Public contract files
Import the files and set the official URL and enabled key only in your private environment. Never publish a workspace containing secrets. Examples below use fictitious data; timeout values demonstrate client choices, not an SLA.
Backend HTTP examples
# Server-side only. Configure KYC_API_BASE_URL with your authorized base (https://api.example.invalid is illustrative), and KYC_API_KEY privately. Never expose credentials in browser code.
set -eu
: "${KYC_API_BASE_URL:?Set authorized base}" "${KYC_API_KEY:?Set API key}"
: "${KYC_IDEMPOTENCY_KEY:?Persist the key for this creation intent}"
curl --fail-with-body --max-time 15 --request POST \
"${KYC_API_BASE_URL%/}/v1/face-auth/transactions" \
--header "X-API-Key: ${KYC_API_KEY}" \
--header "Idempotency-Key: ${KYC_IDEMPOTENCY_KEY}" \
--header 'Content-Type: application/json' \
--data-binary '{"country_code":"BR","external_id":"docs-example-0001","locale":"pt-BR","subject":{"identity":{"country":"BR","number":"00000000000","type":"CPF"}}}'
# Persist transaction_id and business correlation; use the returned links.webview_url. Read status, decision and decision_reason together. Reuse the SAME idempotency key AND original payload only for the same creation intent; never silently bypass a 409 conflict.
These snippets demonstrate basic creation; they are not official SDKs or complete consumers. Add configuration validation, persistence, error handling and idempotent retry behavior appropriate to your application. A new creation intent needs a new key; a technical retry preserves the previous key and payload.
For cURL, see the quickstart. To build an event receiver, follow HMAC verification and reconciliation. The simulator demonstrates fixed scenarios without accessing the real API.