Developers

A REST API, a link, a webhook.

Create a verification in one call, send the link to your user, receive the decision by signed webhook. Integrate in the sandbox first.

API documentation (in French) OpenAPI specification

Create a verification

With a test key (kyc_test_…) or a live key (kyc_live_…). The user is found by your own identifier, external_id.

Request

curl -X POST https://getsanno.com/api/v1/verifications \
  -H "Authorization: Bearer kyc_test_…" \
  -H "Content-Type: application/json" \
  -d '{
    "applicant": {
      "external_id": "user-48151623",
      "first_name": "Jeanne",
      "last_name": "Martin",
      "date_of_birth": "1990-04-12"
    },
    "flow": "standard",
    "redirect_url": "https://www.example.com/kyc/retour"
  }'

Send the link

The response contains your user's private link. They complete the live capture, then return to your redirect_url.

Response (excerpt)

{
  "id": "01jb2y8q5z3x4c6v7b8n9m0k1j",
  "object": "verification",
  "status": "created",
  "environment": "sandbox",
  "url": "https://getsanno.com/v/Xr4b0Yq0m2c3VJ5q9yQw…",
  "flow": "standard",
  "external_id": "user-48151623",
  "expires_at": "2026-10-25T09:30:00Z"
}

Receive the decision

Every status change sends a webhook. Check its signature: HMAC-SHA256 of "timestamp.raw body" with your endpoint secret, and reject a timestamp older than 5 minutes.

Webhook received

POST /kyc/webhook HTTP/1.1
Host: www.example.com
Content-Type: application/json
Kyc-Signature: t=1792834200,v1=5d41c8…

{
  "id": "01jb3c9w4q8t2n6m5r7k1d0f3e",
  "type": "verification.approved",
  "created_at": "2026-10-24T09:30:00Z",
  "data": {
    "verification_id": "01jb2y8q5z3x4c6v7b8n9m0k1j",
    "applicant_id": "01jb2y7k4m3n2b1v0c9x8z7a6s",
    "external_id": "user-48151623",
    "status": "approved",
    "reasons": [],
    "environment": "sandbox"
  }
}

Simulate in the sandbox

With a test key, trigger each outcome yourself (approved, declined, review, resubmission_requested) to put your integration to the test.

Simulation

curl -X POST https://getsanno.com/api/v1/verifications/01jb2y8q5z3x4c6v7b8n9m0k1j/simulate \
  -H "Authorization: Bearer kyc_test_…" \
  -H "Content-Type: application/json" \
  -d '{"outcome": "review"}'

What you will find in the API

The whole API, its statuses and its reason codes are described in the reference documentation (in French).

API documentation (in French)

Separate live and test keys, shown only once.
Idempotent creation (Idempotency-Key header).
Stable reason codes and a single error format.
Cursor pagination, rate limits announced in headers.
Webhooks resent on failure, to deduplicate on their identifier.
Erasure of a user on request (GDPR).

Let's talk about your verifications

Tell us what you need to verify and at what pace: we will come back to you with a proposal.