> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# User Documents

> IDs, proofs of address, and supporting files on Didit User entities — what's collected, how to retrieve them, and how to upload from the console.

export const AgentPromptAccordion = ({prompt, title = "AI Agent Integration Prompt"}) => {
  const [copied, setCopied] = React.useState(false);
  const handleCopy = e => {
    e.stopPropagation();
    if (!prompt) return;
    navigator.clipboard.writeText(prompt.trim()).then(() => {
      setCopied(true);
      setTimeout(() => setCopied(false), 2000);
    });
  };
  const agents = ["Claude Code", "Codex", "Cursor", "Devin", "Windsurf", "GitHub Copilot"];
  return <div className="didit-agent-card">
      {}
      <div className="didit-agent-titlebar">
        <div className="didit-agent-dots" aria-hidden="true">
          <span className="didit-agent-dot didit-agent-dot-red"></span>
          <span className="didit-agent-dot didit-agent-dot-yellow"></span>
          <span className="didit-agent-dot didit-agent-dot-green"></span>
        </div>
        <span className="didit-agent-filename">{title}</span>
        <button type="button" className={`didit-agent-copy ${copied ? "didit-agent-copy-copied" : ""}`} onClick={handleCopy} title="Copy prompt to clipboard" aria-label={copied ? "Copied!" : "Copy prompt to clipboard"}>
          {copied ? <>
              <svg width="13" height="13" viewBox="0 0 16 16" fill="none">
                <path d="M3 8.5l3.5 3.5L13 4" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" />
              </svg>
              <span>Copied</span>
            </> : <>
              <svg width="13" height="13" viewBox="0 0 16 16" fill="none">
                <rect x="5" y="5" width="9" height="9" rx="1.5" stroke="currentColor" strokeWidth="1.5" />
                <path d="M11 5V3.5A1.5 1.5 0 0 0 9.5 2h-6A1.5 1.5 0 0 0 2 3.5v6A1.5 1.5 0 0 0 3.5 11H5" stroke="currentColor" strokeWidth="1.5" />
              </svg>
              <span>Copy</span>
            </>}
        </button>
      </div>

      {}
      <pre className="didit-agent-body"><code>{prompt.trim()}</code></pre>

      {}
      <div className="didit-agent-footer">
        <span className="didit-agent-footer-label">Paste into</span>
        <div className="didit-agent-chips">
          {agents.map(name => <span key={name} className="didit-agent-chip">{name}</span>)}
        </div>
      </div>
    </div>;
};

<AgentPromptAccordion
  title="User Documents Prompt"
  prompt={`# Goal — retrieve user documents and generate compliance PDFs

Documents (ID images, MRZ data, selfies, proof-of-address scans, NFC chip reads) are attached to the **session** that captured them, not directly to the User entity. There is no public "upload document to user" API — capture flows through sessions. You can however list sessions for the user, retrieve each session's decision, and pull signed URLs to the document images.

## Pattern — list sessions for a user, then read each decision

\`\`\`bash
# 1) List sessions tied to the User entity
curl -G https://verification.didit.me/v3/sessions/ \\
-H "x-api-key: $DIDIT_API_KEY" \\
--data-urlencode "vendor_data=user-42" \\
--data-urlencode "page_size=50"

# 2) For each session, retrieve the full decision (V3 plural arrays)
curl https://verification.didit.me/v3/session/$SESSION_ID/decision/ \\
-H "x-api-key: $DIDIT_API_KEY"
\`\`\`

## Where documents appear in the V3 decision

Inspect these plural arrays (every per-feature result is plural in V3):

| Array | Contains |
|---|---|
| \`id_verifications[]\` | Government ID images, OCR fields, MRZ, expiry, issuing country |
| \`liveness_checks[]\` | Selfie frames, passive liveness score |
| \`nfc_verifications[]\` | NFC chip data, ICAO certificate chain |
| \`proof_of_address_checks[]\` | POA document images, extracted address |

Image URLs are short-lived signed URLs — cache the bytes if you need them long-term, or re-fetch the decision when they expire.

## Generate a PDF report

For a human-readable compliance export (used for SARs, audits, regulator requests):

\`\`\`bash
curl https://verification.didit.me/v3/session/$SESSION_ID/generate-pdf/ \\
-H "x-api-key: $DIDIT_API_KEY" \\
-o session-report.pdf
\`\`\`

The PDF includes session details, per-feature results, and embedded document images.

## Re-verification / new document collection

To collect fresh documents (e.g. expired ID), create a new session for the same \`vendor_data\` — the new session attaches to the existing User entity:

\`\`\`bash
curl -X POST https://verification.didit.me/v3/session/ \\
-H "x-api-key: $DIDIT_API_KEY" \\
-H "Content-Type: application/json" \\
-d '{"workflow_id": "$WORKFLOW_ID", "vendor_data": "user-42"}'
\`\`\`

## Failure modes

- \`404\` — wrong \`session_id\` or wrong \`vendor_data\` casing.
- Expired signed image URL — re-fetch the decision to get fresh URLs.
- \`403\` on PDF — your API key's role lacks PDF export permission.
- Document monitoring (expiry alerts) is opt-in per workflow — see /core-technology/id-verification/document-monitoring-id-verification.

## Response shape

See /reference/data-models for the full per-feature schema. Each plural-array item carries its own \`status\`, \`document_images[]\`, OCR extract, and decision metadata.

## Sources of truth

- /sessions-api/retrieve-session — decision schema
- /reference/data-models — V3 plural-array contract
- /core-technology/id-verification/overview — ID capture behaviour
- /core-technology/proof-of-address/overview — POA capture
- /integration/integration-prompt — canonical end-to-end prompt
`}
/>

Every document a user uploads during verification is permanently linked to their User entity. This page explains what's collected, how to retrieve it, and how to upload additional documents manually.

## What Didit collects

| Document type                                                                 | When collected                                                      | Fields extracted                                                       |
| ----------------------------------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| **Government ID** (passport, national ID, driver's license, residence permit) | [ID verification](/core-technology/id-verification/overview) step   | Name, DOB, document number, issuing country, expiry, MRZ where present |
| **Selfie / liveness frames**                                                  | [Liveness](/core-technology/liveness/overview) step                 | Largest face crop, passive liveness score                              |
| **Proof of address (POA)**                                                    | [POA](/core-technology/proof-of-address/overview) step              | Name, address, issuer, document date                                   |
| **NFC chip read**                                                             | [NFC verification](/core-technology/nfc-verification/overview) step | Chip data, ICAO certificate chain, match against OCR                   |
| **Additional documents**                                                      | Analyst request or custom workflow steps                            | OCR when applicable, otherwise stored as-is                            |

[Supported document types](/core-technology/id-verification/supported-documents-id-verification) covers the full country × document matrix (14,000+ documents across 220+ countries).

## Retrieving documents

Documents are associated with the **session** that collected them, not directly with the user. To list all documents for a user:

<Steps>
  <Step title="List the user's sessions">
    ```bash theme={null}
    curl -G https://verification.didit.me/v3/sessions/ \
      -H "x-api-key: YOUR_API_KEY" \
      --data-urlencode "vendor_data=user-42"
    ```
  </Step>

  <Step title="Fetch each session's decision">
    Each session decision includes URLs to the collected documents.

    ```bash theme={null}
    curl https://verification.didit.me/v3/session/{session_id}/decision/ \
      -H "x-api-key: YOUR_API_KEY"
    ```

    Inspect the `id_verification.document_images`, `proof_of_address.document_images`, and `liveness.images` fields in the response.
  </Step>

  <Step title="Use signed URLs">
    Image URLs in the response are short-lived signed URLs. Cache them client-side for the duration of use, or re-fetch the decision when they expire.
  </Step>
</Steps>

## Generating a PDF report

For a human-readable export of everything collected for a session, including all documents, use:

**`GET /v3/session/{session_id}/generate-pdf/`**

Returns a PDF with session details, feature results, and embedded document images. Useful for compliance audits, SAR attachments, and regulatory filings.

## Uploading documents from the console

Compliance operators can upload additional documents against a user or an active session:

1. Navigate to *Users → \[user] → Documents → Upload document*.
2. Choose a document type (ID, POA, custom).
3. Upload a file; OCR runs automatically for supported types.
4. The document attaches to the most recent session (or you can create a remediation session).

<Note>
  The document upload UI is console-only — there is no public API endpoint for directly attaching documents to a user. Use sessions as the entry point for all document capture.
</Note>

## Document cross-referencing

When a session collects multiple document types, Didit cross-references them:

* **ID ↔ Liveness** — face on the ID matches the liveness selfie.
* **ID ↔ POA** — name on the POA matches the name extracted from the ID.
* **ID ↔ NFC** — MRZ / visual data matches the NFC chip data.

Inconsistencies are surfaced as warnings on the session decision and can be configured to trigger manual review.

## Document monitoring and re-verification

For use-cases requiring ongoing document validity (e.g. expired IDs):

* **Document expiry** is tracked on every verified ID. Query the session decision for the `expiry_date` field.
* **Re-verification** — trigger a new session against the same `vendor_data` to refresh documents.
* **Document monitoring** — opt into [document monitoring](/core-technology/id-verification/document-monitoring-id-verification) to be notified when a document is about to expire.

## Document geolocation

The [ID document geolocation](/core-technology/id-verification/document-geolocation-id-verification) check compares the IP location of the submitter against the issuing country of the ID. Results are attached to the session decision.

## Privacy and retention

* All documents are encrypted at rest.
* Image access is via short-lived signed URLs.
* Retention follows the application's [data retention](/console/data-retention) policy.
* Users have the right to request deletion; deletion removes images, OCR extracts, and NFC data.

## Next steps

<CardGroup cols={3}>
  <Card title="ID verification" icon="id-card" href="/core-technology/id-verification/overview">
    How ID capture and OCR works.
  </Card>

  <Card title="Proof of address" icon="file-invoice" href="/core-technology/proof-of-address/overview">
    POA document collection.
  </Card>

  <Card title="Session decision" icon="file-lines" href="/sessions-api/retrieve-session">
    GET /v3/session/{id}/decision/ reference.
  </Card>
</CardGroup>