Changelog

API changes, newest first. Breaking changes are announced by email and flagged here at least 30 days in advance.

2026-07-26

Verifications — POST /v1/verifications, GET /v1/verifications, GET /v1/verifications/{id}, GET /v1/verifications/{id}/media. Full lifecycle: create → hosted capture → scored decision with hash-chained audit log. Docs
Hosted flow session endpoints — POST /v1/session/consent|document|selfie|submit and GET /v1/session/state, authenticated by 30-minute client tokens. Docs
API keys — scoped keys (idc_…) with create/list/revoke under /v1/keys. Docs
Webhooks — endpoint CRUD under /v1/webhooks, HMAC-SHA256 signed deliveries (X-IdCheck-Signature), 3-attempt retry with backoff. Docs
Decision engine — 0–100 composite score with 80/50 bands and explainable reason strings; degraded ML never approves silently. Docs

POST /v1/screen/ofac — fuzzy SDN name matching with DOB corroboration; POST /v1/screen/wallet — exact SDN digital-currency address matching; GET /v1/screen/ofac/stats — data freshness. Data refreshed from live treasury.gov sources. Docs
OFAC screening now runs automatically on the document identity at verification submit time; strong matches decline, possible matches force review, and screening outages never fail open.

1:N face search during the selfie step against enrolled idcheck.now faces plus a ~2.6M-face fleet collection. Same face + different identity → automatic decline; seen-before → review. Faces are enrolled at submit. Docs

POST /v1/free/ofac and GET /v1/free/ofac/stats — keyless OFAC lookups, 30/hour per IP with X-RateLimit-* headers. Powers the public tool at idcheck.now/tools/ofac-lookup. Docs

POST /v1/signals/collect — keyless FingerprintJS signal ingestion with bot-signal derivation; links to a verification when a valid client token rides along.