Share a verified identity with your partners.
Server-to-server.

# Didit B2B Reusable KYC — partner-to-partner KYC sharing

You are integrating Didit's B2B Reusable Know Your Customer (KYC) into <my_stack>. The recipe is server-to-server: one Didit application (Service X) mints a short-lived JSON Web Token (JWT) share token for a finished session; a partner Didit application (Service Y) imports the token and Didit clones the full verified session into Service Y. Works for both KYC and Know Your Business (KYB) sessions.

Built for Banking-as-a-Service (BaaS) sponsor banks, multi-brand financial groups, embedded finance through partner banks, marketplaces with regional or vertical sub-platforms, on-ramp + exchange ecosystems, white-label resellers, and B2B KYB consortia where the same legal entity onboards once and serves many. Every URL, header, and enum value below is canonical — do not paraphrase or "improve" them.

## 1. Provision both applications
- Sign up: https://business.didit.me (no credit card required).
- Or provision programmatically: POST https://apx.didit.me/auth/v2/programmatic/register/
- Create TWO applications in your Didit organisation. One acts as Service X (mints share tokens), the other as Service Y (imports them). In production these will usually live in different organisations — one per partner.
- Each application has its own `x-api-key`. Service X uses its own key to mint; Service Y uses its own key to import.

## 2. Service X — mint a share token

Service X picks a finished session it owns and posts to the share endpoint:

  POST https://verification.didit.me/v3/session/{sessionId}/share/
  Headers:
    x-api-key: <Service X api key>
    Content-Type: application/json
  Body:
    {
      "for_application_id": "<partner-application-uuid>",
      "ttl_in_seconds": 3600
    }

Bounds on `ttl_in_seconds`: min 60, max 86400, default 3600.

Requirements:
  - The session must be in a FINISHED status: "Approved", "Declined", or "In Review".
  - The API key must hold the `write:sessions` privilege.
  - `for_application_id` must be a real Didit application uuid — usually the partner's app.

Response: 201 Created with the JWT in the `share_token` field plus `for_application_id` and `session_kind` ("user" or "business" — Didit detects this from the source session and embeds it in the token):

  {
    "share_token": "eyJhbGciOiJIUzI1NiJ9...",
    "for_application_id": "partner-app-uuid",
    "session_kind": "user"
  }

## 3. Transmit the token to Service Y

Service X transmits the `share_token` to Service Y over a pre-arranged backend channel — REST, message queue, signed webhook, anything you control. The token is scoped to Service Y's application and useless to any other application.

## 4. Service Y — import the shared session

Service Y posts the token to the import endpoint:

  POST https://verification.didit.me/v3/session/import-shared/
  Headers:
    x-api-key: <Service Y api key>
    Content-Type: application/json
  Body:
    {
      "share_token": "<jwt from step 2>",
      "workflow_id": "<Service Y's own workflow id>",
      "vendor_data": "<Service Y's internal user id>",
      "trust_review": true
    }

`trust_review`:
  - `true`  → the imported session preserves the original status ("Approved" / "Declined" / "In Review"). Service Y onboards the user instantly. Use when Service Y fully trusts Service X's decision (sister brand, regulated partner with a signed data-sharing agreement).
  - `false` → the imported session lands in "In Review" so Service Y's compliance team makes its own call. Safe default for new partner relationships.

Response: 201 Created with a brand-new session in Service Y's application:

  {
    "session_id": "<new uuid>",
    "session_number": <int>,
    "session_kind": "user" | "business",
    "status": "Approved" | "In Review" | "Declined",
    "shared_from_session": "<original session uuid in Service X>",
    "vendor_data": "<Service Y's internal user id>",
    "id_verifications": [...],
    "liveness_checks": [...],
    "face_matches": [...],
    "aml_screenings": [...],
    "database_validations": [...],
    "proof_of_address": [...],
    "phone_verifications": [...],
    "email_verifications": [...]
  }

For a `session_kind: "business"` token Didit clones the KYB shape instead. KYB session statuses are UPPER_SNAKE_CASE (not Title Case like KYC):

  {
    "session_id": "<new uuid>",
    "session_kind": "business",
    "status": "APPROVED",
    "shared_from_session": "<original business session uuid>",
    "vendor_data": "<Service Y's internal business id>",
    "registry_checks": [...],
    "key_people_checks": [...],
    "document_verifications": [...],
    "aml_screenings": [...],
    "questionnaires": [...]
  }

A new User or Business entity is auto-created in Service Y if one with the supplied `vendor_data` doesn't already exist.

## 5. Idempotency, expiration, errors

| Status | Reason |
|--------|--------|
| 401 | Share token invalid or past `exp` — request a new one. |
| 403 | Token not intended for your application, OR session already imported into your app. |
| 404 | Original session no longer exists. |
| 404 | `workflow_id` not found in your application. |

The duplicate-import check is enforced against the (share_token, partner application) pair.

## 6. Webhooks (optional, only when Service Y wants async updates)

Service Y can register a webhook destination once via:

  POST https://verification.didit.me/v3/webhook/destinations/
  Body: url, subscribed_events: ["status.updated"]

Every webhook delivery carries an `X-Signature-V2` header you MUST verify before trusting the payload. HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.

Algorithm:
  1. sortKeys(payload) recursively
  2. shortenFloats (truncate trailing zeros after the decimal point)
  3. JSON.stringify the result
  4. HMAC-SHA256 with the secret_shared_key
  5. Hex-encode, compare to the X-Signature-V2 header.

## 7. Hard rules — do not change
- Base URL for /v3/* endpoints is verification.didit.me (NOT apx.didit.me).
- Auth header is x-api-key (lowercase, hyphenated).
- Webhook signature header is X-Signature-V2 (NOT X-Signature).
- Status casing matches exactly: "Approved", "Declined", "In Review", "Not Finished" (Title Case With Spaces — KYC convention).
- session_kind is lowercase: "user" or "business".
- The share API is BUSINESS-to-BUSINESS sharing. Service X and Service Y are responsible for the data-sharing legal basis under General Data Protection Regulation (GDPR), UK GDPR, and any cross-border transfer rules. Didit ships the technical capability; you ship the data-sharing agreement.

## 8. Pricing reference (public)
- Service X already paid for the original verification (full KYC bundle is $0.30 or KYB session starts at $2.00; see didit.me/pricing).
- Service Y pays nothing on the import side — `POST /v3/session/import-shared/` is included with every plan.
- 500 free verifications every month on every account (applies to fresh captures, not imports).

## 9. Verify your integration
- Sandbox starts on signup at https://business.didit.me — no separate flag.
- Create two sandbox applications: one as Service X (issuer), the other as Service Y (importer). Use Service X's API key to mint a token for a finished sandbox session, hand the token off, use Service Y's API key to import.
- Switch to live: flip each application's environment toggle in console.

When in doubt:
- https://docs.didit.me/sessions-api/share-session/overview
- https://docs.didit.me/sessions-api/share-session/share
- https://docs.didit.me/sessions-api/share-session/import
- https://docs.didit.me/core-technology/reusable-kyc/share-kyc-via-api