Didit MCP Server

me.didit由 didit.me 發布官方發布者v5.0.1更新於 Oct 24, 2026

KYC, KYB, AML, wallet screening, transaction monitoring, and fraud workflows for AI agents.

已驗證Streamable HTTP可網頁執行安全與監控商業與電商

服務詳細資訊

識別碼: me.didit/mcp
傳輸: Streamable HTTP
執行環境: Web executable
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此服務的命名空間屬於 didit.me，且該網域同時執行其端點。這可以確認發布者，但並不代表該服務的工具是安全的。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/me.didit%2Fmcp.svg)](https://sourceweft.com/mcp/me.didit%2Fmcp?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

Didit 託管的 MCP 伺服器讓 AI 助理在 Didit 工作區中執行 KYC、KYB、AML、錢包篩查與反詐欺流程，並管理驗證工作階段。

可以做什麼: 搜尋與檢視工作階段、交易、供應商使用者及跨應用分析，建立或更新工作階段，並處理審核、批次匯入和 webhook 記錄與重送。執行身分、AML、人臉比對與 KYB 註冊庫查詢等驗證檢查。建立與編輯分支式驗證工作流程，包含功能設定與國家目錄查詢。管理合規事務：交易監控、含回測的規則、名單、案件、報告、稽核記錄與警示。管理工作區：問卷、webhook、成員、帳務與品牌設定。
適用情境: 當助理需要操作 Didit 身分驗證工作區時使用，例如處理工作階段、執行檢查、設定工作流程或處理合規案件，不必手寫 REST 呼叫。
執行需求: 透過 streamable HTTP 連線至 mcp.didit.me 遠端端點。首次連線需在瀏覽器中透過 Didit 主控台完成 OAuth 登入，沒有 API 金鑰模式。需要具備對應組織角色的 Didit 帳號。託管端點上傳檔案使用 base64；路徑方式僅適用於本機執行。自行架設需要 Docker 或 Node。

安裝前請注意

伺服器以登入使用者身分在其所屬的所有組織中依其角色權限行事，需留意授權範圍與角色。許多工具會寫入、修改或刪除資料，包括工作流程編輯、規則變更、webhook 重送與工作階段狀態更新。驗證檢查與持續監控可能產生費用。上傳的身分證件、自拍與銀行資料會傳送至 Didit 服務。

安裝

在 SourceWeft 中

開啟儀表板中的 Didit MCP Server，將其新增到工作區。
連接所需的憑證。它們會被私密儲存，絕不會在公開頁面上展示。
為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/me.didit%2Fmcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "didit": {
      "type": "http",
      "url": "https://mcp.didit.me/mcp"
    }
  }
}

README

Didit MCP Server

The official Model Context Protocol server for Didit — bring KYC, KYB, AML screening, transaction monitoring, biometrics, and full workspace operations to Claude, Cursor, VS Code, Windsurf, Zed, and any MCP client.

140+ tools across sessions, workflows, vendor users/businesses, transactions, networks, the standalone verification APIs, lists, cases, reports, webhooks, and billing.
Auth is "Log in with Didit" (OAuth 2.1 + PKCE) — the MCP acts as the signed-in user with their role's permissions. There is no API-key mode: every tool calls the user-scoped console endpoints, which only accept a Bearer token.
Tools call Didit REST endpoints. Session PDF generation returns a temporary download URL for the original PDF.

Full documentation: https://docs.didit.me/integration/mcp/overview

Session PDF downloads

didit_session_generate_pdf returns download_url, expires_at (UTC), and expires_in (300 seconds). Fetch the URL without an Authorization header to save the original Didit PDF. The server checks PDF access before issuing the link and fetches the original report again at download time using the same user and organization. It does not reconstruct the report from session data. If the session changes between issuance and download, the download reflects the current report. Revoked or expired user access can invalidate a link before its five-minute expiry.

Deployments must set MCP_PDF_DOWNLOAD_KEY to 32 cryptographically random bytes encoded as 64 hexadecimal characters, shared across all replicas, and set MCP_RESOURCE_URI to the public HTTPS MCP endpoint. Route /downloads/session-report.pdf to this HTTP server. The authenticated-encryption key protects the credentials embedded in the session-scoped link; rotating it invalidates outstanding links. Treat links as secrets and redact the token query parameter in proxy/access logs. Responses use Cache-Control: no-store.

Stdio deployments need a reachable HTTP deployment with the same key, API base URL, and MCP_RESOURCE_URI; stdio alone cannot serve download links. Missing key configuration produces an actionable tool error instead of inline PDF data.

Quick start

Hosted (recommended)

No install, no API key — point your client at the hosted URL and sign in via the browser:

Claude Code

Cursor (~/.cursor/mcp.json)

Windsurf / Zed (via the mcp-remote bridge)

json

{ "mcpServers": { "didit": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://mcp.didit.me/mcp"] } } }

{ "mcpServers": { "didit": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://mcp.didit.me/mcp"] } } }

See per-client setup for Claude Desktop and VS Code.

Authentication

The MCP is an OAuth 2.1 resource server; the Didit console (business.didit.me) is the authorization server. On first connect your client opens a browser, you Log in with Didit and approve the scopes, and the MCP then acts as you — across every organization you belong to, with your role's permissions. Tokens are short-lived and refreshed automatically.

Scopes: didit:management (workspace operations), didit:verification (running checks) and didit:staff (Didit staff accounts only; the authorization server never issues it to anyone else). Your console role is enforced server-side on every call.

There is no API-key mode. Every tool targets the user-scoped console endpoints (/organization/{org}/application/{app}/…), which authorize a Bearer token with per-role privileges and reject x-api-key. (For raw REST access with an application API key — e.g. creating sessions from your backend — use the REST API directly, not this server.)

See Authentication.

Tools

140+ tools, grouped by area. The full catalogue with read/write/destructive markers is in docs/TOOLS.md and at docs.didit.me. Highlights:

Discovery & cross-app: didit_context_get, didit_session_search, didit_transaction_search, didit_vendor_user_search, didit_analytics — aggregate across every org/app in one call.
Sessions: create, list, get decision, update status, reviews, bulk import, webhook delivery log + resend (didit_session_webhooks waits for a sandbox session's webhook so an integration can be verified end to end).
Verification APIs: didit_verify_id, didit_verify_aml, didit_verify_face_match, didit_verify_kyb_search, …
Workflows (incl. branching graphs): didit_workflow_search, didit_workflow_get_graph, didit_workflow_edit_graph — build conditional/branching workflows (fuzzy-match conditions, Document-AI steps) by sending small ops; large feature configs are kept server-side, never resent. didit_workflow_get_id_verification_methods_catalog and didit_workflow_get_kyb_registry_catalog answer the server-driven questions a config write depends on (which countries offer non-doc lookup / wallets, which KYB data tiers and monitoring a country's registries sell).
Compliance: transaction monitoring, custom and preset rule management with backtesting, lists/blocklist/allowlist, cases, reports, audit logs, alerts.
Workspace: questionnaires, webhooks, members, billing, branding.

File inputs

Tools that consume files (face upload, ID/PoA/liveness/face/age verification, branding) accept the file in one of two forms:

*_path — an absolute path on the machine running the MCP server. Only works for local/stdio runs (e.g. Claude Code with a local server), where your files and the server share a filesystem.
*_base64 — the file content inline, as raw base64 or a data: URL. Use this against the hosted endpoint; it is how the Didit Console Copilot passes chat attachments (its agent resolves attachment references like att_1 into base64 before the call reaches the MCP).

Both forms enforce the same 15MB cap and magic-bytes allow-list (png/jpg/jpeg/webp/gif/bmp/ico/pdf). The hosted transport's JSON body limit is 25MB (MCP_JSON_BODY_LIMIT).

Run it yourself

The hosted server above is the easy path — no install. To self-host, clone this repo and run it with Docker or Node. It authenticates the user the same way (OAuth, or a user Bearer token for headless runs); there is no API-key mode.

bash

git clone https://github.com/didit-protocol/mcp.git && cd mcp
# Docker (recommended) — serves /mcp and /healthz on port 3000docker build -t didit-mcp . && docker run -p 3000:3000 --env-file .env didit-mcp
# …or with Nodenpm install && npm run buildnode dist/http.js                                          # hosted HTTP/OAuthDIDIT_ACCESS_TOKEN=<user-access-token> node dist/index.js  # stdio (headless)

git clone https://github.com/didit-protocol/mcp.git && cd mcp
# Docker (recommended) — serves /mcp and /healthz on port 3000docker build -t didit-mcp . && docker run -p 3000:3000 --env-file .env didit-mcp
# …or with Nodenpm install && npm run buildnode dist/http.js                                          # hosted HTTP/OAuthDIDIT_ACCESS_TOKEN=<user-access-token> node dist/index.js  # stdio (headless)

All Didit base URLs and OAuth endpoints are environment variables with public defaults (verification.didit.me, apx.didit.me, business.didit.me) — override them for a private deployment. See ARCHITECTURE.md and .env.example for the full reference.

Workflow feature configuration

Every workflow feature node takes a config object. The tables below are the complete contract - what didit_workflow_create, didit_workflow_update, didit_workflow_validate_graph, didit_workflow_set_graph and didit_workflow_edit_graph accept, and what the API stores. A key that is not listed here is not part of the contract and is dropped silently on save.

didit_workflow_get_feature_config_schema returns the same data as JSON at runtime.

Generated from schema/feature-config-schema.json (contract sha256:a2c413a50107faf3ea47fa187089a930ac17d3d04893e24176f494a58470e982, schema version 1), which is a copy of the artifact service-didit-verification generates from its feature-config serializers. Do not edit by hand — run npm run schema:readme.

AGE_ESTIMATION

Configuration for Age Estimation feature.

Key	Type	Accepts	Meaning
`borderline_maximum_age_threshold`	integer \| null	integer >=1 <=100
`borderline_minimum_age_threshold`	integer \| null	integer >=1 <=100
`enable_id_verification_fallback`	boolean \| null	boolean
`external_capture_device_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when an external capture device is detected.
`face_audio_recording_enabled`	boolean \| null	boolean	Record the microphone during the selfie capture, so a reviewer can hear the session. Off by default.
`face_liveness_duplicated_face_document_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a duplicate face is found on a user verified with a different date of birth. Another document of the same person (a passport after an identity card, a renewal, a document of a second country) is not flagged.
`face_liveness_duplicated_face_name_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a duplicate face is found under a different name.
`face_liveness_flash_mode`	string \| null	string
`face_liveness_max_attempts`	integer \| null	integer >=1 <=3
`face_liveness_method`	string \| null	'ACTIVE_3D'\|'FLASHING'\|'PASSIVE'
`face_liveness_multiple_faces_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when more than one face is present in the capture.
`face_liveness_possible_duplicated_face_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this face matches a previously seen user.
`face_liveness_score_decline_threshold`	number \| null	number
`face_liveness_score_review_threshold`	number \| null	number
`face_liveness_uncertain_retry_enabled`	boolean \| null	boolean	Native SDK active liveness only. On, a capture whose liveness score falls strictly between face_liveness_score_decline_threshold and face_liveness_score_review_threshold is never decided, whichever verdict the engine attached to it: the person is told the result was unclear and asked to capture again, every time, outside the face_liveness_max_attempts budget (which still applies to captures the engine could not score). Off by default; the web flow ignores it.
`face_liveness_video_anomaly_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the stored liveness recording contains a repeated moving sequence consistent with a looped video feed, measured server-side from the video itself, independently of the liveness score. It deliberately does NOT flag a frozen or near-motionless capture: frame statistics cannot separate an injected still from a genuine one (a subject holding still, or a flash that clips the exposure), so acting on that would decline real users. A frozen or pre-recorded injected feed is instead defeated by strict flash liveness (set face_liveness_flash_mode to "1" for strict), which binds the capture to a per-session colour-sequence challenge a recording cannot reproduce. Defaults to NO_ACTION (evidence is recorded, the verdict is unchanged).
`face_luminance_max_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is brighter than `face_luminance_max_threshold`.
`face_luminance_max_threshold`	integer \| null	integer >=0 <=100
`face_luminance_min_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is darker than `face_luminance_min_threshold`.
`face_luminance_min_threshold`	integer \| null	integer >=0 <=100
`face_privacy_mode_enabled`	boolean \| null	boolean
`face_quality_decline_threshold`	integer \| null	integer >=0 <=100
`face_quality_review_threshold`	integer \| null	integer >=0 <=100
`face_search_enabled`	boolean \| null	boolean	Run the 1:N Face Search on the selfie: match it against previously verified users, the face blocklist and allowlist, and store its biometric template for later matching. On by default. Off skips the search, keeps no face template, and leaves the duplicate-face actions with nothing to act on.
`frame_injection_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when injected video frames are detected.
`minimum_age_threshold`	integer \| null	integer >=1 <=100
`screen_capture_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is a photo of a screen.
`status_rules`	array	array
`virtual_camera_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a virtual camera feed is detected.

AML

Configuration for AML feature (used for both KYC AML and KYB Company AML).

Key	Type	Accepts	Meaning
`aml_country_weight`	integer \| null	integer >=0 <=100
`aml_dob_weight`	integer \| null	integer >=0 <=100
`aml_entity_type`	string \| null	'company'\|'person'	Whether this node screens a `person` or a `company`. Defaults to `person` on a person (KYC) workflow and to `company` on a business (KYB) workflow. Set it to `company` to screen the business named in an uploaded document (via `aml_field_sources`) without a KYB Registry step - the provider searches company records instead of people, and the match score is scored as a company.
`aml_field_sources`	json \| null	{"full_name"\|"date_of_birth"\|"nationality"\|"document_number": {"source": "document_ai"\|"questionnaire"\|"expected_data", "key": "\|\|expected_details.<expected_details field>\|metadata."}}	Where this node reads the entity it screens, when the workflow has no ID Verification or KYB Registry step to supply it - a Document AI workflow over non-standardised documents (a tax certificate, an acta constitutiva). Same contract as `database_validation_field_sources`: `source` names the producer and `key` names the value inside it - a Document AI field key for `document_ai`, a questionnaire node id for `questionnaire`, and `expected_details.<field>` or `metadata.<key>` for `expected_data`. The map's KEY is one of the four AML screening inputs: `full_name`, `date_of_birth`, `nationality`, `document_number` - read for a company as legal name, incorporation date, country and registration number. A Document AI field already keyed as one of those four maps automatically and is deliberately not persisted, so renaming it never freezes a stale mapping. An explicit mapping wins over both the auto-map and the ID document, and a mapping that resolves to nothing at runtime leaves the input empty rather than falling back. With no ID Verification and no KYB Registry upstream, `full_name` must be fillable or the graph is rejected on save: there is no search without a name.
`aml_incomplete_data_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the screening ran on less than a full identity (name, date of birth and country). `REVIEW` is the default and the historical behaviour; `NO_ACTION` proceeds on reduced data for a workflow that knowingly holds only a name. The screening still runs either way, and the partial-data log is still recorded - this only decides what it does to the status.
`aml_match_score_threshold`	integer \| null	integer >=0 <=100
`aml_name_weight`	integer \| null	integer >=0 <=100
`aml_score_approve_threshold`	integer \| null	integer >=0 <=100
`aml_score_review_threshold`	integer \| null	integer >=0 <=100
`case_blueprint`	uuid \| null	uuid	Which case blueprint the automatically-created case is built from. Only meaningful with `create_cases_on_hit`; the account default is used when unset.
`create_cases_on_hit`	boolean \| null	boolean	Open a case automatically when the screening returns a hit, instead of leaving the hit to be triaged from the session. Off by default.
`fallback_to_native`	boolean \| null	boolean
`is_aml_ongoing_monitoring_enabled`	boolean \| null	boolean	Keep screening the PERSON after the session is approved, raising a new hit when they later appear on a watchlist. Off by default.
`kyb_company_aml_country_weight`	integer \| null	integer >=0 <=100
`kyb_company_aml_dob_weight`	integer \| null	integer >=0 <=100
`kyb_company_aml_match_score_threshold`	integer \| null	integer >=0 <=100
`kyb_company_aml_name_weight`	integer \| null	integer >=0 <=100
`kyb_enable_ongoing_monitoring`	boolean \| null	boolean	The same, for the COMPANY on a KYB workflow. The two switches are independent.
`kyb_score_approve_threshold`	integer \| null	integer >=0 <=100
`kyb_score_review_threshold`	integer \| null	integer >=0 <=100
`provider_key`	string \| null	string
`status_rules`	array	array

BANK_VERIFICATION

Configuration for Bank Verification feature.

Bank Verification confirms who owns a bank account against an identity ANOTHER step established - it is not identity proof on its own. Put ID Verification, Database Validation or a questionnaire before it; first in a graph it has nothing to compare against and can only return unknown. The node is opt-in and runs nothing while bank_countries is empty.

Key	Type	Accepts	Meaning
`bank_account_selection`	string \| null	'auto'\|'user'	Whether the user picks which of the connected accounts is verified (`user`) or the first eligible one is taken (`auto`).
`bank_allow_skip`	boolean \| null	boolean	Let the user skip the step instead of connecting a bank. A skip is then decided by `bank_skipped_action`.
`bank_attempts_exhausted_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the user spent `bank_max_attempts` without a successful connection.
`bank_business_account_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the institution types the holder as a business rather than a person.
`bank_connection_timeout_minutes`	integer \| null	integer >=5 <=60	How long a started connection stays open before the attempt is abandoned, 5 to 60 minutes.
`bank_consent_expired_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the bank consent lapses after the step was already decided. Only meaningful with `bank_refresh_enabled`.
`bank_countries`	json \| null	{"": {"enabled": true\|false, "institutions": ["<institution_id>", ...] \| "all"}}	Which countries a user may connect a bank in - a WHITELIST, so an empty map means the node offers nothing and runs nothing. `institutions` narrows the picker to specific provider institution ids; `"all"` offers every identity-capable bank in the country. Coverage belongs to the route the node selected in `provider_key`: a country the native route or the connected marketplace provider cannot establish account ownership in is REFUSED on save rather than dropped, because connecting to a bank that returns no holder identity spends an attempt and a charge to end at `not_verifiable`.
`bank_country_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the institution's country differs from the expected/document country.
`bank_currency_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the account currency is not in `bank_expected_currencies`.
`bank_eligible_account_types`	array \| null	array	Which account types the user may pick. Credit cards, loans and investment accounts are never eligible - they do not establish ownership of a payment account. Defaults to current/checking.
`bank_expected_currencies`	array \| null	array	ISO 4217 currencies the account is expected to be in. Empty means any; a mismatch is reported through `bank_currency_mismatch_action`.
`bank_field_sources`	json \| null	{"full_name"\|"first_name"\|"last_name"\|"address": {"source": "document_ai"\|"questionnaire"\|"expected_data", "key": "\|\|expected_details.<expected_details field>\|metadata."}}	Where to read a reference-identity field when no earlier step in the graph can fill it. The map's KEY is one of `full_name`, `first_name`, `last_name`, `address`; `source` names the producer and `key` names the value inside it - a Document AI field key for `document_ai`, a questionnaire node id for `questionnaire`, and `expected_details.<field>` or `metadata.<key>` for `expected_data`. An `expected_details.<field>` VALUE may only name a field the session-create payload actually carries - `address`, `country`, `date_of_birth`, `first_name`, `gender`, `id_country`, `identification_number`, `ip_address`, `last_name`, `nationality` or `poa_country`. A malformed entry is refused on save, not dropped.
`bank_joint_account_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the account has more than one holder.
`bank_low_balance_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the available balance is below `bank_min_balance`. Needs the `balances` scope.
`bank_max_attempts`	integer \| null	integer >=1 <=5	How many connection attempts the user gets, 1 to 5. Spending them all without a successful connection is `bank_attempts_exhausted_action`.
`bank_min_balance`	number \| null	number >=0	Minimum available balance, in the account's own currency. Below it `bank_low_balance_action` fires. Needs the `balances` scope and the save is refused without it. 0 is a real cutoff - it triggers the action for an overdrawn account - but the action defaults to `NO_ACTION`, so the verdict is unchanged unless another action is configured. This is not the same as leaving the key out.
`bank_name_match_threshold`	integer \| null	integer >=50 <=100	At or above this score the holder name is a match. 50 to 100, defaults to 85.
`bank_no_match_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the account holder is demonstrably not the verified person (best name score below `bank_partial_match_floor`).
`bank_not_verifiable_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the institution connected but returned no holder identity to compare.
`bank_partial_match_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the holder name lands between `bank_partial_match_floor` and `bank_name_match_threshold`. Never approves by default.
`bank_partial_match_floor`	integer \| null	integer >=0 <=99	Below this score the holder name is a no-match. 0 to 99, defaults to 70. The band between the floor and the threshold is the partial match, so the floor must be strictly below `bank_name_match_threshold` or the save is refused. An explicit null means "use the default" here too, which is why a threshold of 50 with no floor is refused: it is checked against the default floor of 70.
`bank_reference_identity`	string \| null	'auto'\|'database_validation'\|'expected_details'\|'kyc'\|'questionnaire'	Which earlier step supplies the identity the account holder is compared against: `kyc` (ID Verification), `database_validation`, `expected_details` (the session-create payload), `questionnaire`, or `auto` to use whichever one the workflow produced. The step that actually supplied it is recorded on the result as `reference_identity_source`.
`bank_reference_identity_missing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no earlier step produced an identity to compare the holder against, so ownership can only be `unknown`.
`bank_refresh_enabled`	boolean \| null	boolean	Re-fetch the account's financial data after the step has already been decided, for as long as the bank consent lasts. Needs at least one of the `balances`, `transactions` or `income` scopes and the save is refused without one. A consent that lapses afterwards is `bank_consent_expired_action`.
`bank_require_address_match`	boolean \| null	boolean	Also require the holder's address to match. A name that reached the threshold but whose address scores below it drops to a partial match. An institution that returns no address waives the requirement; a session with no address of its own to compare against does not, and lands on a partial match. Off by default.
`bank_require_oauth_only`	boolean \| null	boolean	Offer only institutions reachable over OAuth / app-to-app, never a provider's legacy credential-capture surface. Where open banking already makes OAuth the only route, this changes nothing.
`bank_scopes`	json \| null	{"ownership": true, "identifiers": true\|false, "balances": true\|false, "transactions": true\|false, "income": true\|false}	What the user is asked to consent to sharing. `ownership` is what the product verifies and cannot be turned off. `identifiers` unmasks the IBAN / account number; `balances`, `transactions` and `income` read real financial data, are each billed separately, and are refused on save unless the application carries the `bank_financial_data` entitlement. A scope that is off is never requested from the provider, so the bank never shows it on its consent screen.
`bank_show_match_result_to_user`	boolean \| null	boolean	Show the ownership result to the user inside the verification flow. Off means it is recorded on the session but never shown to them.
`bank_skipped_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the user skipped the step. Only reachable with `bank_allow_skip`.
`bank_store_full_identifiers`	boolean \| null	boolean	Store the account identifiers unmasked rather than masked. Needs the `identifiers` scope and the save is refused without it. Even then the unmasked form is only served to a caller holding the bank-verification read permission.
`bank_store_raw_owner_data`	boolean \| null	boolean	Keep the holder details the institution returned next to the ownership evidence. Off means only the comparison itself is retained: scores, match method and reason codes.
`bank_transactions_history_days`	integer \| null	integer >=30 <=365	How far back transaction history is read, 30 to 365 days, defaulting to 90. Needs the `transactions` scope and the save is refused without it.
`bank_unknown_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the evidence could not be fetched after retries - a transient failure.
`bank_unsupported_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user's bank is not supported and the node does not allow skipping.
`bank_use_provider_score`	boolean \| null	boolean	Also read the institution's own holder-name score, and let it decide when it is higher than Didit's or when Didit had no holder name to score at all. A result decided that way reports `provider_only` as its match method, and a connection that returned no such score records a `provider_score_unavailable` warning. On by default.
`fallback_to_native`	boolean \| null	boolean	Whether a marketplace connection that cannot be established falls back to Didit's native route. Off by default: a silent fallback would spend your Didit balance on a session you expected to run on your own provider contract. A fallback connection is recorded as `credential_source = native` and billed at the native price.
`provider_key`	string \| null	string	Which route runs the step. Empty (the default) is Didit's native Bank Verification, a provider-independent product Didit routes to the regional open-banking vendor that serves the user's country and institution, on Didit's contracts and billing. A value names a MARKETPLACE provider whose own credentials this application has connected - the session then runs, is billed and is revoked on your provider account, and Didit charges only the marketplace platform fee. A provider that is not connected is refused on save.
`status_rules`	array	array

DATABASE_VALIDATION

Configuration for Database Validation feature.

The node is opt-in and does nothing while database_validation_countries is empty - the editor blocks publishing in that state and the compliance check reports it as a gap. Place it after the step that produces its inputs (usually OCR), and use database_validation_field_sources only for inputs no upstream step can fill.

Key	Type	Accepts	Meaning
`database_validation_countries`	json \| null	{"": {"services": ["<service_id>", ...]}}	The databases to check, per country - this node runs NOTHING until at least one country carries at least one service id. Service ids come from the country's live catalog (e.g. `bra_cpf` for BRA); ids that do not belong to the named country, and countries with no live service, are dropped on save. The legacy `{"<ISO3>": "one_by_one"\|"two_by_two"\|"not_enabled"}` shape is still accepted and auto-expanded to that country's live services.
`database_validation_field_sources`	json \| null	{"<db_validation_input_field>": {"source": "document_ai"\|"questionnaire"\|"expected_data", "key": "\|\|expected_details.<expected_details field>\|metadata."}}	Where to read a database input that no earlier step in the graph can fill. `source` names the producer and `key` names the value inside it: a Document AI field key for `document_ai`, a questionnaire node id for `questionnaire`, and `expected_details.<field>` or `metadata.<key>` for `expected_data`. The two halves speak different vocabularies: the map's KEY is a Database Validation input field (`tax_id`, `document_number`, ...), while an `expected_details.<field>` VALUE may only name a field the session-create payload actually carries - `address`, `country`, `date_of_birth`, `first_name`, `gender`, `id_country`, `identification_number`, `ip_address`, `last_name`, `nationality` or `poa_country`. Anything else under `expected_details.` is rejected on save; `metadata.<key>` takes any non-empty whitespace-free customer key. Exact-key matches against an upstream step resolve automatically and are deliberately not persisted, so renaming a Document AI field never freezes a stale mapping into the config. A malformed entry is dropped on save rather than rejected, which un-satisfies its service and drops it from the selection.
`database_validation_no_match_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the database returns no match at all.
`database_validation_not_applicable_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no selected database covers the holder's country or document.
`database_validation_partial_match_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the database matches some, but not all, of the submitted fields.
`status_rules`	array	array

DOCUMENT_AI

Configuration for the Document AI feature.

At most 3 documents per node, field keys unique within a document, and at most one field per document may set is_full_name (it is optional - a document may mark none).

Key	Type	Accepts	Meaning
`document_ai_document_tampering_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the document looks tampered with.
`document_ai_documents`	array	array
`document_ai_max_attempts_exceeded_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the user runs out of `document_ai_max_retry_attempts`.
`document_ai_max_retry_attempts`	integer \| null	integer >=2 <=5
`document_ai_missing_required_fields_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a field marked `required` could not be extracted.
`document_ai_name_match_score_threshold`	integer \| null	integer >=0 <=100
`document_ai_name_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the field flagged `is_full_name` disagrees with the verified identity's full name, scored against `document_ai_name_match_score_threshold`.
`document_ai_unreadable_document_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the uploaded document cannot be read at all.
`document_ai_unsupported_file_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the uploaded file type is not supported.
`status_rules`	array	array

EMAIL_VERIFICATION

Configuration for Email Verification feature.

Key	Type	Accepts	Meaning
`breached_email_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address appears in a known credential breach.
`cross_org_fraud_email_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this address was flagged as fraudulent by another organization in the network.
`disposable_email_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address belongs to a disposable-mail provider.
`duplicated_email_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address was already verified for this application.
`email_alphanumeric_code`	boolean \| null	boolean
`email_code_size`	integer \| null	integer >=4 <=8
`email_enrichment_enabled`	boolean \| null	boolean
`email_intelligence_score_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the enrichment score is worse than `email_intelligence_score_threshold`.
`email_intelligence_score_threshold`	integer \| null	integer >=0 <=100
`email_max_check_attempts`	integer \| null	integer >=1 <=5
`email_max_retries`	integer \| null	integer >=1 <=5
`email_no_social_presence_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the social footprint check (`email_social_enabled`) finds the address registered on none of the platforms it covers.
`email_social_enabled`	boolean \| null	boolean
`frequent_email_breach_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address appears in many breaches.
`only_corporate_emails_allowed`	boolean \| null	boolean
`recent_email_breach_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address appears in a recent breach.
`status_rules`	array	array

FACE_MATCH

Configuration for Face Match feature.

Key	Type	Accepts	Meaning
`face_match_eyes_covered_action`	string	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when calibrated evidence says the eyes region is covered in the selfie. NO_ACTION records evidence without changing Face Match; REVIEW sends Face Match to review; DECLINE declines it. The signal remains shadow-only until the region reports calibrated=true.
`face_match_face_covered_action`	string	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when calibrated evidence says the face region is covered in the selfie. NO_ACTION records evidence without changing Face Match; REVIEW sends Face Match to review; DECLINE declines it. The signal remains shadow-only until the region reports calibrated=true.
`face_match_max_attempts`	integer \| null	integer >=1 <=3
`face_match_mouth_covered_action`	string	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when calibrated evidence says the mouth region is covered in the selfie. NO_ACTION records evidence without changing Face Match; REVIEW sends Face Match to review; DECLINE declines it. The signal remains shadow-only until the region reports calibrated=true.
`face_match_not_computed_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when no face-match score could be produced (missing portrait or selfie).
`face_match_score_decline_threshold`	integer \| null	integer >=0 <=100
`face_match_score_review_threshold`	integer \| null	integer >=0 <=100
`status_rules`	array	array

GEOLOCATION

Configuration for the Precise Location (GEOLOCATION) feature. Every threshold is bounded here rather than in the client: the browser and the native SDKs are told what to collect by the step data this config produces, and a value the server would refuse must never reach a user as a request their device cannot satisfy. The action keys all default to Review rather than Decline. A denied permission, a wide radius or a stale fix is not evidence of fraud, and a default that declined them would make the step a conversion trap.

Key	Type	Accepts	Meaning
`geolocation_accuracy_mode`	string \| null	'approximate_allowed'\|'precise'
`geolocation_allow_qr_handoff`	boolean \| null	boolean
`geolocation_allow_skip`	boolean \| null	boolean
`geolocation_approximate_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user granted an approximate location while `geolocation_accuracy_mode` asks for a precise one.
`geolocation_deep_link_enabled`	boolean \| null	boolean
`geolocation_document_distance_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device position is further from the document address than `geolocation_document_distance_km`. The address is geocoded coarsely, so this is a weak signal.
`geolocation_document_distance_km`	integer \| null	integer >=0
`geolocation_document_distance_unit`	string \| null	'imperial'\|'metric'	The unit the console shows `geolocation_document_distance_km` in. Display only: the stored value is always kilometres and no rule depends on it.
`geolocation_geofence_undetermined_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the position cannot be placed inside or outside the fence because its accuracy circle reaches the boundary. Uncertainty is never reported as being outside.
`geolocation_geofencing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device position, and its whole uncertainty circle, falls outside `geolocation_geofencing_by_country`.
`geolocation_geofencing_by_country`	json \| null	{"": {"allowed": true\|false, "states"?: {"<ISO 3166-2 code>": {"allowed": true\|false}} \| null}}	Country and region allow/deny rules for the device's own position, applied only while `is_geolocation_geofencing_enabled` is true. Same shape as IP Analysis's `ip_geofencing_by_country`, except that `states` keys are ISO 3166-2 codes (`US-NJ`), not state names, because the position is resolved to a subdivision rather than to a provider's city label. A country that is not listed is allowed. Saving a region rule for a country with no published ISO 3166-2 boundaries is rejected rather than silently ignored.
`geolocation_integrity_missing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a native client submitted a position with no device-attestation token. Defaults to No action; web clients are recorded as unsupported rather than missing, because no browser can attest.
`geolocation_ip_distance_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device position and the session's IP location are further apart than `geolocation_ip_distance_km`, after both uncertainty radii are subtracted.
`geolocation_ip_distance_km`	integer \| null	integer >=0
`geolocation_ip_distance_unit`	string \| null	'imperial'\|'metric'	The unit the console shows `geolocation_ip_distance_km` in. Display only: the stored value is always kilometres and no rule depends on it.
`geolocation_low_accuracy_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no attempt established the required precision: the best position has an uncertainty radius wider than `geolocation_max_accuracy_radius_m`, or it reported no radius at all. A position without a radius is never counted as meeting the limit.
`geolocation_max_accuracy_radius_m`	integer \| null	integer
`geolocation_max_accuracy_radius_unit`	string \| null	'imperial'\|'metric'	The unit the console shows `geolocation_max_accuracy_radius_m` in. Display only: the stored value is always metres, no rule depends on it, and the step data only forwards it so a client can show the same unit.
`geolocation_max_age_seconds`	integer \| null	integer
`geolocation_max_attempts`	integer \| null	integer
`geolocation_mock_location_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the operating system reported the position as simulated rather than measured (Android mock provider, iOS simulated-by-software).
`geolocation_permission_denied_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user declined or dismissed the location prompt on every allowed attempt. Defaults to Review: a refusal is a choice, not a fraud signal.
`geolocation_stale_fix_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the position was measured more than `geolocation_max_age_seconds` before the server received it.
`geolocation_timeout_seconds`	integer \| null	integer
`geolocation_unavailable_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no position could be obtained - location services off or restricted, the positioning system returned nothing, the attempt timed out, the user skipped the step, or the client is too old to support it.
`is_geolocation_geofencing_enabled`	boolean \| null	boolean
`status_rules`	array	array

IP_ANALYSIS

Configuration for Device & IP Analysis feature.

Key	Type	Accepts	Meaning
`automation_detected_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the session looks driven by automation rather than a person.
`cross_org_fraud_device_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this device was flagged as fraudulent by another organization in the network.
`cross_org_fraud_ip_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this IP was flagged as fraudulent by another organization in the network.
`device_app_tampered_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the host application binary looks tampered with.
`device_blocklist_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device is on the organization's block list.
`device_debugger_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a debugger is attached to the host application.
`device_emulator_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device is an emulator rather than real hardware.
`device_hooking_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when runtime hooking or instrumentation is detected.
`device_integrity_missing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no platform device-integrity attestation was returned.
`device_rooted_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device is rooted or jailbroken.
`duplicated_device_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this device was already used by another verified user.
`duplicated_ip_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this IP was already used by another verified user.
`expected_ip_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the IP disagrees with the expected IP sent on the session.
`ip_geofencing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the connecting IP's country is not allowed by `ip_geofencing_by_country`.
`ip_geofencing_by_country`	json \| null	{"": {"allowed": true\|false, "states"?: {"<state_code>": {"allowed": true\|false}} \| null}}	Country allow/deny rules for the connecting IP address, applied only while `is_ip_geofencing_enabled` is true. `allowed` is required and must be a real boolean; `states` is optional and null when the country needs no per-state rule. Countries that are not valid ISO3 are dropped on save.
`ip_location_not_determined_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no IP address identifying the end user was recorded, so the session has no IP location at all: country, city, ISP, coordinates and time zone are unavailable, and `ip_geofencing_by_country`, the document-country comparison and the VPN/data-centre checks cannot run. Defaults to `No Action`, which keeps the `IP_LOCATION_NOT_DETERMINED` warning visible on the session without changing its verdict; set `Review` or `Decline` if an unlocated session must not pass.
`ip_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the IP country disagrees with the document's issuing country.
`is_ip_geofencing_enabled`	boolean \| null	boolean
`multiple_devices_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the session was driven from more than one device.
`recovered_device_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the device reports a recovered or restored state.
`status_rules`	array	array
`vpn_detection_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the connection comes through a VPN, proxy or Tor exit.

KYB_DOCUMENTS

Key	Type	Accepts	Meaning
`kyb_document_age_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a document is older than its configured freshness window.
`kyb_document_critical_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a document contradicts the registry on a critical company detail.
`kyb_document_max_attempts_exceeded_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user runs out of `kyb_document_max_retry_attempts`.
`kyb_document_max_retry_attempts`	integer \| null	integer >=1 <=5
`kyb_document_non_critical_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a document contradicts the registry on a minor detail.
`kyb_document_subtype_config`	json \| null	{"<KYB_DOCUMENT_GROUP\|KYB_DOCUMENT_SUBTYPE>": {"enabled": true\|false, "max_age_days": <0-3650>\|-1\|null}}	Per-group or per-subtype switch and freshness window. Keys must be a known KYB document group or subtype code. `max_age_days` is null for the default window, -1 for unlimited, or an integer 0-3650; anything else is rejected.
`kyb_document_tampering_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a company document looks tampered with.
`kyb_required_document_groups`	json \| null	["<KYB_DOCUMENT_GROUP>", ...]	The company paperwork to collect, as a list of document-GROUP codes - each group is satisfied by any one of the document types it covers. The KYB Documents feature refuses to save with an empty list: a node that requires nothing is the same as not having the node.
`status_rules`	array	array

KYB_KEY_PEOPLE

The workflow ids here point at separate KYC workflows: a KYB graph verifies the company, and the people behind it are verified by the linked person workflows.

Key	Type	Accepts	Meaning
`kyb_corporate_ubo_verification_workflow`	uuid \| null	uuid
`kyb_key_people_company_fields`	json \| null	[{"key": "", "label": "", "type": "text"\|"number"\|"date"\|"phone"\|"email", "required": true\|false, "custom": true\|false}]	Which company details are collected for a CORPORATE key person. Same list-of-descriptors shape and same rules as `kyb_key_people_person_fields`.
`kyb_key_people_document_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a key person's document disagrees with the details declared for them.
`kyb_key_people_ownership_required`	boolean \| null	boolean
`kyb_key_people_person_fields`	json \| null	[{"key": "", "label": "", "type": "text"\|"number"\|"date"\|"phone"\|"email", "required": true\|false, "custom": true\|false}]	Which personal details are collected for an individual key person, as an ORDERED LIST of field descriptors (not a map). `key` is required and non-empty; `type` must be one of text, number, date, phone or email; `custom` marks a field the customer added rather than one of the built-ins.
`kyb_key_people_prefill_from_registry`	boolean \| null	boolean	Pre-fill the key-people list from the company registry result, so the customer confirms and corrects rather than typing every officer and shareholder in.
`kyb_notify_parties_by_email`	boolean \| null	boolean
`kyb_officer_verification_workflow`	uuid \| null	uuid
`kyb_reject_if_ubo_rejected`	boolean \| null	boolean
`kyb_require_corporate_ubo_kyb`	boolean \| null	boolean
`kyb_require_officer_kyc`	boolean \| null	boolean
`kyb_require_ubo_kyc`	boolean \| null	boolean
`kyb_reuse_verified_individuals`	boolean \| null	boolean
`kyb_role_config`	json \| null	{"<role_key>": {"enabled"?: true\|false, "require_kyc"?: true\|false, "verification_workflow"?: ""\|null, "allow_skip"?: true\|false}}	Per-role rules for the people behind the company. Role keys come from the existing config - never invent one. A role with `require_kyc: true` MUST also carry a `verification_workflow` (the uuid of a separate KYC workflow) or the save is rejected. A list of `{"role": ..., ...}` entries is accepted as an alternative to the map.
`kyb_shareholder_ownership_threshold`	integer \| null	integer >=0 <=100
`kyb_shareholder_verification_workflow`	uuid \| null	uuid
`kyb_ubo_ownership_threshold`	integer \| null	integer >=0 <=100
`kyb_ubo_verification_workflow`	uuid \| null	uuid
`kyb_wait_for_all_ubos`	boolean \| null	boolean
`status_rules`	array	array

KYB_REGISTRY

Key	Type	Accepts	Meaning
`kyb_accepted_countries`	json \| null	["", ...]	Which company-registry countries the business may be incorporated in, as a list of ISO-2 codes (note: ISO-2 here, unlike the ISO-3 used by the OCR and IP allow-lists). An empty list or null accepts every supported registry.
`kyb_manual_company_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the company could not be found in a registry and was entered by hand.
`kyb_registry_countries_config`	json \| null	{"": {"enabled": true\|false, "tier": "basic"\|"shareholders"\|"ubo"}}	Per-country registry routing configuration. Each enabled country selects the data tier charged when a company is selected. Only tiers marked available by the pricing endpoint can be enabled. At least one country must be enabled: a registry check that searches nowhere is rejected. Manual company entry does not use this configuration and is billed at its own flat fee of USD 0.75 per company.
`kyb_registry_fields_config`	json \| null	{"<registry_field>": {"enabled"?: true\|false, "required"?: true\|false}}	Per-registry-field overrides controlling which company details are collected and which of them are mandatory. Field keys come from the backend's configurable-field catalog (registration_number, incorporation_date, legal_address, vat_number, alternative_names, tax_number, company_type, legal_entity_identifier, location_of_registration, nature_of_business, registered_capital_amount, registered_capital_currency, website, email, phone, ...); an unknown key, or any sub-key other than `enabled` / `required`, is rejected.
`kyb_registry_monitoring_enabled`	boolean \| null	boolean	Keep the COMPANY's registry record under continuous monitoring after a Shareholders or UBO result: changes of status, officers, ownership or address move the session back to review and fire a webhook. Only where the registry provider offers monitoring; USD 2.00 per company per year, cancellable at any time. Off by default.
`kyb_vat_invalid_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the VAT number is rejected by the tax authority.
`kyb_vat_unverified_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the VAT number could not be checked at all.
`status_rules`	array	array

LIVENESS

Configuration for Liveness feature.

Key	Type	Accepts	Meaning
`cross_org_fraud_face_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Deprecated and no longer applied. It treated a face as if it carried a fraud verdict. Use `cross_org_identity_claim_pattern_action`.
`cross_org_identity_claim_pattern_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when other organizations in the network recorded identity-claim events for this same person in which the claimed identity did not match. Review or no action only - a decline set here is downgraded to review.
`external_capture_device_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when an external capture device is detected.
`face_audio_recording_enabled`	boolean \| null	boolean	Record the microphone during the selfie capture, so a reviewer can hear the session. Off by default.
`face_liveness_duplicated_face_document_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a duplicate face is found on a user verified with a different date of birth. Another document of the same person (a passport after an identity card, a renewal, a document of a second country) is not flagged.
`face_liveness_duplicated_face_name_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a duplicate face is found under a different name.
`face_liveness_flash_mode`	string \| null	string
`face_liveness_max_attempts`	integer \| null	integer >=1 <=3
`face_liveness_method`	string \| null	'ACTIVE_3D'\|'FLASHING'\|'PASSIVE'
`face_liveness_mode`	string \| null	string
`face_liveness_multiple_faces_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when more than one face is present in the capture.
`face_liveness_possible_duplicated_face_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this face matches a previously seen user.
`face_liveness_score_decline_threshold`	integer \| null	integer >=0 <=100
`face_liveness_score_review_threshold`	integer \| null	integer >=0 <=100
`face_liveness_uncertain_retry_enabled`	boolean \| null	boolean	Native SDK active liveness only. On, a capture whose liveness score falls strictly between face_liveness_score_decline_threshold and face_liveness_score_review_threshold is never decided, whichever verdict the engine attached to it: the person is told the result was unclear and asked to capture again, every time, outside the face_liveness_max_attempts budget (which still applies to captures the engine could not score). Off by default; the web flow ignores it.
`face_liveness_video_anomaly_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the stored liveness recording contains a repeated moving sequence consistent with a looped video feed, measured server-side from the video itself, independently of the liveness score. It deliberately does NOT flag a frozen or near-motionless capture: frame statistics cannot separate an injected still from a genuine one (a subject holding still, or a flash that clips the exposure), so acting on that would decline real users. A frozen or pre-recorded injected feed is instead defeated by strict flash liveness (set face_liveness_flash_mode to "1" for strict), which binds the capture to a per-session colour-sequence challenge a recording cannot reproduce. Defaults to NO_ACTION (evidence is recorded, the verdict is unchanged).
`face_luminance_max_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is brighter than `face_luminance_max_threshold`.
`face_luminance_max_threshold`	integer \| null	integer >=0 <=100
`face_luminance_min_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is darker than `face_luminance_min_threshold`.
`face_luminance_min_threshold`	integer \| null	integer >=0 <=100
`face_privacy_mode_enabled`	boolean \| null	boolean
`face_quality_decline_threshold`	integer \| null	integer >=0 <=100
`face_quality_review_threshold`	integer \| null	integer >=0 <=100
`face_search_enabled`	boolean \| null	boolean	Run the 1:N Face Search on the selfie: match it against previously verified users, the face blocklist and allowlist, and store its biometric template for later matching. On by default. Off skips the search, keeps no face template, and leaves the duplicate-face actions with nothing to act on.
`frame_injection_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when injected video frames are detected.
`race_map_similarity_thresholds`	json	{"": {"possible": 0-100, "high": 0-100}}	Per-demographic overrides of the face-similarity bands used against the allow-list and duplicate-face sets, so match rates stay even across groups. `possible` is the lower band (defaults to 62) and `high` the upper (68); a group with no entry uses those defaults.
`screen_capture_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the selfie is a photo of a screen.
`status_rules`	array	array
`virtual_camera_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a virtual camera feed is detected.

NFC

Configuration for NFC/ePassport feature.

Key	Type	Accepts	Meaning
`allow_nfc_skip`	boolean \| null	boolean
`skip_nfc_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user skips the NFC chip read (only reachable with `allow_nfc_skip`).
`status_rules`	array	array
`trust_anchor_missing_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when chip data-group hashes are intact but the certificate chain cannot be verified because the issuing country's CSCA trust anchor is not loaded.
`unverified_chip_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the chip is read but its signature cannot be verified.

OCR

Configuration for OCR/ID Verification feature.

Omitting documents_allowed stores the full country/document catalog, so the node accepts everything. Put OCR before any feature that reads identity data from the document (FACE_MATCH, NFC, DATABASE_VALIDATION).

Key	Type	Accepts	Meaning
`age_restrictions_by_country`	json \| null	{"": {"minimum_age": 1-120, "maximum_age": 1-120\|null, "states"?: {"<STATE_CODE>": {"minimum_age": 1-120, "maximum_age": 1-120\|null}}}}	Per-country (and optionally per-state) age gate. `minimum_age` is required for every country listed; `maximum_age` may be null.
`critical_field_occlusion_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a critical printed field - an identity number, a name, the date of birth or the expiry date - was physically covered on the captured document. Defaults to REVIEW.
`cross_org_fraud_document_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this document was flagged as fraudulent by another organization in the network.
`document_audio_recording_enabled`	boolean \| null	boolean	Record the microphone during document capture, so a reviewer can hear the session. Off by default.
`document_blur_fields_by_country`	json \| null	{"": ["<blur_field_name>", ...]}	Fields to blur out of the stored document image, per country. Only fields the country's document layout supports are accepted.
`document_liveness_portrait_replace_decline_threshold`	integer \| null	integer >=0 <=100
`document_liveness_portrait_replace_review_threshold`	integer \| null	integer >=0 <=100
`document_liveness_printed_copy_decline_threshold`	integer \| null	integer >=0 <=100
`document_liveness_printed_copy_review_threshold`	integer \| null	integer >=0 <=100
`document_liveness_screen_replay_decline_threshold`	integer \| null	integer >=0 <=100
`document_liveness_screen_replay_review_threshold`	integer \| null	integer >=0 <=100
`document_or_personal_number_format_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document or personal number does not match the country's expected format.
`document_selfie_duplicated_face_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document-capture selfie matches, or possibly matches, the face of a user already verified in this application.
`document_selfie_duplicated_face_document_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document-capture selfie matches a user already verified with a different date of birth. Another document of the same person (a passport after an identity card, a renewal, a document of a second country) is not flagged. Can only escalate document_selfie_duplicated_face_action.
`document_selfie_duplicated_face_name_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document-capture selfie matches a user already verified under a different name. Can only escalate document_selfie_duplicated_face_action.
`document_selfie_face_search_enabled`	boolean \| null	boolean	Run the 1:N Face Search on the selfie taken during document capture (needs is_document_selfie_portrait_match_enabled): match it against the face blocklist and previously verified users. The selfie is a probe only, its template is never stored. On by default. Off skips the search and leaves the document-selfie duplicate-face actions with nothing to act on; face_search_enabled off on the LIVENESS step skips it too, since that opt-out covers every selfie of the session.
`document_selfie_portrait_match_decline_threshold`	integer \| null	integer >=0 <=100
`document_selfie_portrait_match_review_threshold`	integer \| null	integer >=0 <=100
`document_without_portrait_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the scanned document family carries no portrait on any side. Node-config only - there is no account-level setting; the runtime default is REVIEW.
`documents_allowed`	json \| null	{"": {"<DOC_CODE>": {"enabled": 0\|1, "sides"?: 1\|2, "subtypes"?: ["<SUBTYPE_CODE>", ...]}}}	Which identity documents are accepted, per issuing country. Omit the key entirely to accept the full catalog; an empty object means the same thing. At least one document must end up enabled or the save is rejected.
`duplicated_user_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the identity was already verified for this application.
`expected_details_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the extracted identity contradicts the `expected_details` sent with the session.
`expiration_date_not_detected_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no expiry date could be read from the document.
`id_document_quality_threshold`	integer \| null	integer >=0 <=100
`id_verification_max_retry_attempts`	integer \| null	integer >=2 <=5
`id_verification_name_match_score_threshold`	integer \| null	integer >=0 <=100
`image_capture_methods_allowed`	array \| null	["CAMERA_SCAN" \| "UPLOAD", ...]	Capture methods the end user may use for the document photo. Declared as a list of free strings, so the vocabulary is not in the field itself: CAMERA_SCAN (live capture) and UPLOAD (pick an existing file). An empty list falls back to the account default.
`image_quality_too_low_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when overall document image quality is below the bar.
`image_too_blurry_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the captured document image is too blurry to trust.
`image_too_bright_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the captured document image is overexposed.
`image_too_dark_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the captured document image is underexposed.
`inconsistent_data_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document's own fields contradict each other.
`invalid_code_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a document check digit or barcode fails validation.
`invalid_mrz_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the machine-readable zone is missing or inconsistent.
`invalid_validation_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when a document authenticity validation fails.
`is_age_restrictions_enabled`	boolean \| null	boolean
`is_document_selfie_portrait_match_enabled`	boolean \| null	boolean
`is_image_capture_review_screen_enabled`	boolean \| null	boolean	Show the user a review screen after each document capture, letting them retake the photo before it is submitted. Off by default.
`is_ocr_id_verification_data_review_enabled`	boolean \| null	boolean	Let the user review and correct the extracted identity data before the step completes. Off by default. A correction is scored against `ocr_id_verification_data_review_critical_fields`, and a disagreement takes the critical or the minor action accordingly. The review still runs when the workflow includes NFC - a later chip read simply supersedes it.
`maximum_age`	integer \| null	integer >=1 <=120
`maximum_age_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the holder is older than `maximum_age`.
`methods`	json \| null	{"": {"document": {"enabled": bool}, "id_lookup": {"enabled": bool, "source"?: "<source_id>"\|null, "max_attempts": 1-5, "skip_liveness_and_face_match": bool, "on_partial_match": "fallback_to_document"\|"decline", "on_no_match": "fallback_to_document"\|"decline", "on_provider_error": "fallback_to_document"\|"decline", "response_fields"?: ["<field_key>", ...]}, "wallet": {"enabled": bool, "providers": ["<wallet_id>", ...], "on_failure": "fallback_to_document"\|"decline"}}}	Which ID verification methods each country may use: document capture (today's behaviour), non-doc lookup against a government or other authoritative source, and digital identity wallets. Omit the key, or a country, or a method, and that country is document only. Every method must be available for the country in the capability catalog (GET workflow-graph/id-verification-methods-catalog/); wallets are an accept-list with no ordering. Each fallback is `fallback_to_document` or `decline`; `max_attempts` (1-5, default 1) counts only lookups the registry answered. Where the catalog lists several lookup `sources` for a country, `source` picks exactly one by id; omitted means the country's default (the first listed).
`minimum_age`	integer \| null	integer >=1 <=120
`minimum_age_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the holder is younger than `minimum_age`.
`ocr_id_verification_data_review_critical_fields`	array \| null	["first_name" \| "last_name" \| "date_of_birth" \| ...]	Which extracted identity fields count as critical when the user edits the OCR result, so a mismatch takes the critical action rather than the minor one.
`ocr_id_verification_data_review_critical_mismatch_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the user's edit disagrees with OCR on a critical field.
`ocr_id_verification_data_review_minor_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user's edit disagrees with OCR on a non-critical field.
`status_rules`	array	array
`unparsed_address_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document address could not be parsed into components.

PHONE_VERIFICATION

Configuration for Phone Verification feature.

Key	Type	Accepts	Meaning
`code_size`	integer \| null	integer >=4 <=8
`cross_org_fraud_phone_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when this number was flagged as fraudulent by another organization in the network.
`disposable_number_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the number belongs to a disposable-number provider.
`duplicated_phone_number_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the number was already verified for this application.
`fallback_to_native`	boolean \| null	boolean
`high_risk_phone_action`	string \| null	'REVIEW'\|'DECLINE'	Verdict when the number carries a high risk signal.
`low_phone_trust_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the trust index is below `phone_trust_index_threshold`.
`phone_enrichment_enabled`	boolean \| null	boolean
`phone_intelligence_score_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the enrichment score is worse than `phone_intelligence_score_threshold`.
`phone_intelligence_score_threshold`	integer \| null	integer >=0 <=100
`phone_max_check_attempts`	integer \| null	integer >=1 <=5
`phone_max_retries`	integer \| null	integer >=1 <=5
`phone_no_social_presence_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the social footprint check (`phone_social_enabled`) finds the number registered on none of the platforms it covers.
`phone_shared_device_mode`	boolean \| null	boolean
`phone_social_enabled`	boolean \| null	boolean
`phone_trust_index_threshold`	integer \| null	integer >=0 <=100
`phone_type_risk_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the line type itself is considered risky.
`phone_verification_countries`	json \| null	{"": {"<channel: sms\|whatsapp\|telegram\|rcs\|viber\|zalo>": {"enabled": true\|false, "max_retries": } \| true\|false}}	Which countries and delivery channels the one-time code may be sent through. It is a WHITELIST: a country absent from the map is not offered at all, and a channel absent from a listed country is skipped. `max_retries` overrides the node-level retry cap for that one channel. A bare boolean is the legacy form and still means enabled/disabled with the node-level cap.
`provider_key`	string \| null	string
`recent_port_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the number was ported to a new carrier recently.
`status_rules`	array	array
`voip_number_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the number is VoIP rather than a real subscriber line.

PROOF_OF_ADDRESS

Configuration for Proof of Address feature.

Key	Type	Accepts	Meaning
`poa_document_authenticity_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document fails authenticity checks.
`poa_document_issues_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document is damaged, cropped or otherwise unusable.
`poa_documents_allowed`	json \| null	{"": {"<DOC_CODE>": {"enabled": 0\|1, "sides"?: 1\|2, "subtypes"?: ["<SUBTYPE_CODE>", ...]}}}	Which proof-of-address documents are accepted, per issuing country. Same shape as OCR's `documents_allowed`; omit to accept the full catalog.
`poa_issue_date_not_detected_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when no issue date could be read from the document.
`poa_issuer_not_identified_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the issuing company or authority cannot be identified.
`poa_languages_allowed`	json \| null	{"<language_code>": 0\|1}	Languages the proof-of-address document may be written in, as a flag per language code. Omit to accept every supported language.
`poa_max_attempts_exceeded_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the user runs out of `poa_max_retry_attempts`.
`poa_max_retry_attempts`	integer \| null	integer >=2 <=5
`poa_name_match_score_threshold`	integer \| null	integer >=0 <=100
`poa_name_or_address_mismatch_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the name or address on the document disagrees with the verified identity.
`poa_unparsable_or_invalid_address_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the address on the document cannot be parsed or is not a real address.
`poa_unsupported_document_type_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the uploaded document is not one of `poa_documents_allowed`.
`poa_unsupported_language_action`	string \| null	'NO_ACTION'\|'REVIEW'\|'DECLINE'	Verdict when the document language is not one of `poa_languages_allowed`.
`status_rules`	array	array

QUESTIONNAIRE

Configuration for Questionnaire feature.

Contributing

The feature-config contract above is generated - never hand-write a config key into a tool description. See CONTRIBUTING.md for the regeneration workflow and the checks that enforce it.

Issues and PRs welcome — see CONTRIBUTING.md. Run the hosted server at mcp.didit.me/mcp, or self-host from this repo (Docker / Node) — see Run it yourself.