Get Started
Integrate / SDKs
User Verification
Business Verification
Transaction Monitoring
Changelogcurl -X PATCH "https://apx.didit.me/auth/v2/organizations/me/$ORG_ID/applications/$APP_ID/" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme Production App",
"website_url": "https://app.acme.example"
}'from didit import Didit
# Use the access token that account.login returns.
client = Didit(account_token="YOUR_ACCESS_TOKEN")
result = client.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
name="Acme Production App",
website_url="https://app.acme.example",
)
print(result)import Didit from "@didit-protocol/sdk-node";
// Use the access token that account.login returns.
const didit = new Didit({ accountToken: "YOUR_ACCESS_TOKEN" });
const result = await didit.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
{
name: "Acme Production App",
website_url: "https://app.acme.example",
},
);
console.log(result);ctx := context.Background()
// Use the access token that account.login returns.
client := didit.NewClient(option.WithAccountToken("YOUR_ACCESS_TOKEN"))
result, err := client.Account.Applications.Update(ctx, "a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", didit.ApplicationUpdateRequest{
Name: didit.String("Acme Production App"),
WebsiteURL: didit.String("https://app.acme.example"),
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("%+v\n", result)import me.didit.Didit;
import me.didit.types.ApplicationUpdateRequest;
// Use the access token that account.login returns.
Didit client = Didit.builder().accountToken("YOUR_ACCESS_TOKEN").build();
var result = client.account().applications().update("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", ApplicationUpdateRequest.builder()
.name("Acme Production App")
.websiteUrl("https://app.acme.example")
.build());
System.out.println(result);<?php
require 'vendor/autoload.php';
use Didit\DiditClient;
// Use the access token that account.login returns.
$didit = new DiditClient(accountToken: 'YOUR_ACCESS_TOKEN');
$result = $didit->account->applications->update('a1b2c3d4-5678-90ab-cdef-111111111111', 'b2c3d4e5-6789-01bc-defg-222222222222', [
'name' => 'Acme Production App',
'website_url' => 'https://app.acme.example',
]);
print_r($result->toArray());require "didit"
# Use the access token that account.login returns.
didit = Didit::Client.new(account_token: "YOUR_ACCESS_TOKEN")
result = didit.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
name: "Acme Production App",
website_url: "https://app.acme.example"
)
puts result.to_husing System;
using System.Text.Json;
using Didit;
// Use the access token that account.login returns.
using var client = new DiditClient(new DiditClientOptions { AccountToken = "YOUR_ACCESS_TOKEN" });
var result = await client.Account.Applications.UpdateAsync("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", new ApplicationUpdateRequest
{
Name = "Acme Production App",
WebsiteUrl = "https://app.acme.example",
});
Console.WriteLine(JsonSerializer.Serialize(result));Update Application API: Manage Customer Apps
PATCH /organizations/me//applications// to update application metadata for reseller customer apps, brands, environments, or separated use cases.
curl -X PATCH "https://apx.didit.me/auth/v2/organizations/me/$ORG_ID/applications/$APP_ID/" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Acme Production App",
"website_url": "https://app.acme.example"
}'from didit import Didit
# Use the access token that account.login returns.
client = Didit(account_token="YOUR_ACCESS_TOKEN")
result = client.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
name="Acme Production App",
website_url="https://app.acme.example",
)
print(result)import Didit from "@didit-protocol/sdk-node";
// Use the access token that account.login returns.
const didit = new Didit({ accountToken: "YOUR_ACCESS_TOKEN" });
const result = await didit.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
{
name: "Acme Production App",
website_url: "https://app.acme.example",
},
);
console.log(result);ctx := context.Background()
// Use the access token that account.login returns.
client := didit.NewClient(option.WithAccountToken("YOUR_ACCESS_TOKEN"))
result, err := client.Account.Applications.Update(ctx, "a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", didit.ApplicationUpdateRequest{
Name: didit.String("Acme Production App"),
WebsiteURL: didit.String("https://app.acme.example"),
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("%+v\n", result)import me.didit.Didit;
import me.didit.types.ApplicationUpdateRequest;
// Use the access token that account.login returns.
Didit client = Didit.builder().accountToken("YOUR_ACCESS_TOKEN").build();
var result = client.account().applications().update("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", ApplicationUpdateRequest.builder()
.name("Acme Production App")
.websiteUrl("https://app.acme.example")
.build());
System.out.println(result);<?php
require 'vendor/autoload.php';
use Didit\DiditClient;
// Use the access token that account.login returns.
$didit = new DiditClient(accountToken: 'YOUR_ACCESS_TOKEN');
$result = $didit->account->applications->update('a1b2c3d4-5678-90ab-cdef-111111111111', 'b2c3d4e5-6789-01bc-defg-222222222222', [
'name' => 'Acme Production App',
'website_url' => 'https://app.acme.example',
]);
print_r($result->toArray());require "didit"
# Use the access token that account.login returns.
didit = Didit::Client.new(account_token: "YOUR_ACCESS_TOKEN")
result = didit.account.applications.update(
"a1b2c3d4-5678-90ab-cdef-111111111111",
"b2c3d4e5-6789-01bc-defg-222222222222",
name: "Acme Production App",
website_url: "https://app.acme.example"
)
puts result.to_husing System;
using System.Text.Json;
using Didit;
// Use the access token that account.login returns.
using var client = new DiditClient(new DiditClientOptions { AccountToken = "YOUR_ACCESS_TOKEN" });
var result = await client.Account.Applications.UpdateAsync("a1b2c3d4-5678-90ab-cdef-111111111111", "b2c3d4e5-6789-01bc-defg-222222222222", new ApplicationUpdateRequest
{
Name = "Acme Production App",
WebsiteUrl = "https://app.acme.example",
});
Console.WriteLine(JsonSerializer.Serialize(result));api_key stays the same unless you rotate credentials separately.Data location
An application’s data location (data_location) is chosen when the application is created and can’t be changed afterwards: an update that names the location the application already has is accepted, and any other location answers 400.
The one exception is the live application created together with your organization, at sign-up or by Verify Email.
The first update that names a data_location chooses its location, once, as long as none of the application’s API keys has been used and it has no verification session.
The console’s Name your first application step uses this to store the location you pick there.
Today the only available location is eu, the European Union (Ireland).
Admin sign-in URL
Setinitiate_login_uri to the application page that starts a fresh authorization request, for example https://acme.example/login with website_url: "https://acme.example". It defaults to an empty string. It is separate from the OAuth callback in redirect_uris.
A nonempty URI must use HTTPS on the exact registered website hostname, with no userinfo, query, fragment, whitespace or port other than 443. Subdomains must match. A policy violation returns HTTP 400 with an initiate_login_uri field error, https_url_on_registered_website_required.
Changing website_url also revalidates the saved URI: update it to the new hostname or clear it in the same PATCH. Read the admin-sent sign-in handoff before implementing this page.Authorizations
RS256-signed JWT access_token returned by POST /programmatic/login/ or POST /programmatic/verify-email/. Send as Authorization: Bearer <access_token>. Default lifetime is 86400 seconds (24h). This token is only valid against the Account Management endpoints on apx.didit.me/auth/v2. The verification API (verification.didit.me/v3) uses the long-lived api_key as x-api-key instead.
Path Parameters
Body
Send only the fields you want to change. PATCH semantics: missing fields are preserved.
PATCH body for application metadata. Send only the fields you want to change; omitted fields are preserved. uuid, client_id, and api_key cannot be updated. products is read-only: a products key in the body is ignored. data_location can't be changed after the application is created: naming the location it already has is accepted, and any other location answers 400. The one exception is the live application created with your organization: the first update that names a data_location chooses it, once, while no API key of the application has been used and it has no verification session.
Where the application's verification data is stored and processed, chosen when the application is created. eu is the European Union (Ireland), the default. au (Australia, Sydney), mx (Mexico), ae (United Arab Emirates) and us (United States, N. Virginia) are coming soon: a request that names them answers 400 This data location is not available yet. An organization's Sandbox application is always in the European Union.
eu, au, mx, ae, us "eu"
Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link.
2048"https://acme.example/login"
Response
Application updated. The response is the full application record after the change, including products; uuid, client_id, and api_key are unchanged.
Full application record. uuid, client_id, and api_key never change after creation. data_location doesn't either, except once on the live application created with your organization, before it is used (see the update request).
Long-lived secret (also called client_secret). Use as the x-api-key header for every call to https://verification.didit.me/v3/... (sessions, workflows, AML, etc.). Treat as a credential; never expose client-side. New keys start with sk_live_ (live application) or sk_test_ (sandbox application), followed by 43 URL-safe characters (letters, digits, - and _). Keys created before this format have no prefix and keep working unchanged. For 72 hours after you recovered your account, list, retrieve and update return an empty string here instead of the key.
"sk_live_example_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Where the application's verification data is stored and processed, chosen when the application is created. eu is the European Union (Ireland), the default. au (Australia, Sydney), mx (Mexico), ae (United Arab Emirates) and us (United States, N. Virginia) are coming soon: a request that names them answers 400 This data location is not available yet. An organization's Sandbox application is always in the European Union.
eu, au, mx, ae, us "eu"
The application's products. Always all three, in this order: identity, transactions, authentication. A new application has identity enabled with every module on, and transactions and authentication disabled. Read-only: a products key in a create or update body is ignored.
Show child attributes
Show child attributes
[
{
"product": "identity",
"status": "enabled",
"modules": {
"user_verification": true,
"business_verification": true,
"case_management": true
}
},
{
"product": "transactions",
"status": "disabled",
"modules": {
"travel_rule": true,
"case_management": true
}
},
{
"product": "authentication",
"status": "disabled",
"modules": {}
}
]
The application's environment. A live application bills every verification session and check created with its key. A sandbox application mocks every check and is never billed, so it is where you test (each sandbox application can create 500 test sessions every 24 hours). Read this field to pick the application: never infer the environment from the name.
live, sandbox "live"
Application sign-in URL for an admin-sent sign-in link. Optional; an empty string disables sending. A nonempty value must use HTTPS and the exact hostname of website_url (subdomains must match), with no userinfo, query, fragment or whitespace and no port other than 443. The server also revalidates the saved URI when website_url changes; update or clear initiate_login_uri in the same PATCH if needed. The hosted handoff adds iss and login_hint, but creates no session or tokens. See /authentication/sign-in-methods#admin-sent-sign-in-link.
2048"https://acme.example/login"