Skip to main content
POST
Create a monitoring token
Authentication is new, and this endpoint stays off until Didit turns it on: until then it answers 503 monitoring_unavailable.
The browser and native SDKs call this endpoint from the person’s device; your server does not need to. Every event sent with the credential is recorded for the person’s vendor_data, whatever the device claims.

Authorizations

Authorization
string
header
required

The person's access token from POST /token/: an ES256 JWT with header typ: at+jwt, valid for at most 5 minutes. Not your Didit API key.

Body

application/json

Empty: the access token names the person.

Response

A device credential for the person.

A short-lived device credential for sending the person's activity events to transaction monitoring from their device. It is not tied to the session: it stays usable until expires_at, even after sign-out.

monitoring_token
string
required

The device credential. Treat it as a secret.

Example:

"mt_2f8c1d9e7b6a5f4e3d2c1b0a"

expires_at
string<date-time>
required

At most 15 minutes after it was issued.

Example:

"2026-10-17T10:56:14Z"

allowed_event_categories
string[]
required

The event categories it may send. Authentication and security events always come from Didit, never from the device.

Example:
max_uses
integer
required
Example:

1000

bind_to_origin
string | null
required

The browser origin the credential works from: the request's Origin, or null when there was none.

Example:

"https://app.example.com"

vendor_data
string
required

The person every event is recorded for, whatever the device sends.

Example:

"user-42"