Identity API

Live

Face verification on the same self-hosted engine that powers Authvio identity checks: auraface recognition, scrfd/yunet detection, and MiniFASNet presentation-attack detection, all on Bolrach infrastructure. v1 is stateless — your images are processed in memory and never stored, enrolled, or shared.

Base URL https://api.bolrach.ioScope identity:verifySpec openapi/identity.json

A high-trust scope

Biometric comparison is sensitive by nature, so identity:verify is issued deliberately, and you are responsible for having the data subject's consent before submitting their images. Full document-verification sessions and Nigerian NIN/BVN rails stay first-party for compliance; this surface gives you the face-verification core.

Endpoints

POST /v1/identity/face-match

Compare the face in a reference image (an ID-document photo, an enrolment picture) against a selfie. Passive liveness runs on the selfie when a face is found. Scores are 0.05-binned by design so they cannot be used to reconstruct embeddings.

FieldTypeDescription
reference_b64string, requiredBase64 JPEG/PNG, up to ~6MB. Plain base64, no data: prefix.
selfie_b64string, requiredBase64 JPEG/PNG, up to ~6MB.
levelstring, optionalStrictness profile: nin (default), bvn, full.
curl -X POST "https://api.bolrach.io/v1/identity/face-match" \
  -H "Authorization: Bearer bt_your_key_here" \
  -H "Content-Type: application/json" \
  -d "{\"reference_b64\": \"$(base64 -i id_photo.jpg)\", \"selfie_b64\": \"$(base64 -i selfie.jpg)\"}"

Response

{
  "engine_version": "2026.07.03",
  "face_matched": true,
  "face_match_score": 0.85,
  "reference_faces": 1,
  "selfie_faces": 1,
  "hard_reject": false,
  "pad_available": true,
  "passive_pad_score": 0.9,
  "screen_replay_score": 0.1
}

Treat face_matched as the verdict and hard_reject as a definitive mismatch. High screen_replay_score suggests the selfie was taken of a screen — pair it with passive_pad_score before trusting a match.

GET /v1/identity/status

Engine health and the exact model lineup in service.

curl "https://api.bolrach.io/v1/identity/status" \
  -H "Authorization: Bearer bt_your_key_here"

{
  "ok": true,
  "engine": "2026.07.03",
  "ml": "live",
  "models": { "recog": "auraface-v1", "detect": "scrfd10g+yunet", "pad": "minifasnet-ens-v1", "ocr": "ppocrv4" }
}

Limits and errors

Plan rate limits are shared across the platform (plans table). Undecodable images return 400 invalid_image; oversized payloads are rejected before processing.

Changelog

DateChange
2026-07-14v1 launch: stateless face-match with passive liveness, and engine status. Hosted verification sessions are planned.