The EnemoVerify API is a REST API for identity verification (KYC), business verification (KYB), background checks, and AML screening. All requests are made to https://api.enemoverify.com over HTTPS.

All responses are JSON. Successful responses return HTTP 200 (or 202 for async operations). Errors follow a consistent envelope format documented below.

Authenticate every request with a Bearer token. Keys are prefixed with ev_live_ for production and ev_test_ for sandbox.

Authorization: Bearer ev_live_XXXXXXXXXXXXXXXXXXXXXXXXXX

Generate keys in the API Keys section of your dashboard. Keys are shown once at creation — store them securely. Rotate by creating a new key and revoking the old one.

All errors follow this envelope:

{
  "error": {
    "code": "invalid_parameter",
    "param": "redirect_url",
    "message": "redirect_url must be a valid HTTPS URL",
    "doc_url": "https://docs.enemoverify.com/errors#invalid_parameter"
  }
}

Initiates an identity verification for an individual.

Request body

curl https://api.enemoverify.com/v1/kyc/create \
  -H "Authorization: Bearer ev_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "reference_id": "user_38291",
    "flow": "enhanced",
    "redirect_url": "https://yoursite.com/verification-done",
    "country": "US"
  }'

Retrieves a KYC session. Append ?expand=checks to include events.

Verifies a business against the appropriate corporate registry.

Returns the full beneficial ownership structure.

Requires an approved KYC verification first. Pass the KYCverification_id in kyc_verification_id.

Synchronous sanctions, PEP, and adverse media screen. Returns results immediately.

Toggles continuous monitoring on an existing AML verification.

Lists all verifications with cursor pagination. Supports filtering:

GDPR right-to-erasure. Permanently deletes the verification and all associated events. Cannot be undone.

Registers a new webhook endpoint. The signing secret is returned once.

Verifying signatures

Every delivery includes a signature header:

EnemoVerify-Signature: t=1744660800,v1=7e8a...

Compute HMAC-SHA256 over ${timestamp}.${payload} with your signing secret:

import { createHmac, timingSafeEqual } from "crypto";

function verify(payload: string, header: string, secret: string) {
  const [t, v1] = header.split(",").map(p => p.split("=")[1]);
  const expected = createHmac("sha256", secret)
    .update(`${t}.${payload}`)
    .digest("hex");
  return timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

• kyc.verification.approved
• kyc.verification.declined
• kyc.verification.review
• kyc.session.expired
• kyb.verification.approved
• kyb.verification.declined
• kyb.verification.review
• background.check.completed
• background.check.declined
• aml.screen.clear
• aml.screen.flagged

In sandbox (ev_test_ keys), pass one of these reference IDs to get deterministic results without completing any flows.

Every API key is rate-limited to 100 requests per minute. Plan-based monthly verification limits apply in addition.

Every response includes:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 1744660860