> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.withverifa.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withverifa.com/_mcp/server.

# Get SDK configuration for a capture session

GET https://api.withverifa.com/api/v1/sdk/config

Returns the mobile SDK configuration for a capture session, including
the ordered step list, accepted document types, branding colours,
liveness/NFC/signals config, and any partially completed state used
for resume.

Authenticated by capture session `token` (query parameter), not by API key.


Reference: https://docs.withverifa.com/api-reference/sdk/get-sdk-config

## Authentication

- `X-API-Key` header (required) — Organization API key. Keys are prefixed with `vk_live_` (production) or `vk_sandbox_` (sandbox).

## Request

### Query parameters

- `token` (string, required) — Capture session token.

### Headers

- `Verifa-Version` (date, optional) — API version date string (e.g. `2026-02-01`). If omitted, the version pinned to your API key is used.

## Response

### 200

SDK configuration.

- `session_id` (string, optional)
- `status` (string, optional)
- `steps` (list of string, optional)
- `document` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaDocument, optional)
- `selfie` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaSelfie, optional)
- `user_info` (map from string to any, optional)
- `proof_of_address` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddress, optional)
- `otp` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaOtp, optional)
- `liveness` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaLiveness, optional)
- `nfc` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaNfc, optional)
- `signals` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaSignals, optional)
- `branding` (ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaBranding, optional)
- `resume_state` (map from string to any, optional)

## Errors

### 400 Bad Request Error

Invalid request parameters.

- `error` (string, required) — Short error code.
- `status_code` (integer, required) — HTTP status code.
- `detail` (string, optional) — Human-readable error description.

### 404 Not Found Error

Resource not found.

- `error` (string, required) — Short error code.
- `status_code` (integer, required) — HTTP status code.
- `detail` (string, optional) — Human-readable error description.

## Types

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaDocument

- `accepted_types` (list of string, optional)
- `requires_back` (boolean, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaSelfie

- `required` (boolean, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddress

- `enabled` (boolean, optional)
- `accepted_types` (list of enum, optional) — Document subtypes this session may upload, already filtered by the organization's proof-of-address policy and by the workflow's own accepted list. Bare keys, in canonical display order.
  - Allowed values: `utility_bill`, `mobile_phone_bill`, `bank_statement`, `credit_card_statement`, `council_tax`, `tax_document`, `government_letter`, `benefits_letter`, `mortgage_statement`, `lease_agreement`, `insurance_statement`, `payslip`, `id_with_address`, `institution_letter`, `other`
- `accepted_type_options` (list of ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddressAcceptedTypeOptionsItems, optional) — The same list as full rows — render the picker straight from this and the SDK never has to carry its own label or policy table.
- `retry_reasons` (list of ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddressRetryReasonsItems, optional) — Reason codes from the most recent failed or review-routed proof-of-address check. Non-empty only when the session is being re-entered after a rejected upload — show them so the user uploads a document that fixes the problem, not the same one again. Codes are stable and match `details.reasons[].code` on the check result.
- `require_issuing_country` (boolean, optional) — Whether the flow must collect the document's issuing country. Currently always true — the issuing country decides the recency window and the address normalisation rules.
- `default_issuing_country` (string, optional, nullable) — Pre-selection for the issuing-country picker — the session's ID-document country when known, otherwise the organization's country.

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaOtp

- `verify_phone` (boolean, optional)
- `verify_email` (boolean, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaLiveness

- `enabled` (boolean, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaNfc

- `enabled` (boolean, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaSignals

- `enabled` (boolean, optional)
- `nonce` (string, optional)
- `categories` (list of string, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaBranding

- `primary_color` (string, optional, nullable)
- `logo_url` (string, optional, nullable)
- `company_name` (string, optional)

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddressAcceptedTypeOptionsItems

- `key` (enum, optional) — Canonical proof-of-address document subtype. This is the vocabulary the capture flow, the workflow node, and the check result all share. Legacy values are still accepted on input and normalised on the way in: `rental_agreement` → `lease_agreement`, `vehicle_registration` → `government_letter`. `lease_agreement`, `institution_letter`, and `other` have no official issuer, so a passing result on one of them still routes to human review. `id_with_address` is not an independent source — it shares its issuer with the ID document — and is only accepted when the policy opts in.
  - Allowed values: `utility_bill`, `mobile_phone_bill`, `bank_statement`, `credit_card_statement`, `council_tax`, `tax_document`, `government_letter`, `benefits_letter`, `mortgage_statement`, `lease_agreement`, `insurance_statement`, `payslip`, `id_with_address`, `institution_letter`, `other`
- `label` (string, optional)
- `category` (string, optional)
- `default_max_age_days` (integer, optional)
- `review_only` (boolean, optional) — The document can be uploaded but cannot pass automatically — a pass still routes the session to human review.
- `counts_as_independent` (boolean, optional) — False when the document shares its source with the ID document (e.g. an ID showing an address), so it does not count as a second, independent piece of evidence.

### ApiV1SdkConfigGetResponsesContentApplicationJsonSchemaProofOfAddressRetryReasonsItems

- `code` (string, optional)
- `severity` (enum, optional)
  - Allowed values: `fail`, `review`, `info`

## Examples

**Response**

```json
{
  "session_id": "string",
  "status": "string",
  "steps": [
    "string"
  ],
  "document": {
    "accepted_types": [
      "string"
    ],
    "requires_back": true
  },
  "selfie": {
    "required": true
  },
  "user_info": {},
  "proof_of_address": {
    "enabled": true,
    "accepted_types": [
      "utility_bill"
    ],
    "accepted_type_options": [
      {
        "key": "utility_bill",
        "label": "Utility bill",
        "category": "utility",
        "default_max_age_days": 90,
        "review_only": true,
        "counts_as_independent": true
      }
    ],
    "retry_reasons": [
      {
        "code": "too_old",
        "severity": "fail"
      }
    ],
    "require_issuing_country": true,
    "default_issuing_country": "string"
  },
  "otp": {
    "verify_phone": true,
    "verify_email": true
  },
  "liveness": {
    "enabled": true
  },
  "nfc": {
    "enabled": true
  },
  "signals": {
    "enabled": true,
    "nonce": "string",
    "categories": [
      "string"
    ]
  },
  "branding": {
    "primary_color": "string",
    "logo_url": "string",
    "company_name": "string"
  },
  "resume_state": {}
}
```

**SDK Code**

```python
import requests

url = "https://api.withverifa.com/api/v1/sdk/config"

querystring = {"token":"token"}

headers = {"X-API-Key": "<apiKey>"}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())
```

```javascript
const url = 'https://api.withverifa.com/api/v1/sdk/config?token=token';
const options = {method: 'GET', headers: {'X-API-Key': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.withverifa.com/api/v1/sdk/config?token=token"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-Key", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.withverifa.com/api/v1/sdk/config?token=token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.withverifa.com/api/v1/sdk/config?token=token")
  .header("X-API-Key", "<apiKey>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.withverifa.com/api/v1/sdk/config?token=token', [
  'headers' => [
    'X-API-Key' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.withverifa.com/api/v1/sdk/config?token=token");
var request = new RestRequest(Method.GET);
request.AddHeader("X-API-Key", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["X-API-Key": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.withverifa.com/api/v1/sdk/config?token=token")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```