Request the right level of proof for each action.

The Trust API coordinates VettiGuard’s human verification, facial liveness, enrolled identity, device-bound authorisation, and explainable adaptive risk policies. Your backend supplies bounded first-party signals, follows the recommended method, and verifies one normalised proof.

POST /v1/trust/decisionPOST /v1/trust/siteverifyPOST /v1/mobile/trust/decisionPOST /v1/mobile/trust/siteverify

01Decision

Describe the action and requested assurance.

Call from your backend using the private site or mobile application secret.

POST https://api.vettiguard.com/v1/trust/decision
Content-Type: application/json

{
  "secret": "YOUR_PRIVATE_SECRET",
  "action": "approve-transfer",
  "subject_id": "customer-4821",
  "requested_assurance": "standard",
  "risk_score": 0.42,
  "request_velocity_5m": 12,
  "failed_attempts_5m": 2,
  "transaction_amount": 250000,
  "new_device": true,
  "country_code": "NG",
  "network_type": "mobile"
}

02Method

Start the recommended verification experience.

The response identifies the policy outcome, matched reason codes, next verification method, enrollment availability, and endpoint family to use.

{
  "success": true,
  "decision": "verify",
  "method": "facial_authorization",
  "requested_assurance": "high",
  "enrollment_available": true,
  "requirements": {
    "identity": true,
    "liveness": true,
    "device_binding": false
  },
  "risk": {
    "outcome": "challenge",
    "score": 0.68,
    "level": "high",
    "engine_status": "evaluated",
    "matched_rules": [
      {
        "policy_name": "Transaction protection",
        "reason_code": "velocity-high"
      }
    ]
  }
}

03Verification

Validate the proof against business requirements.

The Trust API consumes the single-use response and enforces action, assurance, identity, liveness, device, and operation-binding requirements.

POST https://api.vettiguard.com/v1/trust/siteverify

{
  "secret": "YOUR_PRIVATE_SECRET",
  "response": "RESPONSE_TOKEN",
  "action": "approve-transfer",
  "expected_assurance": "high",
  "require_identity": true,
  "require_liveness": true,
  "require_operation_binding": true,
  "operation_reference": "TRANSFER-12345"
}

Normalised result

One response across every verification method.

{
  "success": true,
  "trust": {
    "method": "facial_identity_authorization",
    "assurance_level": "high",
    "identity_bound": true,
    "liveness_verified": true,
    "device_bound": false,
    "operation_bound": true,
    "authorization_capable": true,
    "action": "approve-transfer"
  },
  "error-codes": []
}

Policy guidance

Use the least intrusive method that satisfies the risk.

Use ordered workspace, site, or mobile policies to convert bounded signals into allow, step-up challenge, assisted review, or block decisions. Bot defence remains appropriate for public abuse, while liveness, enrolled identity, and device-bound proof support progressively stronger assurance.

Compare product capabilities