API overview
The integrator API is /v1. The full, always-current schema is on the
Reference page (generated from the live OpenAPI).
Base URL
| Environment | Base URL |
|---|---|
| UAT (sandbox) | https://api.uat.thibit.id |
Authentication
Every /v1 call is tenant-scoped by an API key in the X-API-Key header:
X-API-Key: tk_test_…Get a sandbox key from POST /v1/signup (UAT only) — see the
Quickstart. Keys are tenant-scoped; keep them server-side.
Endpoints
| Method | Path | Purpose |
|---|---|---|
POST | /v1/signup | Self-serve sandbox tenant + key (UAT only). |
GET | /v1/me | Your tenant profile (name, webhook URL, sandbox flag). |
POST | /v1/verifications | Create a verification → { id, onboarding_url }. |
GET | /v1/verifications | List your recent verifications (the log). |
GET | /v1/verifications/{id} | Fetch one verification’s status + verdict. |
POST | /v1/webhook | Set/clear your webhook URL. |
POST | /v1/tenants | Provision a tenant — admin only (X-Admin-Key). |
Verification lifecycle
collecting → pending → processing → completed | failed. Creation returns
immediately; the engine runs asynchronously and the result arrives by
webhook or polling GET /v1/verifications/{id}.
Conventions
- Async, not blocking — never hold a request open waiting for a verdict.
- Idempotency — store your own applicant-to-verification mapping; don’t blind-retry
POST /v1/verifications. - Errors — standard HTTP status codes;
401= missing/invalidX-API-Key.