Verifix

Principles

What you can rely on

01

Sandbox first

Every account starts with a sandbox key and deterministic test subjects, so you can build the full happy path and every failure branch before go-live.

02

One API, four pillars

KYC, KYB, AML screening, and KYT are resources on the same API with the same auth, error envelope, and pagination.

03

Signed webhooks

Decisions, escalations, and rescreening hits arrive as HMAC-signed events with replay protection and at-least-once delivery.

04

Idempotent writes

Every write accepts an Idempotency-Key, so a retried onboarding never creates a duplicate case or double-bills a verification.

Quickstart

From key to live decision

01

1

Start a free 30-day trial

Create your trial account in the VerifiX portal.

02

2

Pick a journey preset

Reference a preset by its identifier instead of assembling checks yourself. Compliance can edit the preset later without a code change.

03

3

Create a verification

POST the subject and get back a hosted URL, or drive each check yourself if you own the capture UI.

04

4

Handle the webhook

Verify the signature, store the decision and the evidence bundle reference against your customer record, and continue your flow.

05

5

Go live

Swap the sandbox key for a live key after the production checklist is signed off, We walk through the go-live checklist with you before you switch to live keys.

POST /v1/verifications

curl -X POST https://api.verifix.ae/v1/verifications \
  -H "Authorization: Bearer $VERIFIX_API_KEY" \
  -H "Idempotency-Key: onb_9f2a41" \
  -H "Content-Type: application/json" \
  -d '{
    "journey": "uae_vara_retail_individual",
    "subject": {
      "type": "individual",
      "reference": "cust_10241",
      "country": "AE"
    },
    "redirect_url": "https://app.example.ae/onboarding/return"
  }'

201 Created

{
  "id": "ver_01HZY8QK3M4T",
  "status": "awaiting_subject",
  "journey": "uae_vara_retail_individual",
  "hosted_url": "https://flow.verifix.ae/s/8Qk3M4T",
  "expires_at": "2026-03-04T09:12:00Z",
  "checks": [
    { "type": "document", "status": "pending" },
    { "type": "liveness", "status": "pending" },
    { "type": "sanctions_pep", "status": "pending" },
    { "type": "risk_score", "status": "pending" }
  ]
}

POST your webhook endpoint

{
  "type": "verification.completed",
  "created_at": "2026-03-04T09:19:44Z",
  "data": {
    "id": "ver_01HZY8QK3M4T",
    "subject_reference": "cust_10241",
    "decision": "approved",
    "risk": { "score": 24, "band": "low" },
    "checks": [
      { "type": "document", "status": "passed" },
      { "type": "liveness", "status": "passed" },
      { "type": "sanctions_pep", "status": "no_match" },
      { "type": "risk_score", "status": "passed" }
    ],
    "evidence_bundle_url": "/v1/verifications/ver_01HZY8QK3M4T/evidence"
  }
}

Webhook security

Verify every event before you trust it

Signatures are HMAC-SHA256 over the raw request body. Compare in constant time and reject anything that fails.

verify-webhook.ts

import { createHmac, timingSafeEqual } from "crypto";

export function verifyWebhook(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return signature.length === expected.length &&
    timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

Event catalog, retry schedule, and rate limits: "documented in the developer reference"

Integrate once. Change policy without a deploy.