Skip to main content
GET
Get one decision

Authorizations

X-API-Key
string
header
required

Path Parameters

decision_id
string<uuid>
required

The decision's id.

Response

Response

One decision: a server SDK's on a request, or the KYA service's browser check, and what the merchant did with it.

decision_id
string<uuid>
required

The decision's id.

decided_at
string<date-time>
required

When it was decided.

transport
enum<string>
required

How the visitor reached the merchant.

Available options:
browser,
api,
mcp,
ucp
step
string
required

The step the request mapped to.

Maximum string length: 32
Pattern: ^[a-z0-9_]+$
outcome
enum<string>
required

What the policy recommended.

Available options:
allow,
step_up,
block
enforcement_mode
enum<string>
required

Whether the step enforced it.

Available options:
monitor,
enforce
reasons
enum<string>[]
required

Why it came out as it did.

Why a decision came out as it did.

rule_unsupported means the SDK met a rule it cannot read: the rule never matches and the whole step runs in monitor mode. The browser check answers allow with monitor for a step in monitor mode, and with no_automated_visitor for a person. Values may be added.

Available options:
baselayer_verified,
baselayer_invalid,
web_bot_auth_verified,
web_bot_auth_invalid,
visa_tap_verified,
visa_tap_invalid,
ip_range_match,
rdns_match,
detection_scored,
detection_unavailable,
identity_conflict,
identity_spoofed,
fallback,
no_evidence,
rule_unsupported,
monitor,
no_automated_visitor
policy
AcceptanceDecisionPolicy (v1) · object
required

The policy that decided.

identity
DecisionIdentity (v1) · object
required

Who the visitor was when the policy ran.

evidence
Evidence (v1) · object[]
required

One entry per reader that contributed, raw.

missing_keys
enum<string>[]
required

The keys an enforced step_up found missing from the credential; empty otherwise.

Attestation-primitive keys for an individual.

Values are the KYA spec's wire form (lowercase snake_case); they appear verbatim in minted credentials and on identity snapshots.

Available options:
phone_possession,
email_possession,
dob_identity_match,
ssn_identity_match,
watchlist_clear
merchant_outcome
enum<string> | null

What the merchant did; null when the SDK did not see it, and for a browser check.

Available options:
allow,
step_up,
block
detection
DecisionDetection (v1) · object | null

Null when detection was unavailable.

requirement
DecisionRequirement (v1) · object | null

What a step_up asked for, or what an allow met; null otherwise.

expires_at
string<date-time> | null

When the decision stops applying.

sdk
Sdk (v1) · object | null

The server SDK that decided; null for a browser check, which the KYA service decided.