdf/
    • + POST /v3/businesses/aml-monitoring/
    • + POST /v3/users/aml-monitoring/
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ GET /v3/travel-rule/settings/: response schema changed
    • ~ PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/: response schema changed
    • ~ POST /v3/database-validation/: response schema changed
    • ~ POST /v3/email/check/: request body changed; response schema changed
    • ~ POST /v3/email/risk/: request body changed; response schema changed
    • ~ POST /v3/kyb/select/: response schema changed
    • ~ POST /v3/kyb/shareholders/: response schema changed
    • ~ POST /v3/kyb/ubo/: response schema changed
    • ~ POST /v3/phone/check/: request body changed; response schema changed
    • ~ POST /v3/phone/risk/: request body changed; response schema changed
    • ~ POST /v3/wallet-screening/: request body changed
    • ~ PUT /v3/travel-rule/settings/: request body changed; response schema changed
36. changelog Sep 14, 2026 · issue 074

    Didit: Adds Credential details to session results for digital-ID-wallet verifications: the wallet, its issuing authority, the level of assurance asserted, and whether the signature checked out

    └──▷ HOW TO FIND IT
    Enable non-document lookup for a specific country so users can verify with just their national ID number instead of uploading a document — useful for markets where lookup sources have high coverage.
    📍In the Didit console, open your workflow, select the ID Verification step, go to the Countries tab, choose the target country, and toggle the non-document lookup method on. Set the retry count (1–5) and choose a fallback action for each failure mode (partial match, no match, no source response).
    • Adds cost preview in the console: each lookup switch displays its billing rate before the configuration is saved

    1 detail in Everything

37. 3.0.0 Sep 13, 2026 · issue 073

    Didit: New endpoint GET /v3/users/{vendor_data}/generate-pdf/

    API change

    Didit: New endpoint GET /v3/users/{vendor_data}/generate-pdf/

    • + GET /v3/aml-monitoring/jobs/{job_id}/
    • + GET /v3/users/{vendor_data}/generate-pdf/
    • + POST /v3/businesses/aml-monitoring/
    • + POST /v3/users/aml-monitoring/
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ GET /v3/travel-rule/settings/: response schema changed
    • ~ PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/: response schema changed
    • ~ POST /v3/database-validation/: response schema changed
    • ~ POST /v3/email/check/: request body changed; response schema changed
    • ~ POST /v3/email/risk/: request body changed; response schema changed
    • ~ POST /v3/kyb/select/: response schema changed
    • ~ POST /v3/kyb/shareholders/: response schema changed
    • ~ POST /v3/kyb/ubo/: response schema changed
    • ~ POST /v3/phone/check/: request body changed; response schema changed
    • ~ POST /v3/phone/risk/: request body changed; response schema changed
    • ~ POST /v3/wallet-screening/: request body changed
    • ~ PUT /v3/travel-rule/settings/: request body changed; response schema changed
38. changelog Sep 13, 2026 · issue 073

    Didit adds non-document national ID lookup and digital ID wallet support to ID Verification, with per-country method controls and new assurance-tier fields on sessions, webhooks, and the decision API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable national ID-number lookup for a specific country so users in that country can verify without uploading a document — useful when reducing drop-off in markets with high government-register coverage.
    📍In the Didit console, open your workflow, select the ID Verification step, go to the Countries tab, find the target country, and toggle Non-document lookup on. Configure the failure-mode switches (partial match, no match, no source response) to either fall back to document capture or decline the session, then save.
    Upgrade the Web SDK to 4.8.0 to pick up the non-document lookup flow and the corrected SDK_VERSION constant in your CI pipeline.
    copy

    $ npm install @didit-protocol/sdk-web@latest

    • Adds status.updated webhook and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-country method controls via the Countries tab on the ID Verification step and through the API, letting you enable or disable document capture, national ID lookup, and digital ID wallets country by country.
    • Adds non-document national ID-number lookup: the user submits their national ID number and personal details, checked against an authoritative source (government register, credit bureau, or similar) with no photograph or upload required.
    • Adds configurable fallback behavior per non-document method failure mode (partial match, no match, no source response, cancelled or timed-out wallet sign-in) — each routes the user to document capture or declines the session.
    • Adds Digital ID wallet support on the roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, EUDI Wallet) — configurable in the console as Coming soon but not yet enabled for production.

    +4 more show less

    • Mobile SDKs 4.8.0 (iOS, Android, React Native, Flutter) surface ID Verification methods — national ID lookup and digital ID wallet sign-in — on a single entry screen alongside document capture, with on-device field validation before submission.
    • Adds SDK_VERSION constant to @didit-protocol/sdk-web, generated from the package version across all build formats and the TypeScript declaration.
    • Lookup retry count is configurable from one to five attempts (default two), with only source-answered attempts counted toward billing; format-invalid numbers never reach the source.
    • Embedded mode in the Web SDK uses the host element's content box instead of inheriting the modal height cap.
    • Adds status.updated webhook and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds per-country method controls via the Countries tab on the ID Verification step and through the API, letting you enable or disable document capture, national ID lookup, and digital ID wallets country by country.
    • Adds non-document national ID-number lookup: the user submits their national ID number and personal details, checked against an authoritative source (government register, credit bureau, or similar) with no photograph or upload required.
    • Adds configurable fallback behavior per non-document method failure mode (partial match, no match, no source response, cancelled or timed-out wallet sign-in) — each routes the user to document capture or declines the session.
    • Adds Digital ID wallet support on the roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, EUDI Wallet) — configurable in the console as Coming soon but not yet enabled for production.

    +1 more show less

    • Lookup retry count is configurable from one to five attempts (default two), with only source-answered attempts counted toward billing; format-invalid numbers never reach the source.

    3 more in Everything

39. docs update Sep 13, 2026 · issue 073

    Didit AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. Screening node gains flexible Screened entity field mapping for flows without ID Verification or KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. Registry steps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    When your AML screening flow is built around a Document AI step (e.g. a notarised deed) rather than an ID Verification step, configure the Screened entity tab to pull identity fields — including the automatically-detected full_name — into the screening node.
    📍In the workflow console, select your AML Screening node › open the Screened entity tab › set Entity type to person › under Field sources, map name to your Document AI field (e.g. full_name), date of birth to dob, and country to country_of_issue › set Incomplete screening data to Review › publish the workflow.
    • Adds a Screened entity tab to the AML Screening node so practitioners can map screening inputs (name, date of birth, country, document number) directly from Document AI fields, questionnaire answers, expected_details, or metadata — enabling AML screening on flows that use non-standardised documents such as tax certificates or notarised incorporation deeds instead of an ID Verification or KYB Registry step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an Entity type selector on the AML Screening node to screen either a person or a company named in an uploaded document, routing company searches against company records rather than people records.
    • Adds an Incomplete screening data control on the AML Screening node to configure behaviour when less than a full identity is available — defaulting to Review, with a No action option for flows that knowingly hold only a name.
    • Sandbox applications can now test every wallet in the catalog with simulated results, independent of production availability.
    • Adds a Screened entity tab to the AML Screening node so practitioners can map screening inputs (name, date of birth, country, document number) directly from Document AI fields, questionnaire answers, expected_details, or metadata — enabling AML screening on flows that use non-standardised documents such as tax certificates or notarised incorporation deeds instead of an ID Verification or KYB Registry step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

40. docs update Sep 13, 2026 · issue 073

    Didit: Surfaces the server-provided rejection reason to users when a questionnaire submission fails, replacing the previous generic error message.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

41. updated seen Sep 13, 2026 · issue 073

    Mobile SDKs 4.8.0 bring national ID-number lookup and digital ID wallet sign-in to iOS, Android, React Native, and Flutter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Improves questionnaire error messaging in mobile SDKs so users see the server-returned rejection reason instead of a generic failure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

42. docs update Sep 13, 2026 · issue 073

    Didit adds per-user PDF history export via UI button and GET /v3/users/{vendor_data}/generate-pdf/ API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Schedule a nightly compliance export of a specific user's full session history into your back-office system.
    copy

    $ curl -X GET 'https://api.didit.me/v3/users/{vendor_data}/generate-pdf/' \
      -H 'Authorization: Bearer <your_api_key>' \
      --output user_history.pdf

    • Adds GET /v3/users/{vendor_data}/generate-pdf/ API endpoint to pull a complete PDF history for a single user, authenticated with an API key, enabling scheduled compliance exports or back-office ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Download user history PDF button on the user detail page to download the same bundled PDF report from the console UI.
    • The exported PDF bundles a cover page (profile summary, feature status, session index) with the full standard report of every completed session for that user.

    3 details in Everything

43. docs update Sep 13, 2026 · issue 073

    Didit adds email/phone social-footprint lookups, PDF compliance report generation, and async KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. registry search with webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Download a compliance-ready PDF for a completed KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. session after a manual review decision, suitable for audit archiving.
    copy

    $ curl -X GET 'https://api.didit.me/v3/session/<sessionId>/generate-pdf/' \
      -H 'x-api-key: <your-api-key>' \
      --max-time 60 \
      -o session_report.pdf

    Trigger an async KYB registry search so your service is notified via webhook when slow registries finish, rather than blocking the request.
    copy

    $ curl -X POST https://api.didit.me/v3/kyb/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"company_name": "Acme Ltd", "kyb_registry": "GB", "webhook_url": "https://yourapp.example.com/webhooks/kyb"}'

    • Adds enable_social: true request field to email risk lookups to return an email_social block listing online platforms the address is registered on, with per-category counts and profile details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds compatibility aliases email.enrichment and phone.enrichment as normalized intelligence objects alongside the existing email.email_intelligence and phone.phone_intelligence fields — values are identical.
    • Adds GET /v3/session/{sessionId}/generate-pdf/ endpoint to render and download a compliance-ready PDF report for finished KYC or KYB verification sessions (eligible statuses: Approved, Declined, In Review, Kyc Expired).
    • Adds GET /v3/users/{vendor_data}/generate-pdf/ endpoint to render a single PDF covering every reportable session of one user.
    • Adds webhook_url field to KYB registry search (POST /v3/kyb/) to enable asynchronous mode, returning immediately and POSTing a kyb.registry_search.resolved callback (with header X-Didit-Unsigned-Callback: true) when the registry finishes.

    +2 more show less

    • Adds document_number field to AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. screening requests, acting as a golden key: an exact match overrides the hit's match_score to 100, and a mismatch penalizes it; sent to the screening provider as a filter only when 2–50 characters.
    • KYB registry search now exposes search_resolved and search_status fields in the response and callback body, and the async callback body includes event_id, event_type, request_id, vendor_data, metadata, kyb_registry, timestamp, and created_at.
    • Adds enable_social: true request field to email risk lookups to return an email_social block listing online platforms the address is registered on, with per-category counts and profile details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /v3/session/{sessionId}/generate-pdf/ endpoint to render and download a compliance-ready PDF report for finished KYC or KYB verification sessions (eligible statuses: Approved, Declined, In Review, Kyc Expired).
    • Adds GET /v3/users/{vendor_data}/generate-pdf/ endpoint to render a single PDF covering every reportable session of one user.
    • Adds webhook_url field to KYB registry search (POST /v3/kyb/) to enable asynchronous mode, returning immediately and POSTing a kyb.registry_search.resolved callback (with header X-Didit-Unsigned-Callback: true) when the registry finishes.
    • Adds document_number field to AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. screening requests, acting as a golden key: an exact match overrides the hit's match_score to 100, and a mismatch penalizes it; sent to the screening provider as a filter only when 2–50 characters.

    2 more in Everything

44. 3.0.0 Sep 12, 2026 · issue 072

    API surface changed: +3 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +3 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + GET /v3/aml-monitoring/jobs/{job_id}/
    • + POST /v3/businesses/aml-monitoring/
    • + POST /v3/users/aml-monitoring/
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ GET /v3/travel-rule/settings/: response schema changed
    • ~ PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/: response schema changed
    • ~ POST /v3/database-validation/: response schema changed
    • ~ POST /v3/email/check/: request body changed; response schema changed
    • ~ POST /v3/email/risk/: request body changed; response schema changed
    • ~ POST /v3/kyb/select/: response schema changed
    • ~ POST /v3/kyb/shareholders/: response schema changed
    • ~ POST /v3/kyb/ubo/: response schema changed
    • ~ POST /v3/phone/check/: request body changed; response schema changed
    • ~ POST /v3/phone/risk/: request body changed; response schema changed
    • ~ POST /v3/wallet-screening/: request body changed
    • ~ PUT /v3/travel-rule/settings/: request body changed; response schema changed
    • New endpoint GET /v3/aml-monitoring/jobs/{job_id}/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint POST /v3/businesses/aml-monitoring/
    • New endpoint POST /v3/users/aml-monitoring/

    3 details in Everything

45. changelog Sep 12, 2026 · issue 072

    Didit adds non-document identity lookup and per-country method controls, with verification method and assurance tier now returned on every session result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable non-document lookup for a specific country so users can verify without uploading a photo — useful for markets where document capture has high drop-off.
    📍In the console, open your workflow › ID Verification step › Countries tab. Find the target country, toggle Data match on, set the fallback for No match to Document capture or Decline, and set retries (1–5). Save — the console shows the per-lookup cost before you confirm.
    • Adds Data match (non-document lookup) as a new ID Verification method: users enter a national ID number and personal details, checked against government registers, credit bureaus, or utility/residential records — no photograph or upload required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Sessions, the decision API, and the status.updated webhook now carry the method that produced each ID Verification (document, Data match, or wallet) and its assurance tier (Documentary, Data match, or Cryptographic).
    • Adds Registry comparison result fields showing every compared field, the value the user provided, the value the source held, and whether it matched.
    • Adds per-country method controls via the Countries tab on the ID Verification step, toggleable through both the console and the API.
    • Where a government register returns a portrait (South Africa, Nigeria, Argentina, Panama), lookup automatically adds passive liveness and face match at no extra charge, allowing downstream Liveness and Face Match steps to be skipped.
    • Adds Data match (non-document lookup) as a new ID Verification method: users enter a national ID number and personal details, checked against government registers, credit bureaus, or utility/residential records — no photograph or upload required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Registry comparison result fields showing every compared field, the value the user provided, the value the source held, and whether it matched.
    • Adds per-country method controls via the Countries tab on the ID Verification step, toggleable through both the console and the API.
    • Where a government register returns a portrait (South Africa, Nigeria, Argentina, Panama), lookup automatically adds passive liveness and face match at no extra charge, allowing downstream Liveness and Face Match steps to be skipped.

    1 more in Everything

46. docs update Sep 12, 2026 · issue 072

    Didit adds social-footprint add-on for email/phone risk APIs, enable_social flag, and documents two-step KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. registry search-then-select flow with async webhook support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Kick off an async KYB company search and receive the resolved candidate list via webhook, avoiding long poll timeouts for slow registries.
    copy

    $ curl -X POST https://api.didit.me/v3/kyb/search/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"company_name": "Acme Ltd", "country": "GB", "webhook_url": "https://your-server.example.com/webhooks/kyb"}'

    Retrieve the full Lite registry profile for a candidate returned by a prior search, completing the two-step KYB flow.
    copy

    $ curl -X POST https://api.didit.me/v3/kyb/select/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"kyb_response_id": "<kyb_response_id-from-search>"}'

    • Adds enable_social: true request field to the Email Risk API endpoint to append an email_social block containing online platform registrations, per-category counts, and profile details for an email address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds enable_social: true request field to the Phone Risk API endpoint to append a phone_social block containing online platform registrations, per-category counts, and profile details for a phone number.
    • Exposes email.enrichment as a compatibility alias for email.email_intelligence on live Email Risk API responses so new integrations have a stable normalized field name.
    • Exposes phone.enrichment as a compatibility alias for phone.phone_intelligence on live Phone Risk API responses so new integrations have a stable normalized field name.
    • Adds officer and shareholder data fields to KYB responses including date_of_birth_year, date_of_birth_month, voting_min_shares, voting_max_shares, appointment/resignation dates, and registry-reported given/family names.

    +3 more show less

    • Documents government identity validation via services array (e.g. bra_cpf, arg_renaper, pan_cedula_sib) across 60+ countries, with a default single service per country when the array is omitted.
    • Enforces full_name minimum of 2 characters for screening requests, returning 400 before any screening runs (and before billing) when the value is shorter.
    • Documents id_document_number as a golden-key filter for screening: an exact match overrides match_score to 100, a hard mismatch penalizes it, and the value is forwarded to the screening provider only when it is 2–50 characters.
    • Adds enable_social: true request field to the Email Risk API endpoint to append an email_social block containing online platform registrations, per-category counts, and profile details for an email address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds enable_social: true request field to the Phone Risk API endpoint to append a phone_social block containing online platform registrations, per-category counts, and profile details for a phone number.
    • Documents government identity validation via services array (e.g. bra_cpf, arg_renaper, pan_cedula_sib) across 60+ countries, with a default single service per country when the array is omitted.

    5 more in Everything

47. docs update Sep 12, 2026 · issue 072

    Didit adds digital identity wallet support and a KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. Registry API with company search and profile endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for 22 digital identity wallets across multiple countries, including assurance levels, prerequisites, and attributes — distinct from crypto wallet screening.

    1 detail in Everything

48. changelog Sep 11, 2026 · issue 071

    Didit: Adds per-country method control via the Countries tab on the ID Verification step and through the API, letting operators toggle document capture, non-document lookup, and (future) digital ID wallets country by country.

    └──▷ TRY IT
    Upgrade the Web SDK to 0.3.1 to get the corrected SDK_VERSION export and viewport-tracking modal before running an automated integration check.
    copy

    $ npm install @didit-protocol/sdk-web@latest

    Navigate to the Countries tab in the console to enable non-document lookup for a specific country while keeping document capture as the fallback for failures.
    📍In the Didit console: open your workflow › ID Verification step › Countries tab › select the target country › toggle Non-document lookup ON › set No match and No response failure modes to Document capture › review the per-switch pricing shown › Save.
    • Adds non-document lookup as a live verification method — the user submits a national ID number and personal details, which are checked against the authoritative source (government register, credit bureau, or utility/residential records) for that country with no photograph or upload required.
    • Adds Registry comparison result block to sessions, exposing each compared field with the user-provided value, the source-held value, and match status, plus an error row when a source did not respond.
    • Adds Credential details result block to sessions for wallet verifications, showing the wallet, issuing authority, asserted level of assurance, and signature verification outcome.
    • Adds configurable retry count (one to five attempts, default two) for non-document lookups, counting only attempts the source actually answered.
    • Adds format pre-validation for lookup ID numbers — a number that fails the format check never reaches the source and is neither counted nor billed.

    +2 more show less

    • Adds real-time pricing display in the console — each failure-handling switch shows its cost before the configuration is saved.
    • Adds passive liveness and face-match to non-document lookups for countries where the government register returns a portrait (South Africa, Nigeria, Argentina, Panama), bundled into the lookup price.

    7 details in Everything

49. changelog Sep 10, 2026 · issue 070

    Didit adds non-document ID lookup and per-country method controls, with assurance tiers surfaced in the decision API and webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Upgrade the Web SDK to 0.3.1 to get the corrected SDK_VERSION and the embedded-mode sizing fix.
    copy

    $ npm install @didit-protocol/sdk-web@latest

    Enable non-document lookup for specific countries via the console so users in those countries can verify without uploading a document.
    📍In the console, open your workflow, select the ID Verification step, go to the Countries tab, find the target country row, and toggle Non-document lookup on. Set the per-failure-mode switches (partial match, no match, no response) to either Fall back to document capture or Decline session, then save.
    • Adds status.updated webhook payload fields and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Countries tab on the ID Verification step to toggle document capture, non-document lookup, and digital wallet methods on or off per country, with the same controls available through the API.
    • Adds Registry comparison result detail: every field comparison showing what the user provided, what the source held, and whether it matched, plus an error row when a source did not respond.
    • Adds Credential details result detail for wallet verifications: wallet identity, issuing authority, level of assurance asserted, and signature validity.
    • Adds SDK_VERSION export to @didit-protocol/sdk-web that now correctly reflects the installed package version in all build formats and TypeScript declarations.

    +4 more show less

    • Adds digital ID wallet method (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, EUDI Wallet) as a configurable option, surfaced as Coming soon in the console — not yet enabled for production users.
    • For lookup countries whose government register returns a portrait (South Africa, Nigeria, Argentina, Panama), the lookup automatically adds passive liveness and face-match — included in the lookup price — allowing downstream Liveness and Face Match workflow steps to be skipped.
    • Per non-document method, adds per-failure-mode switches (partial match, no match, no source response, wallet cancelled/timed out) that route the user to document capture or decline the session.
    • Lookup retry count is configurable from one to five attempts (default two); only attempts the source actually answered are counted and billed.
    • Adds status.updated webhook payload fields and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Countries tab on the ID Verification step to toggle document capture, non-document lookup, and digital wallet methods on or off per country, with the same controls available through the API.
    • Adds Registry comparison result detail: every field comparison showing what the user provided, what the source held, and whether it matched, plus an error row when a source did not respond.
    • Adds Credential details result detail for wallet verifications: wallet identity, issuing authority, level of assurance asserted, and signature validity.
    • Adds digital ID wallet method (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, EUDI Wallet) as a configurable option, surfaced as Coming soon in the console — not yet enabled for production users.

    +3 more show less

    • For lookup countries whose government register returns a portrait (South Africa, Nigeria, Argentina, Panama), the lookup automatically adds passive liveness and face-match — included in the lookup price — allowing downstream Liveness and Face Match workflow steps to be skipped.
    • Per non-document method, adds per-failure-mode switches (partial match, no match, no source response, wallet cancelled/timed out) that route the user to document capture or decline the session.
    • Lookup retry count is configurable from one to five attempts (default two); only attempts the source actually answered are counted and billed.

    1 more in Everything

50. docs update Sep 10, 2026 · issue 070

    Didit adds email and phone risk intelligence endpoints with social-footprint add-on, plus expanded KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. registry search and select APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Search company registries by name as step 1 of KYB, then retrieve the full Lite profile of the top candidate using its ephemeral kyb_response_id.
    copy

    $ # Step 1 — search
    curl -X POST https://api.didit.me/v3/kyb/search/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"name": "Acme Corp", "country": "GB"}'
    
    # Step 2 — select (use kyb_response_id from search response)
    curl -X POST https://api.didit.me/v3/kyb/select/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"kyb_response_id": "<kyb_response_id>"}'

    Run an async KYB registry search and receive results via webhook when the registry resolves, avoiding long polling in your integration.
    copy

    $ curl -X POST https://api.didit.me/v3/kyb/search/ \
      -H 'x-api-key: <your-api-key>' \
      -H 'Content-Type: application/json' \
      -d '{"name": "Acme Corp", "country": "DE", "webhook_url": "https://yourapp.example.com/webhooks/kyb"}'

    • Adds an email risk intelligence endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk signals via x-api-key authentication without sending an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.; set enable_social to true to include an email_social block listing platforms the address is registered on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a phone risk intelligence endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk signals without sending an OTP; set enable_social to true to include a phone_social block listing platforms the number is registered on.
    • Exposes normalized intelligence objects under both email.email_intelligence / email.enrichment and phone.phone_intelligence / phone.enrichment as compatibility aliases — new integrations should read email.enrichment and phone.enrichment.
    • Adds POST /v3/kyb/search/ to search official company registries by name and/or registration number, returning lightweight candidates with fetch_status: "pending"; supports synchronous (default) and asynchronous modes via webhook_url, with a kyb.registry_search.resolved callback.
    • Adds POST /v3/kyb/select/ to retrieve the Lite registry profile of a candidate using its ephemeral kyb_response_id, including company details, registered address, identifiers, status, activity, officers, and raw registry payload.

    +6 more show less

    • Adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for shareholder and ultimate beneficial owner data, sold separately from the Lite profile.
    • Surfaces officer and beneficial-owner birth data as structured fields (date_of_birth_year, date_of_birth_month) alongside the full date_of_birth, with explicit nullability rules when only partial dates are available.
    • Adds voting_min_shares and voting_max_shares fields to officer/shareholder records.
    • Adds registry filing date fields including last_annual_return_date and last_agm_date, distinct from financial accounts.
    • Adds full_name minimum-length validation (2 characters) for AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows./sanctions screening, returning 400 on the field before any screening runs so nothing is billed on short input.
    • Adds document_number as a screening filter field: an exact match overrides match_score to 100; a hard mismatch penalizes it; values outside 2–50 characters are stored but do not narrow the provider search.
    • Adds an email risk intelligence endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk signals via x-api-key authentication without sending an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.; set enable_social to true to include an email_social block listing platforms the address is registered on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a phone risk intelligence endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk signals without sending an OTP; set enable_social to true to include a phone_social block listing platforms the number is registered on.
    • Exposes normalized intelligence objects under both email.email_intelligence / email.enrichment and phone.phone_intelligence / phone.enrichment as compatibility aliases — new integrations should read email.enrichment and phone.enrichment.
    • Adds POST /v3/kyb/search/ to search official company registries by name and/or registration number, returning lightweight candidates with fetch_status: "pending"; supports synchronous (default) and asynchronous modes via webhook_url, with a kyb.registry_search.resolved callback.
    • Adds POST /v3/kyb/select/ to retrieve the Lite registry profile of a candidate using its ephemeral kyb_response_id, including company details, registered address, identifiers, status, activity, officers, and raw registry payload.

    +5 more show less

    • Adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for shareholder and ultimate beneficial owner data, sold separately from the Lite profile.
    • Surfaces officer and beneficial-owner birth data as structured fields (date_of_birth_year, date_of_birth_month) alongside the full date_of_birth, with explicit nullability rules when only partial dates are available.
    • Adds voting_min_shares and voting_max_shares fields to officer/shareholder records.
    • Adds registry filing date fields including last_annual_return_date and last_agm_date, distinct from financial accounts.
    • Adds document_number as a screening filter field: an exact match overrides match_score to 100; a hard mismatch penalizes it; values outside 2–50 characters are stored but do not narrow the provider search.

    1 more in Everything

51. docs update Sep 10, 2026 · issue 070

    Didit adds company registry search by name, registration number, and country to its API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

52. docs update Sep 10, 2026 · issue 070

    Didit adds KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. Registry API with company search and Lite profile selection endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds POST /v3/kyb/search/ endpoint to search for companies by registry (up to $0.50 per successful search; empty results and failures are not charged)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v3/kyb/select/ endpoint to retrieve a Lite profile — company details and officers — for a selected company ($2.00 per selected company, billed separately from search)

    2 details in Everything

53. changelog Sep 9, 2026 · issue 069

    Didit: Exposes verification method and assurance tier through the decision API and session objects; document sessions report documentary and leave new fields empty.

    └──▷ HOW TO FIND IT
    Enable non-document lookup for a specific country so users can verify with just their national ID number and personal details — no document photograph required.
    📍In the console, open your workflow, select the ID Verification step, go to the Countries tab, choose the target country, and toggle Non-document lookup on. Set the fallback for each failure mode (partial match, no match, no source response) to either Document capture or Decline session, then save.
    Upgrade the Web SDK so the modal no longer clips on short or landscape viewports and embedded mode fills your container correctly.
    copy

    $ npm install @didit-protocol/sdk-web@latest

    • Adds non-document lookup as a new ID Verification method — user supplies a national ID number and personal details checked against a government register or credit/financial/utility/residential-records source, with no photograph or upload required.
    • Adds per-country method controls on the Countries tab of the ID Verification step, toggling document capture, non-document lookup, and (future) digital ID wallets on or off per country; same settings available through the API.
    • Adds automatic selfie, passive liveness, and portrait matching to non-document lookups for countries whose government register returns a photograph (South Africa, Nigeria, Argentina, Panama), included in the lookup price.
    • Adds configurable fallback behavior for each non-document method failure mode (partial match, no match, no source response, cancelled/timed-out wallet sign-in) — each either sends the user to document capture or declines the session.
    • Adds retry configuration for non-document lookups: one to five attempts (default two), counting only attempts the source actually answered; format-check failures never reach the source and are not billed.

    +1 more show less

    • Embedded SDK mode now fills the host element's content box instead of inheriting the modal's height cap.
    • Adds non-document lookup as a new ID Verification method — user supplies a national ID number and personal details checked against a government register or credit/financial/utility/residential-records source, with no photograph or upload required.
    • Adds per-country method controls on the Countries tab of the ID Verification step, toggling document capture, non-document lookup, and (future) digital ID wallets on or off per country; same settings available through the API.
    • Adds automatic selfie, passive liveness, and portrait matching to non-document lookups for countries whose government register returns a photograph (South Africa, Nigeria, Argentina, Panama), included in the lookup price.
    • Adds configurable fallback behavior for each non-document method failure mode (partial match, no match, no source response, cancelled/timed-out wallet sign-in) — each either sends the user to document capture or declines the session.
    • Adds retry configuration for non-document lookups: one to five attempts (default two), counting only attempts the source actually answered; format-check failures never reach the source and are not billed.

    1 more in Everything

54. 3.0.0 Sep 7, 2026 · issue 067

    API surface changed: +2 endpoints, 4 modified

    API change

    API surface changed: +2 endpoints, 4 modified

    • + POST /v3/kyb/shareholders/
    • + POST /v3/kyb/ubo/
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ POST /v3/kyb/select/: response schema changed
    • ~ POST /v3/poa/: response schema changed
    • ~ POST /v3/users/delete/: request body changed
    • New endpoint POST /v3/kyb/shareholders/
    • New endpoint POST /v3/kyb/ubo/
    • GET /v3/session/{sessionId}/decision/: response schema changed
    • POST /v3/kyb/select/: response schema changed
    • POST /v3/poa/: response schema changed

    +1 more show less

    • POST /v3/users/delete/: request body changed

    6 details in Everything

55. docs update Sep 7, 2026 · issue 067

    Didit session view now highlights and decodes QR codes and barcodes found on scanned documents

    └──▷ HOW TO FIND IT
    When reviewing a document session, inspect a detected QR code or barcode — the location overlay and decoded payload appear separately from any document-manipulation warning highlights.
    📍In the Didit Console, open a verification session › navigate to the Document AI results › locate the QR/barcode overlay on the image or PDF preview to view the decoded payload, or note detected only if decoding failed.
    • Adds QR code and barcode review to the session view: Document AI highlights the code's location on the image or PDF preview and displays the decoded payload; codes that could not be decoded are shown as detected-only with no payload.

    1 detail in Everything

56. docs update Sep 7, 2026 · issue 067

    Didit adds per-country ID verification method controls with document, non-doc lookup, and digital wallet configuration

    • Adds document.enabled and documents_allowed config keys on the ID Verification node to control whether document capture is accepted and which document types are permitted per country.
    • Adds id_lookup.enabled, id_lookup.max_attempts, and id_lookup.skip_liveness_and_face_match config keys to control non-document lookup availability, attempt limits, and whether Liveness and Face Match steps are bypassed after a portrait-backed match.
    • Adds id_lookup.on_partial_match, id_lookup.on_no_match, and id_lookup.on_provider_error fallback switches to define per-country behaviour when a non-document lookup does not succeed.
    • Adds wallet.enabled, wallet.providers, and wallet.on_failure config keys to control which digital ID wallets are accepted per country and what happens on wallet failure.
    • Adds a Countries tab on the ID Verification node in the workflow console, with a Global settings bulk switch that enables a method across all supported countries at once.

    +3 more show less

    • Adds fallback_from field on session records, populated when a country's fallback switch is set to decline and the session was declined.
    • Surfaces per-method evidence on session detail: a Registry comparison panel for non-doc lookup (showing compared fields, match verdicts, source name, timestamp, and attempt count), and a Credential card for wallet sessions (showing wallet, issuing authority, credential type, assurance level, signature status, and shared attributes).
    • Exposes expected request and response detail for each lookup source and wallet via See details, naming the exact government register, credit-bureau, or residential-records file used per country.

    8 details in Everything

57. docs update Sep 7, 2026 · issue 067

    Didit adds per-country ID method configuration, document subtypes, non-doc lookup controls, and digital identity wallet support to ID Verification workflows.

    └──▷ HOW TO FIND IT
    Configure non-doc lookup attempts and fallback rules per country so users fall back to document capture only after exhausting lookup options.
    📍In the Didit console, go to ID Verification › Countries and allowed ID methods, select a country, then open Additional settings and set lookup attempts (1–5) and enable fallback to document capture.
    Route users in a workflow by document subtype or risk score to apply different verification paths based on finer identity signals.
    📍In the Didit console workflow builder, add a routing rule and select document subtype, risk score, or months since issue as the condition field to branch the user journey.
    • Adds Countries and allowed ID methods configuration in ID Verification to set document capture, non-doc lookup, and digital identity wallets per country.
    • Adds Additional settings panel with document subtypes, lookup attempt limits (one to five), and fallback rules.
    • Supports routing users in workflows by document subtype, date of issue, age, months since issue, risk score, webhook JSON response paths, and custom rules — in addition to existing country, document type, and verification status routing.
    • Supports digital identity wallets in ID Verification, with production wallets enabled live and sandbox wallets testable with simulated results and no charges.
    • Adds Countries and allowed ID methods configuration in ID Verification to set document capture, non-doc lookup, and digital identity wallets per country.
    • Adds Additional settings panel with document subtypes, lookup attempt limits (one to five), and fallback rules.
    • Supports digital identity wallets in ID Verification, with production wallets enabled live and sandbox wallets testable with simulated results and no charges.

    1 more in Everything

58. docs update Sep 7, 2026 · issue 067

    Didit adds three new risk-scoring endpoints for email, IP, and phone signals without sending OTPs

    └──▷ TRY IT
    Pre-screen a signup email for breach exposure and disposable-address risk before allowing account creation.
    copy

    $ curl -X POST https://verification.didit.me/v3/email/risk/ \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"email": "alice@example.com", "country_code": "US", "vendor_data": "lead-123", "metadata": {"source": "signup_prescreen"}}'

    Detect VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./Tor use or country mismatch at login time by scoring the connecting IP against the user's claimed country.
    copy

    $ curl -X POST https://verification.didit.me/v3/ip/risk/ \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"ip_address": "8.8.8.8", "claimed_country": "ESP", "user_agent": "Mozilla/5.0", "vendor_data": "lead-123"}'

    Score a phone number for carrier, line-type, and disposable-number risk during onboarding without triggering an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. send.
    copy

    $ curl -X POST https://verification.didit.me/v3/phone/risk/ \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"phone_number": "+14155552671", "country_code": "US", "vendor_data": "lead-123", "metadata": {"source": "signup_prescreen"}}'

    • Adds POST /v3/email/risk/ to score an email address for deliverability, disposable-address, breach exposure, and cross-session match — returning Approved, In Review, or Declined — without sending an OTP; response exposes risk signals under both email.email_intelligence and email.enrichment aliases.
    • Adds POST /v3/ip/risk/ to score an IP address for geolocation, VPN/Tor, data-center flags, threat data, and country_mismatch against a claimed_country — returning Approved or In Review — without sending an OTP.
    • Adds POST /v3/phone/risk/ to score a phone number for carrier, line-type, porting, disposable-number, and cross-session match signals — returning Approved, In Review, or Declined — without sending an OTP.

    3 details in Everything

59. docs update Sep 7, 2026 · issue 067

    Didit ID Verification adds non-document national-ID lookup and per-country method controls, with new assurance-tier fields on sessions and webhooks.

    └──▷ HOW TO FIND IT
    Enable non-document lookup for a specific country while routing partial-match failures to document capture — configure this via the Countries tab in the ID Verification step.
    📍In the Didit console, open your workflow › ID Verification step › Countries tab. For the target country, toggle Non-document lookup on. Under failure handling, set Partial match to Send to document capture and No match to Decline session. Set retries to 3.
    • Adds a Registry comparison result block showing each compared field: what the user provided, what the source held, and whether it matched — plus an error row when a source did not respond.
    • Adds a Credential details result block for wallet-based verifications, including the wallet, its issuing authority, the level of assurance it asserted, and whether the signature checked out.
    • Adds configurable failure handling per non-document method — for partial match, no match, no source response, or cancelled/timed-out wallet sign-in — each routing the user to document capture or declining the session.
    • Adds retry configuration for non-document lookups: one to five attempts (two by default), counting only lookups the source actually answered.
    • Where a government register returns a portrait (South Africa, Nigeria, Argentina, Panama), the lookup automatically captures a selfie, runs passive liveness, and matches it to the register portrait — included in the lookup price — allowing downstream Liveness and Face Match steps to be skipped.

    +1 more show less

    • Publishes a Digital ID wallet roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, EUDI Wallet) configurable in the console as Coming soon, though no wallet can be enabled in production yet.

    6 details in Everything

60. docs update Sep 7, 2026 · issue 067

    Didit adds digital ID wallet support, non-doc lookup, and event-based transaction monitoring with velocity and sequence rules.

    └──▷ HOW TO FIND IT
    Set per-country ID verification methods and fallbacks, including digital ID wallets like BankID or EUDI Wallet, for a specific country.
    📍In the console, go to ID Verification Methods › Countries tab, select a country, enable digital ID wallet methods (e.g. BankID, EUDI Wallet), and configure fallback to document capture.
    • Adds SDK event submission for device-side capture of non-monetary events using a scoped monitoring credential.
    • Supports non-document identity lookup by checking a national ID number against a government or other authoritative source, available per country.
    • Supports digital ID wallets for identity verification: MitID, BankID, itsme, UAE PASS, gov.br, and EUDI Wallet.
    • Adds event ingestion for non-monetary event types: login, gameplay, bonus, payment, dispute, security, and responsible gambling.
    • Adds rules on events supporting velocity, ratio, ordered-sequence, and cross-subject correlation rule types.

    +1 more show less

    • Adds a Countries tab in the console under ID Verification Methods for configuring per-country verification methods and fallbacks.

    6 details in Everything

61. updated seen Sep 7, 2026 · issue 067

    Didit ID Verification gains non-document national-ID lookup and a digital-wallet method path, selectable per country.

    └──▷ HOW TO FIND IT
    Enable non-document national-ID lookup for a specific country so users can verify without uploading a document photo.
    📍In the console, open your workflow → ID Verification step → Countries tab, select the target country, and toggle Non-document lookup on. Set retry count (1–5, default 2) and choose the fallback action for each failure mode (partial match, no match, no source response).
    • Adds status.updated webhook fields carrying the verification method (Documentary, Data match, or Cryptographic) and the corresponding assurance tier for every ID Verification session.
    • Adds non-document lookup as a second ID Verification method: the user supplies their national ID number and personal details, which are checked against a government register or credit-bureau/financial-services/utility/residential-records source — no photograph or upload required.
    • Adds digital ID wallet support to the ID Verification method roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, and EUDI Wallet), configurable as Coming soon in the console but not yet live for end users.
    • Adds per-country method selection via the Countries tab on the ID Verification step and through the API, letting operators independently enable or disable document capture, non-document lookup, and digital ID wallets for each country.
    • Adds per-failure-mode routing switches for non-document methods — partial match, no match, no source response, and cancelled or timed-out wallet sign-in — each directing the user to document capture or declining the session.

    +4 more show less

    • Adds configurable retry count (one to five attempts, default two) for non-document lookups, counting only attempts the source actually answered.
    • Adds automatic selfie capture, passive liveness, and face match to non-document lookups in countries where the government register returns a portrait (South Africa, Nigeria, Argentina, and Panama), allowing downstream Liveness and Face Match steps to be skipped.
    • Extends the session and decision result with a Registry comparison section showing each compared field, the value the user provided, the value the source held, and whether they matched, plus an error row when the source did not answer.
    • Extends the session and decision result with a Credential details section showing the wallet used, its issuing authority, the level of assurance asserted, and signature verification outcome.
    • Adds non-document lookup as a second ID Verification method: the user supplies their national ID number and personal details, which are checked against a government register or credit-bureau/financial-services/utility/residential-records source — no photograph or upload required.
    • Adds digital ID wallet support to the ID Verification method roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, and EUDI Wallet), configurable as Coming soon in the console but not yet live for end users.
    • Adds per-country method selection via the Countries tab on the ID Verification step and through the API, letting operators independently enable or disable document capture, non-document lookup, and digital ID wallets for each country.
    • Adds per-failure-mode routing switches for non-document methods — partial match, no match, no source response, and cancelled or timed-out wallet sign-in — each directing the user to document capture or declining the session.
    • Adds configurable retry count (one to five attempts, default two) for non-document lookups, counting only attempts the source actually answered.

    +3 more show less

    • Adds automatic selfie capture, passive liveness, and face match to non-document lookups in countries where the government register returns a portrait (South Africa, Nigeria, Argentina, and Panama), allowing downstream Liveness and Face Match steps to be skipped.
    • Extends the session and decision result with a Registry comparison section showing each compared field, the value the user provided, the value the source held, and whether they matched, plus an error row when the source did not answer.
    • Extends the session and decision result with a Credential details section showing the wallet used, its issuing authority, the level of assurance asserted, and signature verification outcome.

    1 more in Everything

62. 3.0.0 Sep 4, 2026 · issue 064

    API surface changed: +3 endpoints, 3 modified

    API change

    API surface changed: +3 endpoints, 3 modified

    • + POST /v3/email/risk/
    • + POST /v3/ip/risk/
    • + POST /v3/phone/risk/
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ POST /v3/aml/: request body changed
    • ~ POST /v3/document-ai/: response schema changed
    • New endpoint POST /v3/email/risk/
    • New endpoint POST /v3/ip/risk/
    • New endpoint POST /v3/phone/risk/
    • GET /v3/session/{sessionId}/decision/: response schema changed
    • POST /v3/aml/: request body changed

    +1 more show less

    • POST /v3/document-ai/: response schema changed

    6 details in Everything

63. changelog Sep 2, 2026 · issue 062

    Didit adds standalone risk APIs, full transaction-monitoring API, biometric-template retention, new fraud signals, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. age-assurance workflows.

    └──▷ TRY IT
    Enable biometric-template retention for an app so duplicate detection and Face Search keep working after session data is purged.
    copy

    $ curl -X PATCH https://api.didit.me/v3/webhook/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

    Delete a session while issuing a privacy-erasure instruction to purge all retained biometric templates for that person, regardless of the app-level retention policy.
    copy

    $ curl -X DELETE https://api.didit.me/v3/session/<sessionId>/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "erasure-req-20260902"}'

    • New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically; matching library and install endpoints manage preset rules.
    • Opt-in biometric-template retention after session deletion: enable via face_retention_policy and face_retention_days on PATCH /v3/webhook/, override per call with retain_face_embeddings on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/; retained templates carry a finite expires_at and never contain images or identity fields.
    • Ready-made age-assurance templates available in the workflow builder with returned data already restricted.
    • Five new fraud-detection signals: recycled-document-image scoring, liveness-video forensics (frame count, duplicate-frame ratio, effective frame rate), DOCUMENT_OCCLUSION_DETECTED for partially obscured documents, Face Match live-capture confirmation, and a pre-extraction capture quality gate.
    • Marketplace is now accessible in the Business Console, with per-feature engine selection in both graph and simple workflow editors.

    +3 more show less

    • Manual company entry added to web, iOS, and Android verification flows when a registry provider is unavailable.
    • Didit Copilot upgraded to a floating panel available on every console page, with inline source citations, fullscreen mobile layout, workflow-building from a description, Database Validation configuration by conversation, and questionnaire generation from a CSV or Excel file.
    • Support section added to the Business Console with organization-scoped tickets, live status, category/severity/session-ID reporting, attachments, human escalation in-thread, and per-ticket permalinks.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on 204 must be updated.
64. changelog Sep 1, 2026 · issue 061

    Didit: New /v3/transactions/rules/ Management API endpoints (create, update, delete, backtest) plus matching library and install endpoints let rules be managed programmatically, in addition to the Business Console.

    └──▷ TRY IT
    Enable biometric-template retention on your app so duplicate detection and Face Search keep working after session data is purged.
    copy

    $ curl -X PATCH https://api.didit.me/v3/webhook/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

    • New Biometric Templates API — GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ — to list, count, inspect, and purge retained templates.
    • Sessions can now be listed ordered by updated_at.
    • New DOCUMENT_OCCLUSION_DETECTED result returned when a partially obscured document is detected at pixel level, translated into every supported language.
    • Age-assurance workflows can now return only the age decision in line with ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27566-1; a workflow declaring the standard cannot return identity attributes alongside the age decision.
    • The Age Estimation borderline band is now visible in the workflow graph, enabling routing to a document check on uncertain results.

    +16 more show less

    • Workflows can now route on the specific NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. skip reason when a chip is not read.
    • Nigeria Bank Verification Number direct BVN lookup added, gated on a selfie face match, with names as optional inputs.
    • Database Validation can now run from its own input sources (e.g., a selfie and a national ID number) without a document capture step.
    • New identity documents added: Moldova ID card (2025), Pakistan ID card (2025), Uruguay ID card (2026), Greece asylum seeker card (2025), and a third Belgium driving license variant.
    • Malaysia MyKad is now selectable as its own subtype rather than a generic ID card.
    • Extraction upgraded for Belgium, Germany, India, Israel, Madagascar, New Zealand, Norway, Sierra Leone, South Africa, and the United States.
    • Didit Copilot is now a resizable floating panel available on every Business Console page, with fullscreen layout on mobile and voice plus typed input support.
    • Copilot can build a complete workflow from a description — adding and configuring steps, branches, final-status rules — and validate before publishing.
    • Copilot can build a questionnaire from an attached CSV or Excel file, including very long answer lists.
    • Copilot can configure Database Validation by conversation for any supported country.
    • Copilot answers now include inline citations that open the underlying documentation without leaving the panel.
    • Support section added to the Business Console with organization-scoped tickets, live status, a standard tickets table, per-ticket permalinks, and escalation to a human agent in the same thread.
    • AI-assisted transaction-rule migration: ask the Didit assistant or any MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-connected agent to map a rule set exported from another provider (CSV or Excel) onto Didit's rule schema, backtest it, and create rules in test mode.
    • Registry coverage analytics now available in Reports, showing registry search coverage and success by country and workflow version.
    • AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. and Wallet Screening results now show the factors behind a risk score, and wallet screening gains a shareable report.
    • Biometric-template retention policy and stored templates are visible in App Settings and Lists → Biometric templates.

    21 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body containing face_retention_outcome, biometric_template_uuid, and per-session results[] for batch requests, instead of 204 No Content. Clients that assert on 204 must be updated.
65. docs update Sep 1, 2026 · issue 061

    Didit adds three new risk-scoring endpoints: POST /v3/email/risk/, /v3/ip/risk/, and /v3/phone/risk/

    └──▷ TRY IT
    Screen a new user's email for breach exposure and disposable-address risk before allowing account creation.
    copy

    $ curl -X POST https://verification.didit.me/v3/email/risk/ \
     -H 'x-api-key: YOUR_API_KEY' \
     -H 'Content-Type: application/json' \
     -d '{
      "email": "alice@example.com",
      "country_code": "US",
      "vendor_data": "lead-123",
      "metadata": {"source": "signup_prescreen"}
    }'

    Detect VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./Tor use or country mismatch on a login IP to flag suspicious sessions for review.
    copy

    $ curl -X POST https://verification.didit.me/v3/ip/risk/ \
     -H 'x-api-key: YOUR_API_KEY' \
     -H 'Content-Type: application/json' \
     -d '{
      "ip_address": "8.8.8.8",
      "claimed_country": "ESP",
      "user_agent": "Mozilla/5.0",
      "vendor_data": "lead-123"
    }'

    Score a phone number for carrier, line-type, porting, and disposable-number risk during lead pre-screening without triggering an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets..
    copy

    $ curl -X POST https://verification.didit.me/v3/phone/risk/ \
     -H 'x-api-key: YOUR_API_KEY' \
     -H 'Content-Type: application/json' \
     -d '{
      "phone_number": "+14155552671",
      "country_code": "US",
      "vendor_data": "lead-123",
      "metadata": {"source": "signup_prescreen"}
    }'

    • New POST /v3/email/risk/ endpoint scores an email address for deliverability, disposable-address detection, breach exposure, cross-session match, and normalized risk signals without sending an OTP; returns Approved, In Review, or Declined in the top-level status field, with intelligence data exposed as both email.email_intelligence and email.enrichment.
    • New POST /v3/ip/risk/ endpoint scores an IP address for geolocation, VPN/Tor/data-center flags, threat data, and country_mismatch against a claimed_country; returns In Review when the resolved country conflicts or the address is flagged as VPN, Tor, or data-center infrastructure.
    • New POST /v3/phone/risk/ endpoint resolves a phone number and returns carrier, line-type, porting status, disposable-number detection, and cross-session match signals without sending an OTP; intelligence available as both phone.phone_intelligence and phone.enrichment.
    • Sandbox keys for all three endpoints validate requests and return deterministic approved data without consuming credits, creating sessions, or contributing to Networks.

    4 details in Everything

66. docs update Sep 1, 2026 · issue 061

    Didit adds standalone risk APIs, programmable monitoring rules, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, biometric retention, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. age-assurance workflows.

    └──▷ TRY IT
    Run a standalone IP risk check against a suspicious address without building a verification workflow.
    copy

    $ curl -X POST https://api.didit.me/v3/ip/risk/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"ip": "203.0.113.42"}'

    Extract structured data from any uploaded document — such as a utility bill or bank statement — without a full identity-verification session.
    copy

    $ curl -X POST https://api.didit.me/v3/document-ai/ \
      -H 'Authorization: Bearer <token>' \
      -F 'file=@statement.pdf'

    • Transaction monitoring gains programmable Management API and MCP rule workflows: integrations can create, update, delete, backtest, and manage preset rules, while console actions retain the user who made a manual status change.
    • Five upload fraud signals now cover recycled document images, liveness-video forensics, covered documents (DOCUMENT_OCCLUSION_DETECTED), live-capture confirmation, and pre-extraction capture quality.
    • Age-assurance workflows can declare ISO/IEC 27566-1, return only an age decision, route borderline estimations to document checks, and start from restricted-data templates.
    • Image-free face biometric templates can be retained after session deletion for duplicate detection, Face Search, and biometric authentication; the disabled-by-default policy and retained templates are managed in console settings.
    • The console adds a cited, voice-capable floating Copilot that can build workflows, configure country-specific Database Validation, and turn attached CSV or Excel files into questionnaires.

    +5 more show less

    • Business Console adds in-product support tickets, Marketplace partner modules, and per-feature engine selection shared by graph and simple workflow editors.
    • Session and workflow APIs add barcode and liveness data, updated_at ordering, marital-status branching, field-level Database Validation inputs, dedicated registry and phone outage codes, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. idempotency, and signed wallet-screening PDF reports.
    • Document coverage expands with new identity and digital driving-license types, firearm licenses, French 2021 ID-card 2D-Doc validation, Mexico City and Paraguay licenses, Malaysia MyKad, and Vatican City and Saint Vincent and the Grenadines.
    • Document-step progress now separates replacements, and capture flows improve camera recovery, photo fallback, upload handling, and clearer liveness and credit-error messaging.
    • Native SDKs advance across React Native, Android, iOS, and Flutter with smaller binaries, Android 16 and still-photo-capture fixes, framework updates, and improved localization.

    10 details in Everything

67. docs update Sep 1, 2026 · issue 061

    Didit transaction monitoring gains event ingestion, event-based rules, and SDK-side device event capture.

    • Adds Event Ingestion endpoint supporting non-monetary event types: login, gameplay, bonus, payment, dispute, security, and responsible gambling.
    • Adds Rules on Events with velocity, ratio, ordered-sequence, and cross-subject correlation rule types for event-driven monitoring logic.
    • Adds SDK Event Submission for device-side event capture using a scoped monitoring credential.

    3 details in Everything

68. updated seen Sep 1, 2026 · issue 061

    Didit adds standalone risk APIs, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability./IEC 27566-1 age assurance, transaction-monitoring rule management, and biometric-template retention.

    ▶ ⤢

    ▶ ⤢

    ▶ ⤢

    ▶ ⤢
    └──▷ TRY IT
    Check whether an email address is high-risk before allowing account creation, without starting a full verification session.
    copy

    $ curl -X POST https://api.didit.me/v3/email/risk/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"email": "user@example.com"}'

    Extract structured data from an uploaded business document without building a verification session.
    copy

    $ curl -X POST https://api.didit.me/v3/document-ai/ \
      -H 'Authorization: Bearer <token>' \
      -F 'file=@invoice.pdf'

    • New POST /v3/document-ai/ endpoint extracts structured data from any uploaded document, not just identity documents, and accepts uploads up to 50 MB.
    • New POST /v3/email/risk/, POST /v3/phone/risk/, and POST /v3/ip/risk/ endpoints return standalone risk signals for an email address, phone number, or IP address, each priced per call.
    • New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules; matching library and install endpoints manage preset rules from the rule library.
    • Nine didit_transaction_rule_* MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools expose the same list, create, update, delete, backtest, and library workflows to any MCP-connected AI agent.
    • Registry-search outages now return HTTP 502 with code: 'kyb_registry_provider_unavailable' so integrations can react programmatically.

    +20 more show less

    • Phone provider outages now return HTTP 502 with code: 'phone_provider_unavailable' for the same purpose.
    • Sessions can now be listed and ordered by updated_at to surface recently imported or modified sessions.
    • A partially obscured document is now detected at pixel level and returns DOCUMENT_OCCLUSION_DETECTED in every supported language.
    • Biometric-template retention lets applications keep one image-free face template after a session is deleted, keeping duplicate detection active after session data is purged; the policy is visible and configurable under Settings > Lists > Biometric templates.
    • Age-assurance workflows now support ISO/IEC 27566-1: a workflow that declares the standard cannot return identity attributes alongside the age decision, and an Age Estimation borderline band is exposed to the workflow graph for routing uncertain results to a document check.
    • Idempotency keys are now supported on the AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. API, so a retried screening request is never charged or screened twice.
    • Nigeria Bank Verification Number (BVN) is a new Database Validation source, gated on a selfie face match.
    • Database Validation can now run without a document capture step — each field can draw from its own input source (e.g., selfie plus a national ID number).
    • New Marketplace section in the Business Console lets you browse and enable partner modules.
    • Per-feature engine selector in the workflow editor (graph and simple) lets you choose which engine runs each individual check, and the choice persists across both editor types.
    • Firearm licenses are now a selectable document category, covering Victoria (Australia) and Illinois, Massachusetts, and two New Jersey permits (United States).
    • Digital driving licenses added for Argentina (Mi Argentina and Jujuy) and Australia (New South Wales including provisional, South Australia including learner, and Victoria including heavy vehicle).
    • ePassport trust store expanded to 136 issuing countries, with new signing-certificate generations for 32 of them; workflows can now route on the specific NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. skip reason.
    • Barcode on North American driving licenses now reports its signed fields with each signature validated against its certificate's validity window.
    • Every manual transaction status change is attributed to the console user who made it.
    • AI-assisted rule migration lets the Didit assistant (or any MCP-connected agent) accept a rule set exported as CSV or Excel from another provider, map it to Didit's rule schema, backtest it against your own transaction history, and create the rules in test mode.
    • Copilot becomes a floating, resizable panel available on every Business Console page, with inline source citations, fullscreen mobile layout, CSV/Excel-to-questionnaire conversion, and the ability to build and validate a complete workflow from a natural-language description.
    • Support is now built into the Business Console: organization-scoped tickets with live status, category/severity/session-ID filing, attachment support, human escalation in the same thread, and per-ticket permalinks.
    • French overseas departments are now searchable in the French company registry.
    • Registry coverage analytics by country and workflow version are now available in Reports.

    25 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Session deletion behavior has changed: applications that relied on full session data persisting after deletion must adopt the new biometric-template retention policy, as session data is now purged while only an image-free face template may be retained.
69. changelog Sep 1, 2026 · issue 061
    └──▷ TRY IT
    Enable biometric-template retention on a webhook so Face Search and duplicate detection keep working after you purge session data.
    copy

    $ curl -X PATCH https://api.didit.me/v3/webhook/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

    Delete a session while overriding the app-level retention policy to force immediate purge of that person's biometric template.
    copy

    $ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"retain_face_embeddings": false}'

    Satisfy a privacy-erasure request by purging every retained biometric template for a person, regardless of application retention policy.
    copy

    $ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "<your-instruction-id>"}'

    • Adds face_retention_policy and face_retention_days fields on PATCH /v3/webhook/ to configure opt-in biometric-template retention at the application level, keeping image-free face embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. anchored to a User after session deletion so duplicate detection, Face Search, and biometric authentication continue working.
    • Adds /v3/transactions/rules/ Management API endpoints to create, update, delete, and backtest transaction-monitoring rules programmatically, plus library and install endpoints to browse, install, and remove preset rules from the rule library.
    • App Settings → Data now exposes a Retain biometric template toggle with a required finite retention period field for configuring biometric-template retention via the Business Console.
    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body containing face_retention_outcome, biometric_template_uuid, and per-session results[] (for batch), instead of 204 No Content — clients that assert on 204 must be updated.
    • !POST /v3/users/delete/ now purges the user's retained biometric templates before deleting the user, and returns 503 (retryable, nothing deleted) if a template cannot be purged.
70. 3.0.0 Aug 31, 2026 · issue 060
    API change

    • + DELETE /v3/biometric-templates/{template_uuid}/
    • + GET /v3/biometric-templates/
    • + GET /v3/biometric-templates/count/
    • + GET /v3/biometric-templates/{template_uuid}/
    • + POST /v3/biometric-templates/delete/
    • ~ DELETE /v3/session/{sessionId}/delete/: request body changed; response schema changed
    • ~ GET /v3/session/{sessionId}/decision/: response schema changed
    • ~ POST /v3/face-search/: response schema changed
    • ~ POST /v3/sessions/delete/: request body changed; response schema changed
    • ~ POST /v3/users/delete/: response schema changed
    • ~ POST /v3/wallet-screening/: response schema changed
    • New endpoint DELETE /v3/biometric-templates/{template_uuid}/
    • New endpoint GET /v3/biometric-templates/
    • New endpoint GET /v3/biometric-templates/count/
    • New endpoint GET /v3/biometric-templates/{template_uuid}/
    • New endpoint POST /v3/biometric-templates/delete/

    +1 more show less

    • GET /v3/session/{sessionId}/decision/: response schema changed
    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/: request body changed; response schema changed
    • !POST /v3/sessions/delete/: request body changed; response schema changed
71. docs update Aug 31, 2026 · issue 060

    Didit Marketplace lets you swap identity verification engines per feature, with automatic fallback and API control via provider_key and fallback_to_native.

    └──▷ USE IT
    Override the verification engine for a specific workflow feature and disable silent fallback, so failures surface explicitly rather than silently running on Didit.
    json copy

    {
      "config": {
        "provider_key": "your-provider-key",
        "fallback_to_native": false
      }
    }

    Route a workflow feature to a connected third-party provider while keeping the default automatic fallback to Didit if the provider is unavailable.
    json copy

    {
      "config": {
        "provider_key": "your-provider-key",
        "fallback_to_native": true
      }
    }

    Connect a new provider and activate it for a feature without leaving the workflow builder.
    📍1. Open the workflow builder and select the feature node you want to change. 2. On the first configuration tab, open the Verification engine control. 3. Find the provider listed as Connect and select it — the setup dialog opens inline. 4. Complete the connection, then select the provider again (now shown as Switch) to make it the active engine for this feature.
    • Adds provider_key (string) and fallback_to_native (boolean, default true) fields to the feature config object in the Management API, enabling programmatic engine selection and fallback control outside the per-feature config reference.
    • New Marketplace UI lets you connect third-party identity verification providers and select, per workflow feature node, which engine runs the check — with status labels (Active, Switch, Connect) and inline provider setup without leaving the workflow builder.
    • Adds a 'Fall back to Didit if my provider fails' toggle per feature: when on (default), Didit's own engine runs automatically if the selected third-party provider is unavailable, preventing outright step failure.

    3 details in Everything

72. docs update Aug 31, 2026 · issue 060

    Didit workflow feature nodes now support third-party verification engines with automatic fallback via the Marketplace.

    └──▷ HOW TO FIND IT
    Switch a verification step to a third-party provider so it runs through your connected Marketplace integration, with Didit as the automatic fallback.
    📍In the workflow editor, open a feature node › first configuration tab › set Verification engine to your connected third-party provider from the Marketplace.
73. docs update Aug 31, 2026 · issue 060

    Didit adds session deletion with granular face-biometric retention controls and retained_template source in Face Search.

    └──▷ TRY IT
    Handle a GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification./CCPA data-subject erasure request by deleting the session and purging every retained biometric template for that person.
    copy

    $ curl -X DELETE \
      https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/ \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "dsar-2026-0142"}'

    Delete a KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. session after approval but keep an image-free biometric template for 365 days to enable ongoing duplicate detection and biometric authentication.
    copy

    $ curl -X DELETE \
      https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/delete/ \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"retain_face_embeddings": true, "face_retention_days": 365, "instruction_id": "post-approval-cleanup-2026-08"}'

    • Adds DELETE /v3/session/{session_id}/delete/ endpoint that returns 200 OK with a face_retention_outcome JSON body (values: deleted, retained_with_user, none, ineligible_no_vendor_user) instead of the previous 204 No Content.
    • Adds retain_face_embeddings request field to the delete endpoint: true keeps one image-free biometric template anchored to the session's User after deletion; false forces deletion regardless of application policy; null/omit follows the application's face_retention_policy.
    • Adds face_retention_days field (max 3650) to the delete request body, setting a finite retention duration for a kept biometric template; required when retaining unless the application already configures face_retention_days.
    • Adds face_retention_deadline field to the delete request body for a hard expiry date on a retained template.
    • Adds deletion_instruction field supporting operational_session_delete (default) and privacy_erasure; the privacy_erasure value purges every retained biometric template for that User and prevents new retention — intended for data-subject erasure requests.

    +6 more show less

    • Adds instruction_id field to the delete request body as a durable reference (e.g. erasure-ticket id) recorded on the audit trail and any retained template.
    • Adds biometric_template_uuid to the delete response body, identifying the retained template when face_retention_outcome is retained_with_user.
    • Exposes retained templates as a new retained_template value for the source field in Face Search (POST /v3/face-search/) match results, alongside existing session, imported, and list_entry values.
    • Adds biometric_template_id field to Face Search match objects, populated only when source is retained_template.
    • Retained biometric templates are managed through /v3/biometric-templates/{template_uuid}/ and are purged on User deletion, privacy erasure, expiry, or explicit call to that endpoint.
    • Delete endpoint authenticates via x-api-key header or a Authorization: Bearer console token carrying the delete:sessions permission; both auth failures return 403 (never 401).

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The DELETE /v3/session/{session_id}/delete/ endpoint now returns 200 OK with a JSON body instead of 204 No Content; clients that assert on a 204 status code will break.
74. docs update Aug 31, 2026 · issue 060

    Didit adds biometric-template retention, a new Biometric Templates API, and richer Face Search match metadata.

    └──▷ TRY IT
    Enable biometric-template retention at the application level so Face Search and duplicate detection keep working after session data is purged.
    copy

    $ curl -X PATCH https://api.didit.me/v3/webhook/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"face_retention_policy": "retain", "face_retention_days": 365}'

    Issue a privacy erasure on session deletion to purge all retained templates for a person, overriding the application-level retention policy.
    copy

    $ curl -X DELETE https://api.didit.me/v3/session/<sessionId>/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "<your-instruction-id>"}'

    List all retained biometric templates to audit what is stored before a compliance review.
    copy

    $ curl -X GET https://api.didit.me/v3/biometric-templates/ \
      -H 'Authorization: Bearer <token>'

    • Adds opt-in biometric-template retention after session deletion: enable Retain biometric template (with a required finite retention period) in App Settings → Data, or set face_retention_policy and face_retention_days on PATCH /v3/webhook/.
    • New Biometric Templates API: GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /v3/biometric-templates/{template_uuid}/, DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ to list, count, inspect, and purge retained templates, with full audit trail.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on 204 must be updated.
75. docs update Aug 31, 2026 · issue 060

    Didit adds session deletion with privacy erasure and a new Biometric Templates management API

    └──▷ TRY IT
    Delete a verification session and trigger privacy erasure to remove associated biometric data.
    copy

    $ curl -X DELETE 'https://api.didit.me/v3/session/{sessionId}/delete/' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"privacy_erasure": true}'

    Audit or purge retained image-free face templates across sessions via the Biometric Templates API.
    copy

    $ curl -X GET 'https://api.didit.me/v3/biometric-templates/' \
      -H 'Authorization: Bearer <token>'

    • Adds DELETE /v3/session/{sessionId}/delete/ endpoint that returns a per-session face_retention_outcome and supports privacy_erasure instructions for GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification.-style data removal.
    • Adds /v3/biometric-templates/ API to list, count, inspect, and purge image-free face templates retained after session deletion (opt-in feature).

    2 details in Everything

76. updated seen Aug 31, 2026 · issue 060

    Didit adds biometric-template retention after session deletion, a full Biometric Templates API, and privacy-erasure controls.

    └──▷ TRY IT
    Enable biometric-template retention org-wide so Face Search keeps working after sessions are deleted, with a 90-day expiry.
    copy

    $ curl -X PATCH https://api.didit.me/v3/webhook/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"face_retention_policy": "retain", "face_retention_days": 90}'

    Override the app policy and suppress template retention for a single sensitive session deletion.
    copy

    $ curl -X DELETE https://api.didit.me/v3/session/{sessionId}/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"retain_face_embeddings": false}'

    Purge all retained biometric templates for a person on a GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. erasure request, regardless of application retention policy.
    copy

    $ curl -X POST https://api.didit.me/v3/sessions/delete/ \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"deletion_instruction": "privacy_erasure", "instruction_id": "<your-instruction-id>"}'

    • Adds face_retention_policy and face_retention_days fields on PATCH /v3/webhook/ to configure biometric-template retention at the application level, keeping image-free face embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. alive for duplicate detection, Face Search, and biometric authentication after session data is purged.
    • Adds retain_face_embeddings parameter on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ to override the application-level retention policy on a per-call basis.
    • Adds UI control Retain biometric template (with a required finite retention period) in App Settings → Data to enable biometric-template retention.
    • New Biometric Templates API: GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /v3/biometric-templates/{template_uuid}/, DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ for listing, counting, inspecting, and purging retained templates — every retain and purge is audited.
    • Adds deletion_instruction: "privacy_erasure" (with instruction_id) on session deletion to purge all retained biometric templates for a person regardless of application policy.

    +2 more show less

    • Face Search match results now include source: "retained_template", vendor_user_id, and biometric_template_id for hits on retained templates, and vendor_user_id on session and imported matches.
    • POST /v3/users/delete/ now purges a user's retained biometric templates before deleting the user, and returns 503 (retryable, nothing deleted) if a template cannot be purged.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ now return 200 OK with a JSON body (face_retention_outcome, biometric_template_uuid; per-session results[] for batch) instead of 204 No Content — clients that assert on a 204 response will break and must be updated.
77. changelog Aug 31, 2026 · issue 060

    Didit adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool management for transaction-monitoring rules, plus AI-assisted rule migration from external providers.

    • New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically, with matching library and install endpoints for browsing, installing, and removing preset rules from the rule library.
    • New AI-assisted rule migration workflow lets the Didit assistant (or any MCP-connected agent) map a rule set exported from another provider (CSV or Excel) onto Didit's rule schema, backtest it against your transaction history, and create the rules in test mode for review before activation.

    2 details in Everything

78. 3.0.0 Aug 28, 2026 · issue 058

    API surface changed: +23 endpoints, 2 modified

    API change

    API surface changed: +23 endpoints, 2 modified

    • + DELETE /v3/transactions/rules/install/
    • + DELETE /v3/transactions/rules/{rule_uuid}/
    • + GET /v3/organization/{organization_id}/application/{application_id}/business-sessions/{business_session_id}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/businesses/{vendor_business_uuid}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/graph/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/map/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/members/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/signals/
    • + GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/timeline/
    • + GET /v3/organization/{organization_id}/application/{application_id}/sessions/{session_id}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/transactions/{transaction_uuid}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/transactions/{transaction_uuid}/parties/{transaction_party_uuid}/networks/
    • + GET /v3/organization/{organization_id}/application/{application_id}/users/{vendor_user_uuid}/networks/
    • + GET /v3/transactions/rules/
    • + GET /v3/transactions/rules/library/
    • + GET /v3/transactions/rules/{rule_uuid}/
    • + PATCH /v3/transactions/rules/{rule_uuid}/
    • + POST /v3/transactions/rules/
    • + POST /v3/transactions/rules/backtest/
    • + POST /v3/transactions/rules/install/
    • + POST /v3/wallet-screening/pdf/
    • ~ POST /v3/aml/: param Idempotency-Key (header) added
    • ~ POST /v3/wallet-screening/: response schema changed
    • New endpoint DELETE /v3/transactions/rules/install/
    • New endpoint DELETE /v3/transactions/rules/{rule_uuid}/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/business-sessions/{business_session_id}/networks/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/businesses/{vendor_business_uuid}/networks/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/

    +20 more show less

    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/graph/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/map/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/members/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/signals/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/networks/{network_uuid}/timeline/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/sessions/{session_id}/networks/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/transactions/{transaction_uuid}/networks/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/transactions/{transaction_uuid}/parties/{transaction_party_uuid}/networks/
    • New endpoint GET /v3/organization/{organization_id}/application/{application_id}/users/{vendor_user_uuid}/networks/
    • New endpoint GET /v3/transactions/rules/
    • New endpoint GET /v3/transactions/rules/library/
    • New endpoint GET /v3/transactions/rules/{rule_uuid}/
    • New endpoint PATCH /v3/transactions/rules/{rule_uuid}/
    • New endpoint POST /v3/transactions/rules/
    • New endpoint POST /v3/transactions/rules/backtest/
    • New endpoint POST /v3/transactions/rules/install/
    • New endpoint POST /v3/wallet-screening/pdf/
    • POST /v3/aml/: param Idempotency-Key (header) added
    • POST /v3/wallet-screening/: response schema changed

    25 details in Everything

79. docs update Aug 28, 2026 · issue 058

    Didit adds Networks: cross-app fraud-ring clustering with graph, map, timeline views, blocklisting, and case creation.

    └──▷ HOW TO FIND IT
    Investigate a flagged network in the console by narrowing the graph to the immediate connections of one suspicious applicant.
    📍In the Didit console, open Networks › select the network › Graph tab, then click an applicant node and set the hop limit to 1, 2, or 3 to isolate their direct connections.
    • Introduces Networks, which automatically clusters applicants, businesses, and transaction parties across every application in an organization that share device, IP, biometric, document, or contact signals — surfacing a fraud ring as one investigation instead of dozens of unrelated flags.
    • Flags high-degree signals (shared office IP, kiosk device, data-center IP) as hub signals for analyst review rather than auto-declining, distinguishing legitimate high-traffic environments from fraud.
    • Enables analysts to create a case anchored to a network (rather than a single subject) to hand off to a compliance team for formal investigation.
    • Enables blocklisting a member's identity or an individual signal directly from the network detail page, so future sessions matching it are automatically declined.
    • Exposes network data through the API, including list networks and network membership lookup (which networks a session, user, business, or transaction belongs to).

    +2 more show less

    • Clustering runs on production data only; sandbox applications and sandbox sessions are excluded entirely and never create or join a network.
    • Signal values are privacy-preserving: every signal except selfie-background and face-similarity is stored as a keyed hash of its normalized value, so underlying device IDs, IPs, document numbers, phones, and emails are never stored or displayed in the clear.

    7 details in Everything

80. docs update Aug 28, 2026 · issue 058

    Didit adds standalone document OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels./fraud, AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. screening, wallet-screening PDF export, and transaction-rule listing endpoints

    └──▷ TRY IT
    Screen a person against PEP and sanctions lists with retry safety — use Idempotency-Key so a timeout does not trigger a duplicate AML charge.
    copy

    $ curl -X POST https://verification.didit.me/v3/aml/ \
     -H 'x-api-key: YOUR_API_KEY' \
     -H 'Content-Type: application/json' \
     -H 'Idempotency-Key: aml-user-1234-2026-08-20' \
     -d '{
      "full_name": "Antonio Ejemplo Modelo",
      "entity_type": "person",
      "date_of_birth": "1972-02-29",
      "nationality": "ES",
      "include_adverse_media": false,
      "vendor_data": "user-1234"
     }'

    Export an already-run wallet screening as a signed PDF for audit — repost the unmodified JSON body (with report_signature) returned by POST /v3/wallet-screening/.
    copy

    $ # $RESULT is the saved JSON body from POST /v3/wallet-screening/
    curl -X POST 'https://verification.didit.me/v3/wallet-screening/pdf/' \
      -H 'x-api-key: YOUR_API_KEY' \
      -H 'Content-Type: application/json' \
      -d "$RESULT" \
      -o wallet_screening_report.pdf

    List only active custom transaction-monitoring rules, ordered by most recently triggered, to review which rules are firing in production.
    copy

    $ curl -G 'https://verification.didit.me/v3/transactions/rules/' \
      -H 'x-api-key: YOUR_API_KEY' \
      --data-urlencode 'source=CUSTOM' \
      --data-urlencode 'mode=ACTIVE' \
      --data-urlencode 'ordering=-latest_triggered_at'

    • New POST /v3/aml/ endpoint screens a person or company against PEP, sanctions, watchlist, and adverse-media datasets, returning aml.status (Approved/In Review/Declined) and per-hit match_score and risk_score fields.
    • AML two-score model is configurable per-request via aml_match_score_threshold (default 93), aml_score_review_threshold (default 100), aml_score_approve_threshold (default 80), aml_name_weight, aml_dob_weight, and aml_country_weight (must sum to 100, defaults 60/25/15).
    • AML endpoint supports include_adverse_media=true for adverse-media enrichment (adds ~5–25 s latency; source recommends a client timeout of at least 60 seconds).
    • AML endpoint supports include_ongoing_monitoring=true to keep re-screening a profile over time (requires save_api_request=true, enforced with 400 otherwise).
    • AML save_api_request field (default true) persists screenings as sessions accessible via GET /v3/session/{sessionId}/decision/ and fires status.updated webhooks; set to false for transient, non-stored screenings.

    +6 more show less

    • New POST /v3/wallet-screening/pdf/ endpoint re-renders a prior wallet-screening result as a Didit-branded PDF by reposting the exact JSON body (including report_signature) returned by POST /v3/wallet-screening/ — no provider call, no billing.
    • New POST /v3/transactions/rules/ listing endpoint returns the application's transaction-monitoring rules (custom and library presets), filterable by source (PRESET/CUSTOM), category, mode (ACTIVE/DISABLED/TEST), and bundle, with ordering support (run_count, approved_pct, reviewed_pct, declined_pct, latest_triggered_at, title, created_at, source, each with optional - prefix for descending).
    • New standalone document OCR and fraud-check endpoint accepts front_image and optional back_image, classifies 14,000+ document types from 220+ countries automatically, and returns extracted holder fields, parsed MRZ, an Approved/Declined status, and a warnings list.
    • Document endpoint exposes three per-request risk-action fields — invalid_mrz_action, inconsistent_data_action, and expiration_date_not_detected_action — each accepting DECLINE or NO_ACTION.
    • Document endpoint supports perform_document_liveness=true to screen for screen replays (SCREEN_CAPTURE_DETECTED), printed copies (PRINTED_COPY_DETECTED), and portrait manipulation (PORTRAIT_MANIPULATION_DETECTED).
    • Document endpoint save_api_request field (default true) persists the call as an API-type session with a request_id usable with GET /v3/session/{sessionId}/decision/.

    11 details in Everything

81. updated seen Aug 28, 2026 · issue 058

    Didit adds a /v3/transactions/rules/ Management API, nine MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, and AI-assisted rule migration for transaction monitoring.

    • Adds /v3/transactions/rules/ Management API endpoints to create, update, delete, and backtest transaction-monitoring rules programmatically, complementing the Business Console.
    • Adds library and install endpoints under /v3/transactions/rules/ to browse, install, and remove preset rules from the rule library.
    • Introduces nine didit_transaction_rule_* MCP tools covering list, create, update, delete, backtest, and library workflows for any MCP-connected AI agent.
    • Adds AI-assisted rule migration: the Didit assistant (or any MCP-connected agent) can ingest a rule set exported from another provider (CSV or Excel), map it to Didit's rule schema, backtest it against your transaction history, and create the rules in test mode for review before activation.

    4 details in Everything

82. docs update Aug 22, 2026 · issue 053

    Didit White Label gains a Texts tab for per-locale string overrides, completion screen mode control, and dynamic placeholders.

    └──▷ HOW TO FIND IT
    Switch the completion screen to a neutral holding message so your own product — not Didit — tells users whether they passed verification.
    📍In the Console, go to White Label › Texts, locate Completion screen mode, and select Submitted for review, then save.
    Write a step-aware progress string that renders correctly across workflows of different lengths using dynamic placeholders.
    📍In the Console, go to White Label › Texts, select the target locale, find the welcome or navigation string field, and enter: 'Step {stepIndex} of {stepTotal} — {appName} identity check', then save.
    • Adds Console → White Label → Texts tab to override the wording of specific verification-flow screens (welcome, document selection, document capture, selfie intro, questionnaire navigation, completion screen, and common buttons like Continue and Retry) on a per-locale basis, without forking translations.
    • Introduces Completion screen mode setting: choose Decision (default) to show the real outcome, or Submitted for review to always show a neutral 'we received your data and are reviewing it' message regardless of Didit's internal decision — useful when the product communicates approval separately.
    • Supports dynamic placeholders in override text — {appName}, {stepIndex}, and {stepTotal} — resolved per user at render time from the actual running workflow, with a 500-character limit per overridden string.
    • Adds Auto-translate action on the Texts tab to draft overrides for additional locales from a manually written value, covering more locales than the Style Editor language selector.
    • Text overrides and completion screen mode apply across all rendering surfaces: hosted web flow, iOS SDK, and Android SDK.

    5 details in Everything

83. docs update Aug 22, 2026 · issue 053

    Didit adds per-user full history PDF export, bundling up to 20 sessions into one chronological report.

    └──▷ HOW TO FIND IT
    Pull a complete audit-ready session history for a single user during a KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. review or dispute.
    📍In the Didit console, open a user's detail page, then choose Actions › Download PDF to receive a merged chronological PDF of up to 20 reportable sessions (Approved, Declined, In Review, Kyc Expired) with a cover page summarising profile, feature status, and session index.
    • New Actions → Download PDF option on a user's detail page exports a single PDF bundling a cover page (profile summary, feature status, session index) with the full standard report of every completed session sharing that user's vendor_data, merged in chronological order — capped at the 20 most recent sessions in a reportable status (Approved, Declined, In Review, Kyc Expired).

    1 detail in Everything

84. docs update Aug 22, 2026 · issue 053

    Didit adds POST /v3/document-ai/ for custom field extraction, name matching, and tamper detection on payslips, invoices, and other supporting documents.

    └──▷ TRY IT
    Extract structured fields from a payslip and verify the employee name matches a known person, declining on tampering and reviewing on missing required fields.
    copy

    $ curl -X POST https://api.didit.me/v3/document-ai/ \
      -H 'Authorization: Bearer <token>' \
      -F 'document=@payslip.pdf' \
      -F 'fields=[{"key":"employer_name","name":"Employer name","instruction":"The employer or company issuing the payslip.","type":"text","required":true,"is_full_name":false},{"key":"employee_name","name":"Employee name","instruction":"The full name of the employee as printed on the payslip.","type":"text","required":true,"is_full_name":true},{"key":"net_pay","name":"Net pay","instruction":"The net amount paid to the employee for the period.","type":"number","required":true,"is_full_name":false},{"key":"pay_date","name":"Pay date","instruction":"The payment date shown on the payslip.","type":"date","required":false,"is_full_name":false}]' \
      -F 'expected_first_name=Sophia' \
      -F 'expected_last_name=Martinez' \
      -F 'document_ai_name_match_score_threshold=80' \
      -F 'document_ai_document_tampering_action=DECLINE' \
      -F 'document_ai_missing_required_fields_action=REVIEW' \
      -F 'save_api_request=true'

    Verify a business invoice against a company name, tuning normalization for a French entity and routing name mismatches to review rather than ignoring them.
    copy

    $ curl -X POST https://api.didit.me/v3/document-ai/ \
      -H 'Authorization: Bearer <token>' \
      -F 'document=@invoice.pdf' \
      -F 'fields=[{"key":"company_name","name":"Company name","instruction":"The issuing company name on the invoice.","type":"text","required":true,"is_full_name":true},{"key":"invoice_total","name":"Invoice total","instruction":"The total amount due on the invoice.","type":"number","required":true,"is_full_name":false},{"key":"invoice_date","name":"Invoice date","instruction":"The date printed on the invoice.","type":"date","required":false,"is_full_name":false}]' \
      -F 'expected_company_name=Acme France SAS' \
      -F 'expected_company_country=FR' \
      -F 'document_ai_name_mismatch_action=REVIEW' \
      -F 'save_api_request=true'

    • New POST /v3/document-ai/ endpoint accepts a document (multipart/form-data) plus a fields JSON-encoded array (1–30 items, max 16 KB) and returns typed extracted values (text, number, date as YYYY-MM-DD), a status of Approved/Declined/In Review, and a warnings list — supporting payslips, proof-of-funds letters, tax statements, contracts, invoices, and more.
    • Each field definition in the fields array carries key (^[a-z0-9_]{1,64}$), name, instruction, type (text | number | date), required (boolean), and is_full_name (boolean, at most one per request); marking required: true raises DOCUMENT_AI_MISSING_REQUIRED_FIELDS when the value cannot be read.
    • Fuzzy name-match scoring via expected_first_name + expected_last_name (person) or expected_company_name + optional expected_company_country (ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 3166-1 alpha-2) returns name_match_score (0–100) and name_on_document; scores below document_ai_name_match_score_threshold (default 80) trigger DOCUMENT_AI_NAME_MISMATCH.
    • Per-risk configurable actions — document_ai_unreadable_document_action, document_ai_missing_required_fields_action, document_ai_document_tampering_action, document_ai_name_mismatch_action, document_ai_unsupported_file_action — each accept DECLINE, REVIEW, or NO_ACTION to control the resulting status.
    • PDF/EXIFEXIFMetadata standard embedded in image and audio files that records camera settings, timestamps, GPS coordinates, and device identifiers — giving cyber tools a rich source of attribution and forensic data without touching file content. tamper detection flags DOCUMENT_AI_SUSPECTED_MANIPULATION for known PDF editors, overlay-text manipulation, suspicious re-exports, modified-after-signing artifacts, and image anomalies; default action is DECLINE.

    +3 more show less

    • Accepted file formats: tiff, jpg, jpeg, png, pdf, webp, zip; max upload 30 MB; multi-page PDFs supported (up to ~30 s latency); encrypted PDFs rejected with 400.
    • Session persistence controlled by save_api_request (default true): stores the document, extracted values, field definitions, and name-match snapshot as an API-type session visible in the Business Console and retrievable via GET /v3/session/{sessionId}/decision/ using the returned request_id.
    • Billing is $0.20 per document (one Document AI API credit per 200 response); sandbox API keys return a deterministic mock and are not charged; a depleted balance returns 403 before any processing.

    8 details in Everything

85. docs update Aug 22, 2026 · issue 053

    Didit adds Document AI field extraction and KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. company registry search/profile endpoints to its API.

    • New Document AI capability extracts user-defined fields from any PDF or image document, with name matching and tampering checks.
    • New KYB Registry Search endpoint lets practitioners search official company registries by name, registration number, and country at no cost.
    • New KYB Registry Select endpoint retrieves the full registry profile for a selected company, including officers, beneficial owners, and addresses.

    3 details in Everything

86. 3.0.0 Aug 20, 2026 · issue 051

    API surface changed: +1 endpoint

    API change

    API surface changed: +1 endpoint

    • + POST /v3/document-ai/
    • New endpoint POST /v3/document-ai/

    1 detail in Everything

87. changelog Aug 15, 2026 · issue 046

    Didit adds barcode fields to Session API, kyc.marital_status branch support, KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./phone 502 error codes, and React Native 0.77 TurboModule support.

    └──▷ TRY IT
    Inspect barcode data extracted from a scanned ID document after a verification session completes.
    copy

    $ curl -X GET 'https://api.didit.me/v1/sessions/<session_id>' \
      -H 'Authorization: Bearer <token>' \
      | jq '.id_verifications[].barcodes'

88. 3.0.0 Aug 14, 2026 · issue 045

    API surface changed: +1 endpoint, 3 modified

    API change

    API surface changed: +1 endpoint, 3 modified

    • + PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/
    • ~ POST /v3/kyb/search/: response schema changed
    • ~ POST /v3/phone/check/: response schema changed
    • ~ POST /v3/phone/send/: response schema changed
    • New endpoint PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/
    • POST /v3/kyb/search/: response schema changed
    • POST /v3/phone/check/: response schema changed
    • POST /v3/phone/send/: response schema changed

    4 details in Everything

89. docs update Aug 14, 2026 · issue 045

    Didit workflows gain marital-status branching via kyc.marital_status and copilot-driven Database Validation step setup.

    • Adds kyc.marital_status as a usable OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. field in conditional branches and custom status rules within workflow builders; when the document omits marital status the field is empty and the fallback branch applies.
    • Workflow copilot can now create and configure Database Validation steps in a single action, resolving the supported service per country from a list you specify and displaying the saved configuration on the canvas.

    2 details in Everything

90. docs update Aug 14, 2026 · issue 045

    Didit adds a PATCH endpoint to skip or re-require frozen KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk. Key People parties, unblocking stalled business verification sessions.

    └──▷ TRY IT
    Unblock a KYB session stalled in Awaiting User because a UBOUBOuBlock Origin, a browser extension maintained by Raymond Hill that blocks ads and trackers using filter lists; cyber tools embed or reference it to strip unwanted content from web traffic or scraped pages.'s individual KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. session was deleted — skip that party so the business session can settle.
    copy

    $ curl -X PATCH 'https://api.didit.me/v3/session/sess_abc123/kyb/parties/0a3f1e2c-7c2f-4a1b-9d55-2f8d2a5d6b41/' \
      -H 'Authorization: Bearer <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"is_skipped": true}'

    Restore a previously skipped Key People party to scope after the individual re-submits their KYC session.
    copy

    $ curl -X PATCH 'https://api.didit.me/v3/session/sess_abc123/kyb/parties/0a3f1e2c-7c2f-4a1b-9d55-2f8d2a5d6b41/' \
      -H 'Authorization: Bearer <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"is_skipped": false}'

    • New PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/ endpoint lets operators set is_skipped: true to exempt a frozen Key People party from verification — immediately recomputing KYBKeyPeopleCheck and the parent KYB session status — or is_skipped: false to put the party back in scope; requires the write:businesses permission via API key or console user token.
    • The endpoint surfaces new party-level status signals: kyc_session_deleted (linked individual KYC session was deleted and can never settle) and kyb_sub_session_deleted (corporate-party counterpart), giving analysts explicit visibility into why a party is frozen.
    • New kyb_registry_provider_unavailable error code (with code, summary, and detail fields) returned when the KYB registry provider is temporarily unavailable; search is not billed and Didit's hosted flow automatically offers manual company entry instead.
    • New phone_provider_unavailable error code returned on both the send and check phone-verification endpoints when Prelude is temporarily unavailable; nothing is billed and no attempt is consumed on send, while the attempt budget is only consumed by completed checks.

    4 details in Everything

91. docs update Aug 14, 2026 · issue 045

    Didit adds barcode fields to Session API, new 502 error codes for KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./phone outages, and marital-status branching support.

    └──▷ USE IT
    Handle a KYB registry outage gracefully by detecting the new error code and prompting the user to enter company details manually.
    python copy

    if response.status_code == 502 and response.json().get('code') == 'kyb_registry_provider_unavailable':
        prompt_manual_company_entry()

    Branch a workflow on marital status to apply different KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. rules for specific applicant profiles.
    json copy

    {
      "condition": "kyc.marital_status == 'married'",
      "then": "enhanced_due_diligence_step"
    }

    • Retrieve-session responses now include id_verifications[].barcodes, with fields type, position, data, data_raw, and side per entry; documents without barcode output return an empty array.
    • Face-step payloads now always include face_liveness_method; workflows that do not set it explicitly receive PASSIVE as the default value.
    • Supports kyc.marital_status as a field in workflow branches and custom status rules.
    • KYB registry-search outages now return HTTP 502 with code: "kyb_registry_provider_unavailable", enabling integrations to offer manual company entry or a retry.
    • Phone-verification provider outages now return HTTP 502 with code: "phone_provider_unavailable".

    +6 more show less

    • Web, iOS, and Android verification flows now offer manual company entry when the KYB registry provider is unavailable.
    • French 2021 ID cards now read and validate the ANTS 2D-Doc Data Matrix on the back of the document.
    • Web, iOS, and Android capture flows can continue with a still photo when video recording is unavailable.
    • The workflow copilot can now create a configured Database Validation step for supported countries.
    • Compliance country questions now group countries by continent and support selecting or clearing an entire continent at once.
    • React Native TurboModule specification now supports React Native 0.77 code generation.

    11 details in Everything

92. updated seen Aug 14, 2026 · issue 045

    Didit adds barcode data to session responses, new kyc.marital_status branch field, and 502 error codes for KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./phone outages.

    └──▷ TRY IT
    Inspect barcode data extracted from a scanned ID document after a verification session completes.
    copy

    $ GET /sessions/{session_id}
    
    // Response excerpt:
    // {
    //   "id_verifications": [{
    //     "barcodes": [
    //       { "type": "PDF417", "side": "back", "data": "...", "data_raw": "...", "position": {...} }
    //     ]
    //   }]
    // }

    • Retrieve-session responses now include id_verifications[].barcodes, with each entry exposing type, position, data, data_raw, and side; documents without barcode output return an empty array.
    • Face-step payloads now always include face_liveness_method; workflows that do not set it explicitly receive PASSIVE from the API.
    • Adds kyc.marital_status as a usable field in workflow branch conditions.
    • KYB registry-search outages now return 502 with code: 'kyb_registry_provider_unavailable', enabling integrations to offer manual company entry or a retry.
    • Phone-verification provider outages now return 502 with code: 'phone_provider_unavailable'.

    +6 more show less

    • Web, iOS, and Android verification flows now offer manual company entry when the KYB registry provider is unavailable.
    • French 2021 ID cards can now be read and validated via the ANTS 2D-Doc Data Matrix on Web, iOS, and Android.
    • Console copilot can now create a configured Database Validation step for supported countries.
    • Compliance country questions in the console now group countries by continent and support selecting or clearing an entire continent at once.
    • Prepaid credits now use charge discounts instead of bonus credits: 4% at $250 and 7% at $1,000.
    • React Native SDK 4.5.4 adds iOS dSYM artifacts.

    11 details in Everything

93. docs update Aug 9, 2026 · issue 040

    Didit MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server adds 115 tools spanning AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows., Travel RuleTravel RuleA FATF requirement that cryptocurrency exchanges and other virtual asset service providers must collect and transmit sender and recipient identity data alongside transactions above a threshold amount., webhooks, and billing to Claude

    • Adds a Didit MCP server for Claude (MIT-licensed, source on GitHub) exposing 115 tools across sessions, workflows, AML, Travel Rule, marketplace, lists, webhooks, and billing.
    • Provides a one-click Add Didit to Claude connector that pre-fills the Claude integration dialog for instant setup.

    2 details in Everything

94. docs update Aug 9, 2026 · issue 040

    Didit guarantees a retry on capture-condition failures even when face_liveness_max_attempts: 1 is set

95. docs update seen Aug 1, 2026 · issue 032

    Didit adds custom domain support for white-label verification flows, letting users stay on your subdomain end-to-end.

    └──▷ HOW TO FIND IT
    Set up a branded subdomain so users never see verify.didit.me during identity verification.
    📍In the Business Console, go to White Label → Domain, enter your subdomain (e.g. verify.yourbrand.com), click Add Domain, then copy the Verification CNAME and CloudFront CNAME records shown and add both as CNAME records at your DNS provider (TTL 300). Return to the console and click Verify domain.
    • Adds custom domain support so the identity verification flow can be served from your own subdomain (e.g. verify.yourbrand.com) instead of verify.didit.me, completing a white-label experience.
    • Generates two DNS records (Verification CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. and CloudFront CNAME) automatically in the Business Console for the operator to add at their DNS provider.
    • Provides in-console domain verification with a real-time status panel, including a Verification failed box that identifies the specific missing or misconfigured record.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !While a custom domain is configured, you cannot re-enable the Didit login screen — you must remove the custom domain first.
96. docs update seen Aug 1, 2026 · issue 032

    Didit API adds session deletion, PDF report generation, and KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./mixed session listing across v3 endpoints.

    └──▷ TRY IT
    Permanently delete a KYCKYCKnow Your Customer — a regulatory requirement that financial services verify the identity of their users before granting access, used by cyber tools handling payments or financial data to stay compliant. or KYB session and all its media/data before a data-retention deadline.
    copy

    $ curl -X DELETE "https://verification.didit.me/v3/session/123e4567-e89b-12d3-a456-426614174000/" \
      -H "x-api-key: <your-api-key>"

    Download a compliance PDF report for a finished KYC or KYB session (use -L to follow the 301 if omitting the trailing slash).
    copy

    $ curl -L -o report.pdf "https://verification.didit.me/v3/session/123e4567-e89b-12d3-a456-426614174000/generate-pdf/" \
      -H "x-api-key: <your-api-key>" \
      --max-time 60

    List both KYC and KYB sessions together for a back-office reconciliation export, filtering by status.
    copy

    $ curl "https://verification.didit.me/v3/sessions/?session_kind=all&status=Approved&limit=50&offset=0" \
      -H "x-api-key: <your-api-key>"

    • New DELETE /v3/session/{sessionId}/ endpoint removes KYC or KYB sessions and all associated data (decision, media, extracted fields, feature records) permanently.
    • New GET /v3/session/{sessionId}/generate-pdf/ endpoint renders and downloads a compliance-ready PDF report for finished KYC or KYB sessions, including all executed feature sections and white-label branding.
    • New session_kind filter on GET /v3/sessions/ supports listing user (KYC), business (KYB), or all session types in a single paginated response.
    • Clone response includes new shared_from_session field containing the original session's session_id, with trust_review: false forcing the cloned session to In Review status.

    4 details in Everything

97. docs update seen Aug 1, 2026 · issue 032

    Didit adds Travel RuleTravel RuleA FATF requirement that cryptocurrency exchanges and other virtual asset service providers must collect and transmit sender and recipient identity data alongside transactions above a threshold amount. compliance, an AI Copilot, sandbox Test Mode, device attestation, and major KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows./transaction monitoring upgrades.

    └──▷ HOW TO FIND IT
    Enable ongoing AML monitoring for a specific user record directly from the Users table without leaving the Console.
    📍In the Console, go to Users, locate the target record, and toggle the Monitoring column switch to On. A cost estimate is shown before the change is saved.
    Choose a smaller Flutter SDK variant to reduce native footprint while keeping the same Dart API.
    yaml copy

    dependencies:
      didit_sdk_core: ^4.5.3   # or didit_sdk_autodetection / didit_sdk_nfc

    • Adds end-to-end Travel Rule handling for crypto transfers: IVMS 101-encrypted sender/recipient exchange, TRP messaging, secure email fallback, VASP directory from the EU register, and self-custody wallet ownership proof across Ethereum-compatible, Solana, Bitcoin, and Tron networks.
    • Introduces Didit Copilot in the Business Console: a resizable AI panel that builds workflows, applies filters, and navigates dialogs via natural language, voice input, file attachments, and persistent conversation history — with explicit user confirmation before any write or delete.
    • Adds ID Verification Data Review: a pre-submission step where applicants confirm or correct extracted document fields, with configurable outcomes by mismatch severity, MRZ-protected fields, full correction history, and optional image retake for camera scans.
    • Introduces full sandbox Test Mode: choose approved/declined/in-review scenarios per feature group, run business-verification registry scenarios, upload sample documents, use any OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. code, and assert the armed scenario via sandbox_scenario in the v3 decision payload — no external provider is called.
    • Adds device and capture integrity signals: Apple App Attest and Google Play Integrity attestation, frame-injection detection with attack subtype, virtual-camera risk flagging, and per-workflow policy actions (decline/review/record).

    +7 more show less

    • Expands Business Verification (KYB) with EU VAT validation via VIES, configurable company search with prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it./lock, local business document recognition in 103 countries, Document AI extraction in KYB payloads and PDF reports, and file uploads up to 30 MB.
    • Adds per-record ongoing AML monitoring controls on the Users and Businesses tables: enable/disable from list rows, cost estimates before enabling, deduplication to one monitored record per identity, and bulk-job processing with explicit skip reasons.
    • Connects Transaction Monitoring to native SDK submission with device intelligence, action_required responses, one-selfie biometric step-up remediation using the stored face, workflow/group selection for user-action rules, and sender-vs-receiver field comparisons in rules.
    • Updates native SDKs (iOS, Android, React Native, Flutter) versions 4.0.9–4.5.3: native transaction submission/retrieval, wallet-ownership proof, Test Mode scenario picker from 4.2.0, Swift Package Manager support, and Flutter split packages (didit_sdk_core, didit_sdk_autodetection, didit_sdk_nfc).
    • Expands document coverage with Australia Larrakia Nation ID Card, Northern Territory Proof of Identification Card, Israeli ePassport variant, plus AI extraction for Israeli, Kyrgyzstani, German health insurance cards, New Jersey IDs, Pennsylvania commercial driving licences, and British Columbia IDs.
    • Returns issuing region as ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 3166-2 so callers can distinguish regional documents without parsing text.
    • Adds database validation analytics widgets: match-coverage and latency (median and 95th-percentile) by country and database, with a full-screen world-map coverage view.

    12 details in Everything

98. updated seen Aug 1, 2026 · issue 032

    Didit adds Travel RuleTravel RuleA FATF requirement that cryptocurrency exchanges and other virtual asset service providers must collect and transmit sender and recipient identity data alongside transactions above a threshold amount. compliance, Console Copilot, Test mode sandbox, device integrity attestation, and expanded KYBKYBKnow Your Business — a regulatory compliance process for verifying the legal identity, ownership, and legitimacy of a business entity, used by cyber tools to screen counterparties or customers against fraud and sanctions risk./AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows. capabilities.

    └──▷ HOW TO FIND IT
    Enable ongoing AML monitoring for a specific user directly from the Users table without navigating away.
    📍In the Console, go to Users › find the user row › toggle the Monitoring column switch › review the cost estimate › confirm to enable monitoring.
    Use the modular Flutter SDK variant to include only core verification without NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. or autodetection, reducing native footprint.
    yaml copy

    dependencies:
      didit_sdk_core: ^4.5.3

    • Adds end-to-end Travel Rule compliance: encrypted IVMS 101 sender/recipient exchange, TRP messaging, secure email fallback, VASP directory, self-custody wallet ownership proof, and preset EU Transfer of Funds Regulation rules.
    • Introduces Didit Copilot in the Business Console — a resizable AI panel that builds workflows, applies filters, and navigates dialogs via natural language, voice input, or file attachment, with explicit confirmation gates for writes/deletes.
    • New applicant ID Verification Data Review step lets users confirm or correct extracted document fields before submission, with configurable outcomes by mismatch severity, MRZ-protected fields, and full correction history in session details.
    • Adds complete Test mode for sandbox applications: choose approved/declined/in-review scenarios, upload sample documents, enter any OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., and assert the armed scenario via sandbox_scenario in the v3 decision payload — no external providers contacted.
    • New Device & Capture Integrity signals: Apple App Attest and Google Play Integrity attestation, frame injection detection with attack subtype reporting, virtual-camera risk flagging, and per-workflow policy actions (decline/review/record).

    +5 more show less

    • Business Verification (KYB) adds EU VAT validation via VIES, configurable company-search field prefillprefillThe first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it./lock, local business document names in 103 countries, Document AI extraction results in KYB payloads and PDF reports, and file uploads up to 30 MB.
    • Ongoing AML monitoring can now be enabled or disabled per user or business record directly from the Users and Businesses tables, with cost preview before enabling, deduplication of monitored records, and transparent bulk-job skip reasons.
    • Transaction monitoring now supports native SDK submission with device intelligence attached, biometric one-selfie step-up remediation, sender/receiver field comparison in rules, and custom lists in text rules.
    • Native SDKs (versions 4.0.9–4.5.3) add transaction submission/retrieval with automatic user actions, wallet-ownership proof, Swift Package Manager support for iOS in React Native and Flutter, modular Flutter variants (didit_sdk_core, didit_sdk_autodetection, didit_sdk_nfc), and Arabic RTLRTLRegister Transfer Level, a hardware design abstraction describing how data moves between registers each clock cycle; cyber tools use it to analyze or synthesize digital circuits from HDL source. + Hebrew localization.
    • AI extraction expanded to Israeli and Kyrgyzstani documents, German health insurance cards, New Jersey IDs, Pennsylvania commercial driving licences, Australia's Larrakia Nation ID Card, and Northern Territory Proof of Identification Card.

    10 details in Everything

99. docs update seen Jul 24, 2026 · issue 024

    Didit adds phone and email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. verification APIs with intelligence reporting, risk actions, and sandbox support

    └──▷ TRY IT
    Verify a phone OTP and apply a DECLINE policy for VoIP numbers to block high-risk signups at the verification step.
    copy

    $ curl -X POST https://api.didit.me/v3/phone/verify/ \
      -H "x-api-key: <your-api-key>" \
      -H "Content-Type: application/json" \
      -d '{
        "phone_number": "+14155550123",
        "code": "847291",
        "voip_number_action": "DECLINE",
        "disposable_number_action": "NO_ACTION"
      }'

    Verify an email OTP and automatically decline breached addresses to prevent account takeover via compromised credentials.
    copy

    $ curl -X POST https://api.didit.me/v3/email/verify/ \
      -H "x-api-key: <your-api-key>" \
      -H "Content-Type: application/json" \
      -d '{
        "email": "user@example.com",
        "code": "123456",
        "breached_email_action": "DECLINE",
        "disposable_email_action": "DECLINE"
      }'

    • New POST /v3/phone/verify/ endpoint verifies OTPs and returns phone intelligence: carrier name, line type, VoIP/disposable flags, and duplicate usage across sessions.
    • New POST /v3/email/verify/ endpoint verifies OTPs and returns email intelligence: deliverability status, breach exposure (is_breached + breaches list), disposable-provider detection, and duplicate usage across sessions.
    • Configurable risk actions (duplicated_phone_number_action, disposable_number_action, voip_number_action for phone; duplicated_email_action, breached_email_action, disposable_email_action for email) let you set DECLINE or NO_ACTION per risk type to control whether a detected risk terminates or merely flags a verification.
    • 3-attempt budget enforced on both phone and email OTP checks: first two wrong codes return Failed with remaining attempts; third wrong code finalizes as Declined with a dedicated warning code.
    • Sandbox mode for both verify endpoints: any well-formed code returns a static Approved payload without persisting state or calling providers.

    +2 more show less

    • Finalized OTP checks persist to the originating session (visible in Business Console, queryable via GET /v3/session/{sessionId}/decision/) and fire a status.updated webhook.
    • Backend-only resubmit throttle: resubmitting a session for backend-only features (AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows., DATABASE_VALIDATION, IP_ANALYSIS) within 30 seconds now returns a structured error with a Retry-After interval instead of silently repeating.

    7 details in Everything

100. docs update seen Jul 24, 2026 · docs issue 004

     Didit adds phone and email OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. verification APIs with intelligence reporting, risk actions, and sandbox support

     └──▷ TRY IT
     Verify a phone OTP and apply a DECLINE policy for VoIP numbers to block high-risk signups at the verification step.
     copy

     $ curl -X POST https://api.didit.me/v3/phone/verify/ \
       -H "x-api-key: <your-api-key>" \
       -H "Content-Type: application/json" \
       -d '{
         "phone_number": "+14155550123",
         "code": "847291",
         "voip_number_action": "DECLINE",
         "disposable_number_action": "NO_ACTION"
       }'

     Verify an email OTP and automatically decline breached addresses to prevent account takeover via compromised credentials.
     copy

     $ curl -X POST https://api.didit.me/v3/email/verify/ \
       -H "x-api-key: <your-api-key>" \
       -H "Content-Type: application/json" \
       -d '{
         "email": "user@example.com",
         "code": "123456",
         "breached_email_action": "DECLINE",
         "disposable_email_action": "DECLINE"
       }'

     • New POST /v3/phone/verify/ endpoint verifies OTPs and returns phone intelligence: carrier name, line type, VoIP/disposable flags, and duplicate usage across sessions.
     • New POST /v3/email/verify/ endpoint verifies OTPs and returns email intelligence: deliverability status, breach exposure (is_breached + breaches list), disposable-provider detection, and duplicate usage across sessions.
     • Configurable risk actions (duplicated_phone_number_action, disposable_number_action, voip_number_action for phone; duplicated_email_action, breached_email_action, disposable_email_action for email) let you set DECLINE or NO_ACTION per risk type to control whether a detected risk terminates or merely flags a verification.
     • 3-attempt budget enforced on both phone and email OTP checks: first two wrong codes return Failed with remaining attempts; third wrong code finalizes as Declined with a dedicated warning code.
     • Sandbox mode for both verify endpoints: any well-formed code returns a static Approved payload without persisting state or calling providers.

     +2 more show less

     • Finalized OTP checks persist to the originating session (visible in Business Console, queryable via GET /v3/session/{sessionId}/decision/) and fire a status.updated webhook.
     • Backend-only resubmit throttle: resubmitting a session for backend-only features (AMLAMLAnti-Money Laundering: a set of laws, regulations, and procedures that financial institutions must follow to detect and report suspicious financial activity; cyber tools use it to automate transaction monitoring and compliance workflows., DATABASE_VALIDATION, IP_ANALYSIS) within 30 seconds now returns a structured error with a Retry-After interval instead of silently repeating.

     7 details in Everything

101. updated seen Jul 13, 2026 · issue 014

     Didit June 2026: Document AI custom verification, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. v5, PACE NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. on Android, new transaction rule operators, and brand import.

     └──▷ TRY IT
     Use the decision endpoint to retrieve AI-extracted fields from a custom document type after a verification session completes.
     copy

     $ curl -X GET https://api.didit.me/v1/sessions/{session_id}/decision \
       -H "Authorization: Bearer <org_scoped_user_token>" \
       -H "Accept: application/json"

     Install the Didit MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server v5 in Cursor so AI agents can run verifications and screen wallets using scoped access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
     📍In Cursor, open Settings › MCP Servers › Add Server, search for Didit in the marketplace, and install the Didit plugin. Authenticate with your credentials — the server exchanges them for a narrowly-scoped token automatically.
     Add a regex-based rule condition to flag transactions whose reference field matches a suspicious pattern, using the new regex operator in the Console rule editor.
     📍In the Business Console, go to Transaction Rules › New Rule › Add Condition, set the field to your target attribute, select the regex operator, and enter your pattern (e.g. ^[A-Z]{2}\d{6}$). Save and publish the rule.
     • New Document AI Verification: define custom document types (contracts, licenses, certificates) with configurable extraction fields — no template required — and results are returned via decision/events endpoints and webhooks.
     • Auto-suggest extraction fields by uploading a sample document; the AI proposes fields for you directly in the workflow builder.
     • Document AI results surface in a dedicated Console section on session details, showing every extracted field, and full-name fields can be matched against the verified identity.
     • Document AI custom verification step available natively on iOS, Android, React Native, and Flutter (SDK 4.0.7+).
     • PACE NFC support on Android: passports and IDs protected with PACE can now be read over NFC.

     +21 more show less

     • New Social Security Card document type supported across iOS, Android, React Native, and Flutter SDKs.
     • AI-powered data extraction enabled for ~300 additional document types, focused on Arabic-speaking countries and historically lower-accuracy document types.
     • Transaction detail page redesigned with counterparty flow cards, state-aware rule rows, paginated related-transactions table, and threshold-colored score pill.
     • Transaction rule engine adds date comparisons, regex matching, fuzzy matching, and in (list match) operators — available in both the API and Console rule editor.
     • Real-time updates for transaction lists and detail views — no manual refresh needed.
     • MCP Server v5.0.0: ships with a registry manifest and Cursor plugin, aligned with OpenAI app review guidelines for marketplace installation.
     • Scoped access tokens for MCP agents: agents exchange credentials for narrowly-scoped tokens via standard token-exchange flow.
     • White-label brand import: enter your website URL and Didit automatically detects your logo, colors, and fonts and maps them onto the verification flow.
     • New Notifications preferences matrix in Account Settings: per-event, per-channel toggles, test-notification firing, Slack disconnect, and throttled webhook-failure alerts (max one per 30 minutes).
     • Organization-level list API: query sessions, businesses, transactions, and cases across all applications in your organization, with each record attributed to its application.
     • Column-visibility toolbar added to Users and Businesses tables in the Console.
     • Field blurring for data minimization now available for all countries (previously EU-only).
     • CSV imports now report row-level errors before committing, and imported records carry an Imported badge.
     • Console sessions remain active for ~30 days via silent renewal.
     • Business Console now available in Italian.
     • Published questionnaires can now be renamed.
     • Questionnaire fields validate format inline as the user types, with inline error messages.
     • Guided post-signup onboarding wizard and self-driving guided tour added.
     • Demo environment seeded with 1,000+ realistic sessions for Console exploration.
     • Sandbox template gallery: select a test persona to auto-set country and document type.
     • Changing your password now signs out all other active Console sessions.

     26 details in Everything