> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # List your application's decisions > Every decision at your application, across visits: each server SDK decision on a request and each browser check, newest first by default, a page at a time: `limit`, then `cursor` from `X-Next-Cursor`, or `offset`. `X-Total-Count` and `X-Total-Pages` count every match and are sent on the first cursor page and on every offset page. A decision appears here about a minute after it is reported. ## OpenAPI ````yaml /api-reference/openapi.json get /acceptance/decisions openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /acceptance/decisions: get: tags: - Acceptance summary: List your application's decisions description: >- Every decision at your application, across visits: each server SDK decision on a request and each browser check, newest first by default, a page at a time: `limit`, then `cursor` from `X-Next-Cursor`, or `offset`. `X-Total-Count` and `X-Total-Pages` count every match and are sent on the first cursor page and on every offset page. A decision appears here about a minute after it is reported. operationId: acceptance_decisions_list parameters: - name: limit in: query required: false schema: type: integer maximum: 1000 minimum: 1 description: >- Maximum number of records to return in a single page. Must be between 1 and 1000. default: 10 title: Limit description: >- Maximum number of records to return in a single page. Must be between 1 and 1000. - name: offset in: query required: false schema: anyOf: - type: integer minimum: 0 - type: 'null' description: >- Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor. title: Offset description: >- Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor. - name: cursor in: query required: false schema: anyOf: - type: string - type: 'null' description: >- Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset. title: Cursor description: >- Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset. - name: sort in: query required: false schema: anyOf: - $ref: '#/components/schemas/v1.AcceptanceDecisionSortField' - type: 'null' description: >- `decided_at`: when it was decided; ties break on the decision's id. Defaults to `decided_at` `desc`. title: Sort description: >- `decided_at`: when it was decided; ties break on the decision's id. Defaults to `decided_at` `desc`. - name: sort_direction in: query required: false schema: anyOf: - $ref: '#/components/schemas/SortMethod' - type: 'null' description: >- `asc` or `desc`, for every key of the sort. Defaults to the field's own: `decided_at` `desc`. title: Sort Direction description: >- `asc` or `desc`, for every key of the sort. Defaults to the field's own: `decided_at` `desc`. - name: visitor_type in: query required: false schema: anyOf: - type: array items: $ref: '#/components/schemas/v1.VisitorType' - type: 'null' description: Only this visitor type. Repeat for several. title: Visitor Type description: Only this visitor type. Repeat for several. - name: trust_level in: query required: false schema: anyOf: - type: array items: $ref: '#/components/schemas/TrustLevel' - type: 'null' description: Only this trust level. Repeat for several. title: Trust Level description: Only this trust level. Repeat for several. - name: visit_id in: query required: false schema: anyOf: - type: array items: type: string format: uuid - type: 'null' description: >- Only decisions of this visit; an unknown visit matches none. Repeat for several. title: Visit Id description: >- Only decisions of this visit; an unknown visit matches none. Repeat for several. - name: step in: query required: false schema: anyOf: - type: array items: maxLength: 32 pattern: ^[a-z0-9_]+$ type: string - type: 'null' description: Only decisions at this step. Repeat for several. title: Step description: Only decisions at this step. Repeat for several. - name: outcome in: query required: false schema: anyOf: - type: array items: $ref: '#/components/schemas/v1.AcceptanceDecisionOutcome' - type: 'null' description: Only decisions with this recommendation. Repeat for several. title: Outcome description: Only decisions with this recommendation. Repeat for several. - name: start_date in: query required: false schema: anyOf: - type: string format: date - type: 'null' description: 'Filter records created on or after this date (format: YYYY-MM-DD).' title: Start Date description: 'Filter records created on or after this date (format: YYYY-MM-DD).' - name: end_date in: query required: false schema: anyOf: - type: string format: date - type: 'null' description: >- Filter records created on or before this date (format: YYYY-MM-DD). title: End Date description: 'Filter records created on or before this date (format: YYYY-MM-DD).' - name: tz in: query required: false schema: type: string description: >- IANA timezone identifier used to interpret start_date and end_date (defaults to UTC). examples: - UTC - America/Los_Angeles - Europe/London default: UTC title: Tz description: >- IANA timezone identifier used to interpret start_date and end_date (defaults to UTC). responses: '200': description: Decisions in the requested order. content: application/json: schema: type: array items: $ref: '#/components/schemas/v1.AcceptanceDecision' application/vnd.baselayer.v1+json: schema: type: array items: $ref: '#/components/schemas/v1.AcceptanceDecision' headers: X-Total-Count: description: Total number of records matching the query. schema: type: integer X-Total-Pages: description: Total number of pages available based on the current limit. schema: type: integer X-Next-Cursor: description: >- Cursor for the next page (only present when using the keyset pagination and if `has_more` is true. schema: type: string '422': description: The request is invalid. content: application/json: schema: $ref: '#/components/schemas/Error' title: ValidationFailed description: The request is invalid. examples: - type: validation_failed code: 7112 message: The request is invalid. metadata: {} '503': description: >- Acceptance data cannot be read right now; retry after `Retry-After` seconds. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' title: AcceptanceReadsUnavailable description: >- Acceptance data is temporarily unavailable. Retry after the Retry-After interval. examples: - type: acceptance_reads_unavailable code: 7252 message: >- Acceptance data is temporarily unavailable. Retry after the Retry-After interval. metadata: {} security: - APIKeyHeader: [] components: schemas: v1.AcceptanceDecisionSortField: type: string enum: - decided_at title: AcceptanceDecisionSortField description: The field a list of decisions sorts on. SortMethod: type: string enum: - asc - desc title: SortMethod v1.VisitorType: description: |- What automated visitor is behind a request at a merchant: an AI agent, a crawler, or not yet known. enum: - agent - crawler - unknown title: VisitorType type: string TrustLevel: description: |- How strongly the evidence backs a request's identity, strongest first: `credentialed` (a Baselayer credential), `signed` (a verified signature such as Web Bot Auth), `declared` (a User-Agent corroborated by the platform's published IP range), `undeclared` (nothing backs it). enum: - credentialed - signed - declared - undeclared title: TrustLevel type: string v1.AcceptanceDecisionOutcome: description: |- What a decision recommends for a request: let it through, ask for a stronger credential, or refuse it. enum: - allow - step_up - block title: AcceptanceDecisionOutcome type: string v1.AcceptanceDecision: description: |- One decision: a server SDK's on a request, or the KYA service's browser check, and what the merchant did with it. properties: decision_id: description: The decision's id. format: uuid title: Decision Id type: string decided_at: description: When it was decided. format: date-time title: Decided At type: string transport: $ref: '#/components/schemas/v1.VisitTransport' description: How the visitor reached the merchant. step: description: The step the request mapped to. maxLength: 32 pattern: ^[a-z0-9_]+$ title: Step type: string outcome: $ref: '#/components/schemas/v1.AcceptanceDecisionOutcome' description: What the policy recommended. enforcement_mode: $ref: '#/components/schemas/v1.EnforcementMode' description: Whether the step enforced it. merchant_outcome: anyOf: - $ref: '#/components/schemas/v1.AcceptanceDecisionOutcome' - type: 'null' default: null description: >- What the merchant did; null when the SDK did not see it, and for a browser check. reasons: description: Why it came out as it did. items: $ref: '#/components/schemas/v1.AcceptanceDecisionReason' title: Reasons type: array policy: $ref: '#/components/schemas/v1.AcceptanceDecisionPolicy' description: The policy that decided. identity: $ref: '#/components/schemas/v1.DecisionIdentity' description: Who the visitor was when the policy ran. detection: anyOf: - $ref: '#/components/schemas/v1.DecisionDetection' - type: 'null' default: null description: Null when detection was unavailable. evidence: description: One entry per reader that contributed, raw. items: $ref: '#/components/schemas/v1.Evidence' title: Evidence type: array requirement: anyOf: - $ref: '#/components/schemas/v1.DecisionRequirement' - type: 'null' default: null description: What a `step_up` asked for, or what an `allow` met; null otherwise. missing_keys: description: >- The keys an enforced `step_up` found missing from the credential; empty otherwise. items: $ref: '#/components/schemas/v1.IndividualActiveKey' title: Missing Keys type: array expires_at: anyOf: - format: date-time type: string - type: 'null' default: null description: When the decision stops applying. title: Expires At sdk: anyOf: - $ref: '#/components/schemas/v1.Sdk' - type: 'null' default: null description: >- The server SDK that decided; null for a browser check, which the KYA service decided. required: - decision_id - decided_at - transport - step - outcome - enforcement_mode - reasons - policy - identity - evidence - missing_keys title: AcceptanceDecision (v1) type: object Error: properties: type: type: string title: Type description: >- Stable snake_case name of the error. Branch on this, never on `message`. code: type: integer title: Code description: Integer catalog code of the error. message: type: string title: Message description: For a person reading a log; not stable and not localized. metadata: additionalProperties: true type: object title: Metadata description: Context documented per `type`. request_id: anyOf: - type: string - type: 'null' title: Request Id description: The `X-Request-ID` of the failed request. type: object required: - type - code - message title: Error description: The one body of every error a KYA route answers. v1.VisitTransport: description: How a visitor reached the merchant. Values may be added. enum: - browser - api - mcp - ucp title: VisitTransport type: string v1.EnforcementMode: description: Whether a step's decisions are only recorded or also applied. enum: - monitor - enforce title: EnforcementMode type: string v1.AcceptanceDecisionReason: description: |- Why a decision came out as it did. `rule_unsupported` means the SDK met a rule it cannot read: the rule never matches and the whole step runs in monitor mode. The browser check answers `allow` with `monitor` for a step in monitor mode, and with `no_automated_visitor` for a person. Values may be added. enum: - baselayer_verified - baselayer_invalid - web_bot_auth_verified - web_bot_auth_invalid - visa_tap_verified - visa_tap_invalid - ip_range_match - rdns_match - detection_scored - detection_unavailable - identity_conflict - identity_spoofed - fallback - no_evidence - rule_unsupported - monitor - no_automated_visitor title: AcceptanceDecisionReason type: string v1.AcceptanceDecisionPolicy: description: The policy that decided, and the rule in it. properties: version_id: anyOf: - type: string format: uuid - type: 'null' default: null description: The policy version that decided; null for the bundled policy. title: Version Id label: anyOf: - type: string - type: 'null' default: null description: >- `bundled:` and the SDK version, set only when the SDK fetched no policy. examples: - bundled:1.4.0 title: Label rule: anyOf: - type: string - type: 'null' default: null description: The rule that decided; null when the step's fallback did. examples: - vl2 title: Rule is_hash_mismatch: description: True when the policy that ran differs from the version it named. title: Is Hash Mismatch type: boolean required: - is_hash_mismatch title: AcceptanceDecisionPolicy (v1) type: object v1.DecisionIdentity: description: Who the visitor was when the policy ran, and what backed it. properties: visitor_type: $ref: '#/components/schemas/v1.VisitorType' description: What is behind the request. trust_level: $ref: '#/components/schemas/v1.TrustLevel' description: The strongest positive evidence. claim: $ref: '#/components/schemas/v1.Claim' description: >- The agent it claimed to be, and whether that held up; `unobserved` when there was nothing to judge. agent_platform: anyOf: - $ref: '#/components/schemas/v1.AgentPlatform' - type: 'null' default: null description: The platform `agent_name` belongs to. agent_name: anyOf: - $ref: '#/components/schemas/v1.AgentName' - type: 'null' default: null description: 'The agent; with `claim: spoofed`, the one it claimed to be.' attestations: description: >- Every attestation the request presented, oldest first, refused ones included; empty when none. items: $ref: '#/components/schemas/v1.VisitAttestation' title: Attestations type: array required: - visitor_type - trust_level - claim - attestations title: DecisionIdentity (v1) type: object v1.DecisionDetection: description: What detection judged when the policy ran. properties: confidence_level: $ref: '#/components/schemas/v1.ConfidenceLevel' description: How sure detection was. required: - confidence_level title: DecisionDetection (v1) type: object v1.Evidence: additionalProperties: false description: |- One reader's contribution to a decision: what it concluded and the raw detail it saw. properties: source: $ref: '#/components/schemas/v1.PresenceSource' description: The reader. visitor_type: $ref: '#/components/schemas/v1.VisitorType' description: What the reader concluded. trust_level: $ref: '#/components/schemas/v1.TrustLevel' description: How strongly its evidence backs it. detail: description: Everything the reader saw, raw, by `source`. oneOf: - $ref: '#/components/schemas/v1.TransportEvidenceDetail' - $ref: '#/components/schemas/v1.WebBotAuthEvidenceDetail' - $ref: '#/components/schemas/v1.KyaEvidenceDetail' - $ref: '#/components/schemas/v1.TapEvidenceDetail' - $ref: '#/components/schemas/v1.DetectionEvidenceDetail' - $ref: '#/components/schemas/v1.GenericEvidenceDetail' title: Detail required: - source - visitor_type - trust_level - detail title: Evidence (v1) type: object v1.DecisionRequirement: additionalProperties: false description: >- What a decision asked for or met, with the identity level its keys derive. properties: required_keys: description: >- The verification keys the credential must carry, all of them: `email_possession`, `phone_possession`, both, or `phone_possession`, `ssn_identity_match` and `dob_identity_match`. Sorted. examples: - - email_possession - phone_possession items: $ref: '#/components/schemas/v1.IndividualActiveKey' title: Required Keys type: array scope: anyOf: - type: string - type: 'null' default: null description: >- The name of one of the policy's `scopes`, whose fields the credential discloses; null asks for the keys alone. examples: - sign_up title: Scope purpose: anyOf: - type: string - type: 'null' default: null description: >- Read-only: the scope's purpose, filled in from the policy; null when `scope` is. title: Purpose fields: description: >- Read-only: the scope's fields, filled in from the policy; empty when `scope` is null. items: type: string title: Fields type: array credential: $ref: '#/components/schemas/v1.RequirementCredential' description: What the person gets on approval. Required. identity_level: $ref: '#/components/schemas/v1.IdentityLevel' description: >- Read-only: derived from required_keys; ignored on write. `L3` for phone, SSN and date-of-birth matches, else `L2`. readOnly: true required: - required_keys - credential - identity_level title: DecisionRequirement (v1) type: object v1.IndividualActiveKey: description: |- Attestation-primitive keys for an individual. Values are the KYA spec's wire form (lowercase snake_case); they appear verbatim in minted credentials and on identity snapshots. enum: - phone_possession - email_possession - dob_identity_match - ssn_identity_match - watchlist_clear title: IndividualActiveKey type: string v1.Sdk: additionalProperties: false description: The Baselayer SDK that computed a decision on the merchant's side. properties: language: $ref: '#/components/schemas/v1.SdkLanguage' description: The SDK's language. version: description: The SDK's package version. examples: - 1.4.0 maxLength: 32 title: Version type: string policy_schema_version: description: >- The policy feature level the SDK's evaluator implements; below a policy's `minimum_policy_schema_version` it runs in monitor mode. maximum: 2147483647 minimum: 1 title: Policy Schema Version type: integer required: - language - version - policy_schema_version title: Sdk (v1) type: object v1.TrustLevel: description: |- How strongly the evidence backs a request's identity, strongest first: `credentialed` (a Baselayer credential), `signed` (a verified signature such as Web Bot Auth), `declared` (a User-Agent corroborated by the platform's published IP range), `undeclared` (nothing backs it). enum: - credentialed - signed - declared - undeclared title: TrustLevel type: string v1.Claim: description: |- The agent a request claims and whether the claim held up: confirmed by a signature, the claimed token's IP ranges or reverse DNS; refuted (`spoofed`); not checkable yet; or no registry token claimed. enum: - spoofed - signature - rdns - ip_range - unverifiable - cloud_browser - unobserved - unclaimed title: Claim type: string v1.AgentPlatform: description: The company or service behind an automated visitor. enum: - anthropic - openai - meta - xai - google - microsoft - amazon - apple - perplexity - mistral - duckduckgo - common_crawl - yandex - baidu - bytedance - linkedin - whatsapp - slack - x - telegram - discord - instinct - hark - browser_use - anchor - browserbase - browserless - hyperbrowser - kernel - steel - apify - scrape_do - scrapfly - scrapingbee - zenrows title: AgentPlatform type: string v1.AgentName: description: |- The agent itself: a registry User-Agent token (lowercased), a detection provider, or the name a verified signer's domain maps to. enum: - googlebot - googleother - google-inspectiontool - google-cloudvertexbot - bingbot - duckduckbot - applebot - yandexbot - baiduspider - gptbot - oai-searchbot - chatgpt-user - perplexitybot - perplexity-user - claudebot - claude-user - claude-searchbot - mistralai-user - duckassistbot - modelcontextprotocol - ccbot - amazonbot - meta-externalagent - facebookexternalhit - bytespider - slackbot-linkexpanding - slack-imgproxy - slackbot - telegrambot - twitterbot - linkedinbot - discordbot - whatsapp - meta-muse - dot - grok-bot - instinct - hark - browser-use-cloud - anchor - browserbase - browserless - hyperbrowser - onkernel - steel - apify - scrape-do - scrapfly - scrapingbee - zenrows title: AgentName type: string v1.VisitAttestation: description: |- How a visitor proved who it is, passed or failed, by its `type`. Types may be added; a reader drops an entry whose type it does not know. discriminator: mapping: baselayer: '#/components/schemas/v1.VisitBaselayerAttestation' visa_tap: '#/components/schemas/v1.VisitVisaTapAttestation' web_bot_auth: '#/components/schemas/v1.VisitWebBotAuthAttestation' propertyName: type oneOf: - $ref: '#/components/schemas/v1.VisitBaselayerAttestation' - $ref: '#/components/schemas/v1.VisitWebBotAuthAttestation' - $ref: '#/components/schemas/v1.VisitVisaTapAttestation' title: VisitAttestation v1.ConfidenceLevel: enum: - high - medium - low title: ConfidenceLevel type: string v1.PresenceSource: description: A reader that contributed to a request's presence. Values may be added. enum: - transport - baselayer - web_bot_auth - visa_tap - detection - edge_hint - local title: PresenceSource type: string v1.TransportEvidenceDetail: additionalProperties: false description: What the transport reader saw on the request, raw. properties: source: const: transport title: Source type: string user_agent: anyOf: - type: string - type: 'null' default: null description: The raw User-Agent header. title: User Agent ip: anyOf: - type: string - type: 'null' default: null description: The client IP the merchant trusts. title: Ip ip_range_platform: anyOf: - type: string - type: 'null' default: null description: The platform whose published IP range the address is in. title: Ip Range Platform ip_range: anyOf: - type: string - type: 'null' default: null description: The published range it matched, in CIDR form. title: Ip Range client_hints: additionalProperties: type: string description: The `Sec-CH-*` request headers, raw. title: Client Hints type: object fetch_metadata: additionalProperties: type: string description: The `Sec-Fetch-*` request headers, raw. title: Fetch Metadata type: object tls_fingerprint: anyOf: - type: string - type: 'null' default: null description: The TLS fingerprint, when the runtime exposes it. title: Tls Fingerprint http_fingerprint: anyOf: - type: string - type: 'null' default: null description: The HTTP/2 fingerprint, when the runtime exposes it. title: Http Fingerprint edge_bot_score: anyOf: - type: integer - type: 'null' default: null description: A bot score the merchant's edge forwarded, as it sent it. title: Edge Bot Score is_edge_verified_bot: anyOf: - type: boolean - type: 'null' default: null description: Whether the merchant's edge flagged a verified bot. title: Is Edge Verified Bot required: - source title: TransportEvidenceDetail (v1) type: object v1.WebBotAuthEvidenceDetail: additionalProperties: false description: A Web Bot Auth signature the request carried. properties: source: const: web_bot_auth title: Source type: string signer: description: The domain that published the signing key. title: Signer type: string key_id: description: The signature's `keyid`. title: Key Id type: string key_thumbprint: description: The signing key's RFC 7638 thumbprint. title: Key Thumbprint type: string is_signature_verified: description: Whether the signature verified. title: Is Signature Verified type: boolean required: - source - signer - key_id - key_thumbprint - is_signature_verified title: WebBotAuthEvidenceDetail (v1) type: object v1.KyaEvidenceDetail: additionalProperties: false description: |- A KYA credential the request presented or the merchant's session named. Never the credential's disclosed claims. properties: source: const: baselayer title: Source type: string credential_id: description: The credential's `jti`. title: Credential Id type: string identity_level: anyOf: - $ref: '#/components/schemas/v1.IdentityLevel' - type: 'null' default: null description: The level the credential's keys meet; null when none. key_thumbprint: description: The thumbprint of the credential's `cnf` key. title: Key Thumbprint type: string arrived_by: $ref: '#/components/schemas/v1.CredentialSource' description: How the credential reached this request. required: - source - credential_id - key_thumbprint - arrived_by title: KyaEvidenceDetail (v1) type: object v1.TapEvidenceDetail: additionalProperties: false description: A Trusted Agent Protocol signature the request carried. properties: source: const: visa_tap title: Source type: string key_thumbprint: description: The agent key's RFC 7638 thumbprint. title: Key Thumbprint type: string consumer_token: anyOf: - type: string - type: 'null' default: null description: The consumer token, raw, when one was sent. title: Consumer Token required: - source - key_thumbprint title: TapEvidenceDetail (v1) type: object v1.DetectionEvidenceDetail: additionalProperties: false description: A detection verdict, in Baselayer's vocabulary. properties: source: const: detection title: Source type: string visitor_type: $ref: '#/components/schemas/v1.VisitorType' description: What detection judged the request. confidence_level: anyOf: - $ref: '#/components/schemas/v1.ConfidenceLevel' - type: 'null' default: null description: How sure it was. required: - source - visitor_type title: DetectionEvidenceDetail (v1) type: object v1.GenericEvidenceDetail: additionalProperties: true description: |- A reader's detail with no shape of its own here: its `source` and whatever it saw, as it sent it. properties: source: description: The reader that saw it. not: enum: - baselayer - detection - transport - visa_tap - web_bot_auth title: Source type: string required: - source title: GenericEvidenceDetail (v1) type: object v1.RequirementCredential: additionalProperties: false description: |- What the person gets on approval: a credential their account holds, or one for this agent session alone that expires after `ttl_seconds`. properties: type: $ref: '#/components/schemas/v1.CredentialType' description: >- `account`: the person's Baselayer account holds the credential; it needs `email_possession` among the required keys. `ephemeral`: this agent session alone. ttl_seconds: anyOf: - maximum: 604800 minimum: 300 type: integer - type: 'null' default: null description: >- How long an `ephemeral` credential lives, 300 to 604800 seconds; 3600 when left out, and always spelled out on a read. An `account` credential takes none. title: Ttl Seconds required: - type title: RequirementCredential (v1) type: object v1.IdentityLevel: description: |- The deepest identity established for a visitor, lowest to highest: `L1` (Level 1) the operator is known, `L2` (Level 2) a consistent per-person identifier (pseudonymous), `L3` (Level 3) a verified-identity credential. enum: - L1 - L2 - L3 title: IdentityLevel type: string v1.SdkLanguage: description: |- The language of the Baselayer SDK that computed a decision. Values may be added. enum: - typescript - python title: SdkLanguage type: string v1.VisitBaselayerAttestation: description: |- A Baselayer credential, accepted or refused. `key_thumbprint` is the key it is bound to. properties: status: $ref: '#/components/schemas/v1.AttestationStatus' description: How its check came out. checked_at: description: When it was checked, passed or failed. format: date-time title: Checked At type: string key_thumbprint: anyOf: - type: string - type: 'null' default: null description: >- The RFC 7638 JWK SHA-256 thumbprint of the key it was checked with; null only when `status` is not `verified`. examples: - NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs title: Key Thumbprint type: const: baselayer title: Type type: string failure_reason: anyOf: - $ref: '#/components/schemas/v1.VerificationFailure' - type: 'null' default: null description: Why it was refused; null unless `status` is `invalid`. credential_id: anyOf: - type: string - type: 'null' default: null description: Its `jti`; null when it carried none or could not be read. title: Credential Id subject: anyOf: - type: string - type: 'null' default: null description: Its pairwise subject DID; null when it could not be read. title: Subject identity_level: anyOf: - $ref: '#/components/schemas/v1.IdentityLevel' - type: 'null' default: null description: The level its keys meet; null when none. credential_type: anyOf: - $ref: '#/components/schemas/v1.CredentialType' - type: 'null' default: null description: Account or ephemeral; null when it could not be read. expires_at: anyOf: - format: date-time type: string - type: 'null' default: null description: When an ephemeral credential expires; null for an account. title: Expires At scope: anyOf: - type: string - type: 'null' default: null description: The policy scope it was presented for. title: Scope active_keys: description: >- The keys its verification holds, such as `phone_possession`. Values may be added. items: $ref: '#/components/schemas/v1.IndividualActiveKey' title: Active Keys type: array disclosed: description: The field values it shared; empty when none. items: $ref: '#/components/schemas/v1.VisitDisclosedValue' title: Disclosed type: array required: - status - checked_at - type - active_keys - disclosed title: VisitBaselayerAttestation (v1) type: object v1.VisitVisaTapAttestation: description: A Visa TAP signature and the consumer it named. properties: status: $ref: '#/components/schemas/v1.AttestationStatus' description: How its check came out. checked_at: description: When it was checked, passed or failed. format: date-time title: Checked At type: string key_thumbprint: anyOf: - type: string - type: 'null' default: null description: >- The RFC 7638 JWK SHA-256 thumbprint of the key it was checked with; null only when `status` is not `verified`. examples: - NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs title: Key Thumbprint type: const: visa_tap title: Type type: string failure_reason: anyOf: - $ref: '#/components/schemas/v1.VisaTapFailureReason' - type: 'null' default: null description: Why it failed; null unless `status` is `invalid`. key_id: anyOf: - type: string - type: 'null' default: null description: >- Visa's opaque key-store id, as sent; null only when `status` is not `verified`. title: Key Id intent: anyOf: - $ref: '#/components/schemas/v1.VisaTapIntent' - type: 'null' default: null description: >- From the signature's tag; null only when `status` is not `verified` and the tag could not be read. signed_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The signature's `created`. title: Signed At signature_expires_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The signature's `expires`. title: Signature Expires At consumer: anyOf: - $ref: '#/components/schemas/v1.VisitVisaTapConsumer' - type: 'null' default: null description: Null when no consumer object came with it. required: - status - checked_at - type title: VisitVisaTapAttestation (v1) type: object v1.VisitWebBotAuthAttestation: description: 'A Web Bot Auth signature: the signer is the `Signature-Agent` fetched.' properties: status: $ref: '#/components/schemas/v1.AttestationStatus' description: How its check came out. checked_at: description: When it was checked, passed or failed. format: date-time title: Checked At type: string key_thumbprint: anyOf: - type: string - type: 'null' default: null description: >- The RFC 7638 JWK SHA-256 thumbprint of the key it was checked with; null only when `status` is not `verified`. examples: - NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs title: Key Thumbprint type: const: web_bot_auth title: Type type: string failure_reason: anyOf: - $ref: '#/components/schemas/v1.WebBotAuthFailureReason' - type: 'null' default: null description: Why it failed; null unless `status` is `invalid`. signature_agent: anyOf: - type: string - type: 'null' default: null description: >- The `Signature-Agent` URL the verifier fetched; null only when `status` is not `verified`. title: Signature Agent signer: anyOf: - type: string - type: 'null' default: null description: >- The host of `signature_agent`; null only when `status` is not `verified`. examples: - browserless.io title: Signer is_domain_bound: description: Whether the key directory's own response signature was checked. title: Is Domain Bound type: boolean signed_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The signature's `created`. title: Signed At signature_expires_at: anyOf: - format: date-time type: string - type: 'null' default: null description: The signature's `expires`. title: Signature Expires At required: - status - checked_at - type - is_domain_bound title: VisitWebBotAuthAttestation (v1) type: object v1.CredentialSource: description: >- How a credential reached a decision: presented by the agent, or named by the merchant's session claims after an earlier presentation. Values may be added. enum: - presentation - session title: CredentialSource type: string v1.CredentialType: description: |- What the person gets when they approve a step-up: a credential held by their Baselayer account, or one for this agent session alone that expires. Values may be added. enum: - account - ephemeral title: CredentialType type: string v1.AttestationStatus: description: Whether an attestation's check passed, failed, or was not run. enum: - verified - invalid - unverified title: AttestationStatus type: string v1.VerificationFailure: description: |- Why a merchant's KYA verifier refused a presentation, in the SDKs' own codes. Values may be added. enum: - no_credential_presented - unknown_disclosure_scope - malformed_presentation - unsupported_credential_type - untrusted_issuer - sandbox_issuer - issuer_resolution_failed - unknown_signing_key - issuer_signature_invalid - credential_expired - credential_not_yet_valid - status_list_resolution_failed - status_list_invalid - credential_revoked - unsupported_digest_algorithm - disclosure_digest_mismatch - key_binding_missing - key_binding_invalid - nonce_not_issued - nonce_replayed - audience_mismatch - audience_not_registered - actor_mismatch - actor_not_authorized - scope_violation - verification_level_mismatch - verification_missing title: VerificationFailure type: string v1.VisitDisclosedValue: description: One field value a credential shared, as the verifier saw it. properties: field: description: The field's name. examples: - email title: Field type: string value: description: Its value. examples: - test@example.com title: Value type: string required: - field - value title: VisitDisclosedValue (v1) type: object v1.VisaTapFailureReason: description: Why a Visa TAP signature did not verify. enum: - missing_field - lifetime_too_long - expired - not_yet_valid - invalid_validity_window - authority_mismatch - unsupported_algorithm - nonce_replayed - key_unavailable - signature_invalid title: VisaTapFailureReason type: string v1.VisaTapIntent: description: What a Visa TAP signature's tag says the agent is doing. enum: - browsing - payment title: VisaTapIntent type: string v1.VisitVisaTapConsumer: description: >- The consumer a Visa TAP request named, as its Agentic Consumer Recognition Object carried it. properties: status: $ref: '#/components/schemas/v1.VisaTapConsumerStatus' description: Whether its signature verified; invalid is kept. id_token: anyOf: - type: string - type: 'null' description: >- The signed JWT, as sent; null when it could not be stored safely, never when `status` is `verified`. title: Id Token subject: anyOf: - type: string - type: 'null' default: null description: Its `sub`. title: Subject email_mask: anyOf: - type: string - type: 'null' default: null description: The masked email. title: Email Mask phone_number_mask: anyOf: - type: string - type: 'null' default: null description: The masked phone number. title: Phone Number Mask is_email_verified: anyOf: - type: boolean - type: 'null' default: null description: Whether the email is verified. title: Is Email Verified is_phone_number_verified: anyOf: - type: boolean - type: 'null' default: null description: Whether the phone number is verified. title: Is Phone Number Verified country_code: anyOf: - type: string - type: 'null' default: null description: Its country. examples: - US title: Country Code postal_code: anyOf: - type: string - type: 'null' default: null description: Its postal code. examples: - '10001' title: Postal Code required: - status - id_token title: VisitVisaTapConsumer (v1) type: object v1.WebBotAuthFailureReason: description: Why a Web Bot Auth signature did not verify. enum: - missing_component - wrong_tag - expired - not_yet_valid - lifetime_too_long - unknown_key - directory_unavailable - invalid_signature_agent - authority_mismatch - unsupported_algorithm - nonce_replayed - signature_invalid - test_key title: WebBotAuthFailureReason type: string v1.VisaTapConsumerStatus: description: |- Whether a Visa TAP consumer object's signature verified; an invalid one is kept. enum: - verified - invalid title: VisaTapConsumerStatus type: string securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.