Skip to main content
POST
Mint a presigned S3 URL the client uploads bytes to

Authorizations

token
string
query
required

Possession of the verification id in the URL path (/v1/verifications/:token/...) authenticates the SPA capture flow. No header — the id is the credential. ULIDs are large enough that existence-by-id is not a meaningful leak. Used for POST /captures/upload-url, POST /captures, GET /v1/verify/:token.

Path Parameters

token
string
required
Pattern: ^vfy_[0-9A-HJKMNP-TV-Z]{26}$
Example:

"vfy_01HXYZABCDEFGHJKMNPQRSTVWX"

Body

application/json

Body for POST /v1/verifications/:token/captures/upload-url. The returned presigned PUT URL is single-use, 5-minute TTL, locked to the specified contentType — a stolen URL cannot be repurposed for a different mime.

content_type
string
required
kind
enum<string>
default:image
Available options:
image,
forensic_buffer

Response

Presigned URL minted. Client PUTs bytes here next.

upload_url
string<uri>
required
image_key
string
required
capture_id
string
required
expires_at
string<date-time>
required