> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.withverifa.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withverifa.com/_mcp/server. # Export session data (GDPR Art. 15 DSAR) GET https://api.withverifa.com/api/v1/sessions/{session_id}/export Returns a JSON document containing every record Verifa holds for a single session, decrypted and ready to deliver to a data subject as part of a GDPR Article 15 Subject Access Request (DSAR). The export is scoped to the API key's environment — sandbox keys can only export sandbox sessions, and vice versa. **Audit:** Every successful call writes an `api.session.export` audit-log entry recording the actor, session ID, IP, and timestamp. **Required scope:** `sessions:read` ### Sections returned - `session` — session-level fields (status, metadata, timestamps). - `result` — verification result with decrypted PII. - `documents` — list of captured documents. Each entry includes a 24-hour-TTL signed `download_url` so the caller can fetch the original image bytes. - `screening` — every screening check tied to this session, with hits. - `review_case` — review case state if one exists. - `case_notes` — chronological review-case notes. - `fraud_signals` — risk and fraud signals captured for the session. - `webhook_deliveries` — full delivery history (event, URL, status, attempts). Reference: https://docs.withverifa.com/api-reference/sessions/export-session ## Authentication - `X-API-Key` header (required) — Organization API key. Keys are prefixed with `vk_live_` (production) or `vk_sandbox_` (sandbox). ## Request ### Path parameters - `session_id` (string, required) — Session ID (`ses_*`). ### Headers - `Verifa-Version` (date, optional) — API version date string (e.g. `2026-02-01`). If omitted, the version pinned to your API key is used. - `Key-Inflection` (enum, optional, default: snake) — Response key casing. Defaults to `snake`. - Allowed values: `camel`, `kebab`, `snake` ## Response ### 200 Decrypted DSAR bundle for the session. - `session` (SessionDetail, required) - `result` (SessionResult, optional, nullable) - `documents` (list of SessionExportDocument, optional) - `screening` (list of Check, optional) — All screening checks tied to this session, with hits. - `review_case` (CaseResponse, optional, nullable) - `case_notes` (list of map from string to any, optional) — Chronological review-case notes (oldest first). - `fraud_signals` (list of map from string to any, optional) — Risk and fraud signals captured for the session. - `webhook_deliveries` (list of WebhookDelivery, optional) ## Errors ### 401 Unauthorized Error Missing or invalid API key. - `error` (string, required) — Short error code. - `status_code` (integer, required) — HTTP status code. - `detail` (string, optional) — Human-readable error description. ### 403 Forbidden Error Caller is missing the `sessions:read` scope. - `error` (string, required) — Short error code. - `status_code` (integer, required) — HTTP status code. - `detail` (string, optional) — Human-readable error description. ### 404 Not Found Error Session not found, or wrong environment for this key. - `error` (string, required) — Short error code. - `status_code` (integer, required) — HTTP status code. - `detail` (string, optional) — Human-readable error description. ## Types ### SessionDetail - `id` (string, required) - `status` (enum, required) - Allowed values: `pending`, `capturing`, `processing`, `sandbox_pending`, `completed`, `expired`, `failed`, `awaiting_external`, `under_review` - `is_sandbox` (boolean, required) - `environment` (string, required) — Environment ID for this session. - `created_at` (datetime, required) - `updated_at` (datetime, required) - `external_ref` (string, optional, nullable) - `metadata` (map from string to any, optional) - `country` (string, optional, nullable) - `checks` (list of string, optional, nullable) - `workflow_id` (string, optional, nullable) — Workflow used for this session. - `document_type` (string, optional, nullable) — Detected or specified document type. - `retention_status` (string, optional, nullable) — Data retention status (active, sensitive_redacted, redacted). - `processing_attempts` (integer, optional, nullable) — Number of processing attempts for this session. - `consent_ip` (string, optional, nullable) — IP address from which consent was given. - `capture_url` (string, optional, nullable) — Capture URL (only present while session is pending/capturing). - `token_expires_at` (datetime, optional, nullable) — When the capture token expires. - `case_id` (string, optional, nullable) — Associated review case ID, if any. - `case_status` (string, optional, nullable) — Status of the associated review case. - `tags` (list of string, optional) — Free-form tags attached to this session. ### SessionResult - `session_id` (string, required) - `status` (enum, required) - Allowed values: `needs_review`, `approved`, `rejected`, `escalated`, `pending_second_review` - `is_sandbox` (boolean, required) - `created_at` (datetime, required) - `face_match_passed` (boolean, optional, nullable) - `face_match_score` (double, optional, nullable) — Similarity score between 0 and 1. - `age_check_passed` (boolean, optional, nullable) - `extracted_age` (integer, optional, nullable) - `extracted_data` (ExtractedData, optional) — PII extracted from the identity document. Fields returned depend on your organization's `api_pii_fields` configuration. - `rejection_reason` (string, optional, nullable) - `rejection_reason_code` (enum, optional) — Structured reason a verification was rejected. Complements the free-text `rejection_reason`. Stable enum — clients can pivot UI and metrics off this without parsing prose. - Allowed values: `document_unreadable`, `document_expired`, `document_unsupported`, `document_authenticity`, `face_mismatch`, `liveness_failed`, `age_under_threshold`, `aml_hit`, `duplicate_identity`, `blocklist_match`, `geo_blocked`, `identity_blocked`, `poa_failed`, `poa_review`, `nfc_failed`, `consistency_failed`, `manual_reject`, `other` - `processing_mode` (enum, optional) - Allowed values: `auto`, `manual` - `country_used` (string, optional, nullable) — ISO 3166-1 alpha-2 country code used for verification. - `sensitive_data_expired` (boolean, optional) — `true` if the organization's sensitive data window has elapsed. When true, `extracted_data` will be empty. ### SessionExportDocument A captured document for the session, including a short-lived signed URL the data subject can use to download the original image bytes. - `id` (string, required) - `document_type` (string, required) - `download_url` (string, required) — HMAC-signed download URL valid for 24 hours from issue. - `download_url_expires_at` (datetime, required) — Absolute expiry of the signed `download_url`. - `page` (enum, optional) - Allowed values: `front`, `back`, `selfie` - `mime_type` (string, optional, nullable) - `size_bytes` (integer, optional, nullable) - `captured_at` (datetime, optional, nullable) ### Check A screening check or risk report. The `result` field structure varies by check type: **AML checks** (sanction, pep, adverse_media, warning): `result` contains `match_count`, `highest_score`, and provider metadata. **Risk checks** (email_risk, phone_risk, ip_risk): `result` contains `risk_score` (0-100), `risk_level` (low/medium/high/critical), and signal-specific fields. **Enhanced checks** (email_risk_enhanced, phone_risk_enhanced, address_validation, ssn_verification): `result` contains provider-specific detailed analysis. For PEP checks, additional top-level fields `pep_risk_tier` and `pep_recommended_action` are included when available. - `id` (string, optional) - `check_type` (enum, optional) — The type of check. Categories: - **AML**: `sanction`, `pep`, `adverse_media`, `warning` — screen against global sanctions, PEP, and adverse-media watchlists - **Risk**: `email_risk`, `phone_risk`, `ip_risk` — lightweight risk scoring - **Enhanced**: `email_risk_enhanced`, `phone_risk_enhanced`, `address_validation`, `ssn_verification` — deep provider-backed analysis - Allowed values: `sanction`, `pep`, `adverse_media`, `warning`, `email_risk`, `phone_risk`, `ip_risk`, `email_risk_enhanced`, `phone_risk_enhanced`, `address_validation`, `ssn_verification` - `status` (enum, optional) — Check status. `pending` = still processing, `clear` = no matches/low risk, `hit` = matches found or high risk, `error` = provider failure. - Allowed values: `pending`, `clear`, `hit`, `error` - `has_match` (boolean, optional) — Whether the check found any matches or flagged risk. - `hit_count` (integer, optional) — Number of screening hits found (AML checks) or 0/1 for risk checks. - `provider` (string, optional, nullable) — Sanitized provider category for the check (e.g., `aml_screening`, `email_risk`, `phone_risk`, `address_verification`). Raw vendor identifiers are scrubbed at the API boundary — the underlying vendor name is never exposed to API clients. - `session_id` (string, optional, nullable) — Associated session ID, if the check was triggered as part of a verification session. - `identity_id` (string, optional, nullable) — Associated identity ID, if the check is linked to a known identity. - `external_ref` (string, optional, nullable) — Your external reference for the subject. - `monitoring_enabled` (boolean, optional) — Whether ongoing monitoring is enabled for this check (AML only). - `is_sandbox` (boolean, optional) — Whether this check was created in sandbox mode (uses test data). - `tags` (list of string, optional) — Custom tags attached to this check. - `batch_id` (string, optional, nullable) — Batch ID if this check was created via the bulk endpoint. - `pep_risk_tier` (enum, optional) — PEP risk classification tier. Only present for `pep` check type. - Allowed values: `tier_1`, `tier_2`, `tier_3`, `tier_4` - `pep_recommended_action` (string, optional, nullable) — Recommended action based on PEP risk tier. Only present for `pep` check type. - `redacted_at` (datetime, optional, nullable) — When check data was redacted (GDPR). Only present if redacted. - `last_checked_at` (datetime, optional) - `created_at` (datetime, optional) - `expires_at` (datetime, optional) - `result` (CheckResult, optional, nullable) — Provider result data. Structure varies by check type: * **AML**: `{match_count, highest_score, ...}` * **Risk**: `{risk_score, risk_level, deliverable, fraud_score, ...}` * **Enhanced**: Provider-specific detailed analysis object - `hits` (list of ScreeningHit, optional) — Screening hits (matches). Only included when fetching check detail. ### CaseResponse - `id` (string, required) — Case public ID. - `session_id` (string, required) — UUID of the associated session. - `status` (enum, required) - Allowed values: `open`, `in_review`, `escalated`, `pending_second_review`, `approved`, `rejected` - `created_at` (datetime, required) - `decision` (enum, optional) - Allowed values: `approved`, `rejected` - `assigned_to` (string, optional, nullable) — UUID of the assigned reviewer. - `claimed_at` (datetime, optional, nullable) - `entered_review_at` (datetime, optional, nullable) - `decided_at` (datetime, optional, nullable) ### WebhookDelivery - `id` (string, required) - `event` (string, required) — The event type that triggered this delivery. - `url` (string, required) - `status` (enum, required) - Allowed values: `pending`, `delivered`, `failed` - `attempts` (integer, required) - `max_attempts` (integer, required) - `created_at` (datetime, required) - `http_status` (integer, optional, nullable) — HTTP response status from the endpoint. - `last_error` (string, optional, nullable) ### ExtractedData PII extracted from the identity document. Fields returned depend on your organization's `api_pii_fields` configuration. - `first_name` (string, optional, nullable) - `last_name` (string, optional, nullable) - `date_of_birth` (string, optional, nullable) — ISO 8601 date (YYYY-MM-DD). - `address` (Address, optional) - `document_number` (string, optional, nullable) - `nationality` (string, optional, nullable) - `gender` (string, optional, nullable) - `ssn` (string, optional, nullable) — Social Security Number (US only). - `document_type` (string, optional, nullable) — Type of document (e.g. drivers_license, passport, state_id). - `document_expiration_date` (string, optional, nullable) — ISO 8601 date (YYYY-MM-DD). - `document_issuing_state` (string, optional, nullable) — Issuing state or jurisdiction code. ### CheckResult Provider result data. Structure varies by check type: * **AML**: `{match_count, highest_score, ...}` * **Risk**: `{risk_score, risk_level, deliverable, fraud_score, ...}` * **Enhanced**: Provider-specific detailed analysis object ### ScreeningHit A screening match found during an AML check. Includes similarity scoring, source information, and type-specific enrichment (e.g., `pep_details`, `sanction_details`, `adverse_media_details`). - `id` (string, required) - `created_at` (datetime, required) - `matched_name` (string, optional, nullable) — The name of the matched entity from the watchlist. - `name_similarity` (double, optional) — Name similarity score between 0.0 and 1.0. - `dob_match` (boolean, optional, nullable) — Whether the date of birth matched, if provided. - `combined_score` (double, optional) — Combined match score factoring name, DOB, and other signals. - `hit_source` (string, optional, nullable) — Source list or database that produced this hit (e.g., OFAC, UN, EU). - `hit_type` (string, optional, nullable) — Type of match (e.g., sanction, pep, adverse_media, warning). - `provider_ref` (string, optional, nullable) — Provider's unique reference for this entity. - `deceased` (boolean, optional, nullable) — Whether the matched entity is deceased (if known). - `is_false_positive` (boolean, optional) — Whether this hit has been dismissed as a false positive. - `pep_details` (ScreeningHitPepDetails, optional, nullable) — PEP-specific enrichment. Only present for PEP hits. - `sanction_details` (ScreeningHitSanctionDetails, optional, nullable) — Sanction-specific enrichment. Only present for sanction hits. - `adverse_media_details` (ScreeningHitAdverseMediaDetails, optional, nullable) — Adverse media enrichment. Only present for adverse_media hits. ### Address - `line1` (string, optional, nullable) - `line2` (string, optional, nullable) - `city` (string, optional, nullable) - `state` (string, optional, nullable) - `zip` (string, optional, nullable) ### ScreeningHitPepDetails PEP-specific enrichment. Only present for PEP hits. - `sources` (list of string, optional) - `positions` (list of ScreeningHitPepDetailsPositionsItems, optional) - `associates` (list of ScreeningHitPepDetailsAssociatesItems, optional) - `pep_class` (string, optional, nullable) ### ScreeningHitSanctionDetails Sanction-specific enrichment. Only present for sanction hits. - `sources` (list of string, optional) - `list_name` (string, optional, nullable) - `program` (string, optional, nullable) - `listed_on` (string, optional, nullable) ### ScreeningHitAdverseMediaDetails Adverse media enrichment. Only present for adverse_media hits. - `sources` (list of ScreeningHitAdverseMediaDetailsSourcesItems, optional) ### ScreeningHitPepDetailsPositionsItems - `title` (string, optional) - `country` (string, optional, nullable) - `from` (string, optional, nullable) - `to` (string, optional, nullable) ### ScreeningHitPepDetailsAssociatesItems - `name` (string, optional) - `relationship` (string, optional, nullable) ### ScreeningHitAdverseMediaDetailsSourcesItems - `name` (string, optional) - `url` (string, optional, nullable) - `date` (string, optional, nullable) ## Examples **Response** ```json { "session": { "id": "ses_abc123", "status": "pending", "is_sandbox": true, "environment": "string", "created_at": "2024-01-15T09:30:00Z", "updated_at": "2024-01-15T09:30:00Z", "external_ref": "string", "metadata": {}, "country": "string", "checks": [ "string" ], "workflow_id": "string", "document_type": "string", "retention_status": "string", "processing_attempts": 1, "consent_ip": "string", "capture_url": "string", "token_expires_at": "2024-01-15T09:30:00Z", "case_id": "string", "case_status": "string", "tags": [ "string" ] }, "result": { "session_id": "ses_abc123", "status": "needs_review", "is_sandbox": true, "created_at": "2024-01-15T09:30:00Z", "face_match_passed": true, "face_match_score": 1.1, "age_check_passed": true, "extracted_age": 1, "extracted_data": { "first_name": "string", "last_name": "string", "date_of_birth": "string", "address": { "line1": "string", "line2": "string", "city": "string", "state": "string", "zip": "string" }, "document_number": "string", "nationality": "string", "gender": "string", "ssn": "string", "document_type": "string", "document_expiration_date": "string", "document_issuing_state": "string" }, "rejection_reason": "string", "rejection_reason_code": "document_unreadable", "processing_mode": "auto", "country_used": "string", "sensitive_data_expired": true }, "documents": [ { "id": "doc_abc123", "document_type": "passport", "download_url": "string", "download_url_expires_at": "2024-01-15T09:30:00Z", "page": "front", "mime_type": "string", "size_bytes": 1, "captured_at": "2024-01-15T09:30:00Z" } ], "screening": [ { "id": "schk_abc123", "check_type": "sanction", "status": "pending", "has_match": true, "hit_count": 1, "provider": "string", "session_id": "string", "identity_id": "string", "external_ref": "string", "monitoring_enabled": true, "is_sandbox": true, "tags": [ "string" ], "batch_id": "string", "pep_risk_tier": "tier_1", "pep_recommended_action": "string", "redacted_at": "2024-01-15T09:30:00Z", "last_checked_at": "2024-01-15T09:30:00Z", "created_at": "2024-01-15T09:30:00Z", "expires_at": "2024-01-15T09:30:00Z", "result": {}, "hits": [ { "id": "string", "created_at": "2024-01-15T09:30:00Z", "matched_name": "string", "name_similarity": 1.1, "dob_match": true, "combined_score": 1.1, "hit_source": "string", "hit_type": "string", "provider_ref": "string", "deceased": true, "is_false_positive": true, "pep_details": { "sources": [ "string" ], "positions": [ { "title": "string", "country": "string", "from": "string", "to": "string" } ], "associates": [ { "name": "string", "relationship": "string" } ], "pep_class": "string" }, "sanction_details": { "sources": [ "string" ], "list_name": "string", "program": "string", "listed_on": "string" }, "adverse_media_details": { "sources": [ { "name": "string", "url": "string", "date": "string" } ] } } ] } ], "review_case": { "id": "rvc_abc123", "session_id": "string", "status": "open", "created_at": "2024-01-15T09:30:00Z", "decision": "approved", "assigned_to": "string", "claimed_at": "2024-01-15T09:30:00Z", "entered_review_at": "2024-01-15T09:30:00Z", "decided_at": "2024-01-15T09:30:00Z" }, "case_notes": [ {} ], "fraud_signals": [ {} ], "webhook_deliveries": [ { "id": "whd_abc123", "event": "session.approved", "url": "string", "status": "pending", "attempts": 1, "max_attempts": 1, "created_at": "2024-01-15T09:30:00Z", "http_status": 1, "last_error": "string" } ] } ``` **SDK Code** ```python import requests url = "https://api.withverifa.com/api/v1/sessions/session_id/export" headers = {"X-API-Key": ""} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api.withverifa.com/api/v1/sessions/session_id/export'; const options = {method: 'GET', headers: {'X-API-Key': ''}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.withverifa.com/api/v1/sessions/session_id/export" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("X-API-Key", "") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.withverifa.com/api/v1/sessions/session_id/export") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["X-API-Key"] = '' response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://api.withverifa.com/api/v1/sessions/session_id/export") .header("X-API-Key", "") .asString(); ``` ```php request('GET', 'https://api.withverifa.com/api/v1/sessions/session_id/export', [ 'headers' => [ 'X-API-Key' => '', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.withverifa.com/api/v1/sessions/session_id/export"); var request = new RestRequest(Method.GET); request.AddHeader("X-API-Key", ""); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = ["X-API-Key": ""] let request = NSMutableURLRequest(url: NSURL(string: "https://api.withverifa.com/api/v1/sessions/session_id/export")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```