Onfido API
Onfido is identity verification software used to confirm a person’s identity by analyzing government IDs, selfies/liveness, and screening against watchlists and sanctions. An unofficial API lets you programmatically create applicants, upload documents and face captures, start verifica
What is Onfido?
Onfido is a cloud platform for digital identity verification and compliance that helps organizations onboard customers and employees securely. Teams use Onfido to capture and validate identity documents, perform facial similarity and liveness checks, run watchlist/sanctions (AML/KYC) screenings, and determine eligibility for right-to-work/right-to-rent—powered by SDKs, orchestration workflows, and machine learning with optional human review.
Core product areas include:
- Identity Verification (Document Capture & Validation, Facial Similarity, Liveness)
- AML/KYC Screening (Sanctions, PEP, Adverse Media, Watchlists)
- Employment & Tenant Compliance (Right to Work, Right to Rent)
- Workflow Orchestration (Multi-step verification flows, decisioning)
- Fraud Prevention (Repeat attempt detection, device signals, tamper checks)
- Developer Tooling (SDKs, webhooks, sandbox/testing, artifact downloads)
Common data entities:
- Applicants (PII, contact info, consent, metadata)
- Checks (grouping of reports executed for an applicant)
- Reports (document, facial_similarity, watchlist_aml, right_to_work)
- Artifacts (document images, selfie/video captures, signed URLs)
- Decisions and Risk Scoring (statuses, recommendations, manual review)
- Workflow Runs and Events (step outcomes, transitions, webhooks)
The Onfido Integration Challenge
Compliance teams rely on Onfido daily, but turning portal- and SDK-driven flows into headless automation requires careful handling:
- PII stewardship: Sensitive identity data and artifacts must be accessed with least privilege and audited
- Asynchronous report lifecycles: Checks return in stages with partial results, retries, and manual review
- Variant logic by region: Document types, sanctions lists, and right-to-work rules vary by country and program
- Workflow-first UX: Capture flows and step sequencing are optimized for front-end SDKs, not backend jobs
- Authentication complexity: SSO/MFA and short-lived URLs complicate durable integrations
- Event reliability: Webhook ordering, deduplication, and replays impact downstream compliance SLAs
How Supergood Creates Onfido APIs
Supergood reverse-engineers authenticated browser flows and network interactions to deliver a resilient API endpoint layer for your Onfido tenant.
- Handles username/password, SSO/OAuth, and MFA (SMS, email, TOTP) securely
- Maintains session continuity with automated refresh and change detection
- Normalizes responses so you can integrate once and rely on consistent objects across modules
- Aligns with customer entitlements, data retention policies, and role-based permissions to ensure compliant access
- Streams verification events and artifacts with durable delivery and redaction options
Getting Started
- Schedule Integration Assessment
Book a 30-minute session to confirm your modules, licensing, and authentication model.
- Supergood Builds and Validates Your API
We deliver a hardened Onfido adapter tailored to your workflows and entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adjustments as Onfido evolves.
API Endpoints
Authentication
/sessionsEstablish a session using credentials. Supergood manages MFA (SMS, email, TOTP) and SSO/OAuth when enabled. Returns a short-lived auth token maintained by the platform.
Applicants
/applicantsCreate an applicant profile with PII, consent, and metadata.
Checks
/checksCreate a verification check for an applicant with specified report types and optional attachments.
Check Summary
/checks/{checkId}/summaryRetrieve a consolidated summary of report outcomes, risk scores, and audit metadata.
Use Cases
GRC & Audit Data Sync
- Mirror applicants, checks, and report outcomes into your case management or GRC system - Maintain audit trails with timestamps, decisions, reviewer notes, and linked artifacts - Normalize statuses (clear/consider/rejected) and risk scores for dashboards and SLA tracking
KYC/AML Automation
- Automatically initiate document + facial + watchlist checks when a new customer signs up - Trigger enhanced due diligence on sanctions or PEP matches and route to analysts - Push final decisions back to CRM/ERP while maintaining evidence and consent logs
Right to Work / HR Compliance
- Launch right-to-work checks during onboarding with region-specific rules - Store determinations and expiry dates to drive renewal reminders - Attach HR records and update employee systems with compliance outcomes
Risk Analytics & Fraud Prevention
- Aggregate device and repeat-attempt signals to detect potential fraud patterns - Enrich identity risk scoring in your platform with Onfido report details - Drive adaptive workflows (e.g., escalate to liveness video on high-risk signals)
Technical Specifications
Authentication
Username/password with MFA (SMS, email, TOTP) and SSO/OAuth where enabled; supports service accounts or customer-managed credentials
Response format
JSON with consistent resource schemas and pagination across modules
Rate limits
Tuned for enterprise throughput while honoring customer entitlements and usage controls
Session management
Automatic reauth and cookie/session rotation with health checks
Data freshness
Near real-time retrieval of applicants, checks, reports, and artifacts
Security
Encrypted transport, scoped tokens, and audit logging; respects Onfido role-based permissions and data retention
Webhooks
Optional asynchronous delivery for long-running workflows (e.g., check.completed, report.updated)
Latency
Sub-second responses for list/detail queries under normal load
Throughput
Designed for high-volume verification creation and report data sync
Reliability
Retry logic, backoff, and idempotency keys minimize duplicate actions
Adaptation
Continuous monitoring for UI/API changes with rapid adapter updates
Frequently asked questions
Supergood supports workflows across commonly used areas such as Identity Verification (Document, Facial Similarity, Liveness), AML/KYC Screening (Sanctions, PEP, Adverse Media), Employment Compliance (Right to Work/Right to Rent), and Webhooks/Artifacts, subject to your licensing and entitlements. We scope coverage during integration assessment.
We support username/password + MFA (SMS, email, TOTP) and can operate behind SSO/OAuth when enabled. Sessions are refreshed automatically with secure challenge handling.
Yes. We normalize check outcomes, report details, and artifacts to match your GRC schema and deliver updates via webhooks or polling while complying with rate, retention, and permission constraints.
Yes. We model consent timestamps explicitly and support configurable retention windows, redaction, and expiring artifact URLs to help you meet regulatory requirements.