cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/verifications" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "verification_type": "kyb",
  "workflow_version": "kyb-ca-v1",
  "return_url": "https://client.example.com/verified",
  "processing_context": {
    "product": "insights",
    "workflow_run_id": "wfr_example"
  }
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/verifications",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'verification_type': 'kyb',
 'workflow_version': 'kyb-ca-v1',
 'return_url': 'https://client.example.com/verified',
 'processing_context': {'product': 'insights',
                        'workflow_run_id': 'wfr_example'}},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/verifications", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "verification_type": "kyb",
  "workflow_version": "kyb-ca-v1",
  "return_url": "https://client.example.com/verified",
  "processing_context": {
    "product": "insights",
    "workflow_run_id": "wfr_example"
  }
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "ver_example",
    "object": "verification",
    "subject_id": "biz_example",
    "created_at": "2026-10-22T13:00:00Z",
    "updated_at": "2026-10-22T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "verification_type": "kyb",
    "status": "not_started",
    "hosted_url": "https://verify.example.com/session",
    "workflow_version": "kyb-ca-v1",
    "stop_reason": null,
    "processing_context": {
      "product": "insights",
      "workflow_run_id": "wfr_example"
    },
    "subject_association_version": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  }
}

Identity

Start verification

Start a KYC or KYB session.

Required scope: identity:verify. Return hosted_url when applicable; poll verification ID for result. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. This is a stage of an authorized Insights or Signal workflow. processing_context is required; unrelated, completed, unpaid, cancelled or unentitled contexts return 409 invalid_state. It creates no separate AMLOK charge. The orchestrator deduplicates equivalent stage work within the parent. Person KYC within a business assessment requires processing_context.subject_association_id. Its person_id must match the verification subject; its business_id must match the parent subject. Store the association ID and validated record version on the verification for audit. Pending, rejected, revoked, mismatched or cross-workspace associations cannot authorize a stage. Revocation stops unfinished related-person work. Do not create a second product merely to verify its owner. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

verifications

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/verifications" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "verification_type": "kyb",
  "workflow_version": "kyb-ca-v1",
  "return_url": "https://client.example.com/verified",
  "processing_context": {
    "product": "insights",
    "workflow_run_id": "wfr_example"
  }
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/verifications",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'verification_type': 'kyb',
 'workflow_version': 'kyb-ca-v1',
 'return_url': 'https://client.example.com/verified',
 'processing_context': {'product': 'insights',
                        'workflow_run_id': 'wfr_example'}},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/verifications", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "verification_type": "kyb",
  "workflow_version": "kyb-ca-v1",
  "return_url": "https://client.example.com/verified",
  "processing_context": {
    "product": "insights",
    "workflow_run_id": "wfr_example"
  }
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "ver_example",
    "object": "verification",
    "subject_id": "biz_example",
    "created_at": "2026-10-22T13:00:00Z",
    "updated_at": "2026-10-22T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "verification_type": "kyb",
    "status": "not_started",
    "hosted_url": "https://verify.example.com/session",
    "workflow_version": "kyb-ca-v1",
    "stop_reason": null,
    "processing_context": {
      "product": "insights",
      "workflow_run_id": "wfr_example"
    },
    "subject_association_version": null
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  }
}

Required scope: identity:verify Start a KYC or KYB session. Required scope: identity:verify. Return hosted_url when applicable; poll verification ID for result. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. This is a stage of an authorized Insights or Signal workflow. processing_context is required; unrelated, completed, unpaid, cancelled or unentitled contexts return 409 invalid_state. It creates no separate AMLOK charge. The orchestrator deduplicates equivalent stage work within the parent. Person KYC within a business assessment requires processing_context.subject_association_id. Its person_id must match the verification subject; its business_id must match the parent subject. Store the association ID and validated record version on the verification for audit. Pending, rejected, revoked, mismatched or cross-workspace associations cannot authorize a stage. Revocation stops unfinished related-person work. Do not create a second product merely to verify its owner. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID

string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key

string

required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

application/json

subject_id

string

required

Authorized person or business.

Minimum string length: 1

verification_type

enum<string>

required

kyc or kyb.

Available options:

kyc,

kyb

workflow_version

string

required

Approved ID from GET /v1/configuration workflow_versions, matching this workflow type and product.

Minimum string length: 1

processing_context

object

required

Parent must belong to this workspace. Same-subject stages need no association. Only person KYC may target a different subject: supply an active subject_association_id linking that person to the parent business. Insights requires an unfinished authorized root run; Signal requires an active paid period. Stage scope, consent, association and workload are checked on every attempt. The parent business remains the billing and workload subject. No standalone service or extra charge.

Option 1
Option 2

Show child attributes

return_url

string<uri>

Registered browser redirect after applicant flow; not a webhook URL.

Minimum string length: 1

Pattern: ^https://

Response

Start a KYC or KYB session. Accepted work is not yet complete.

data

verification · object

required

KYC or KYB session and its aggregate result. Population depends on source and tenant entitlement.

Show child attributes

Get started

Endpoints

Essentials

Start verification

Authorizations

Headers

Body

Response