Tenant API (KYC)
API overview
KnowaKYC exposes two public HTTP APIs for tenant-server integration:
- Tenant API (KYC) — manages individual (applicant) verification: creating sessions and verification links, fetching results, OCR data, AML screening, manual review tasks, statistics, and audit data.
- KYB API — a separate surface for business verification (including KYB review tasks). See KYB API.
Both surfaces are served from your tenant API domain. The Tenant API is mounted at /tenant/v1/kyc/..., the KYB API at /tenant/v1/kyb/....
Authentication
All server-to-server requests are signed with HMAC-SHA256.
Required headers:
Authorization: HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>X-Timestamp: <unix_seconds>— allowed clock drift versus the server is ±5 minutes.
The string to sign: timestamp\nmethod\npath\nbody_hash, where body_hash is the lowercase hex SHA256 digest of the raw request body. For bodyless requests, use an empty string.
For the full algorithm description, JavaScript / Python / Go examples, key identifier formats (kyc_live_* / kyc_test_* / kyb_live_* / kyb_test_*), and the list of scopes, see Authentication.
Environments
| Environment | Key prefix | Purpose |
|---|---|---|
| Production | kyc_live_ / kyb_live_ | Real verifications, billing, real webhooks |
| Test | kyc_test_ / kyb_test_ | Sandbox sessions, isolated data, no charge |
Section structure
- Authentication — HMAC, scopes, key rotation.
- Sessions — create, fetch, and cancel verification sessions.
- Applicants — applicant records, history, AML data.
- Documents and media — supported document types, presigned URLs.
- Flows — verification scenario reference (managed in the admin panel).
- Verification links — generating links and QR codes for end users.
- Review tasks — manual review queue and decisions for integrators (HMAC).
- Webhooks — asynchronous event notifications, signature format, retry policy.
- Metrics and analytics — session aggregates, conversion, export.
- Audit — log of API-side actions.
- Errors and limits — error codes, rate limits, OTP parameters.
- API reference (Swagger / OpenAPI) — machine-readable specification.