Didit MCP Tools Reference: 169 Identity Tools

The hosted server at https://mcp.didit.me/mcp gives a signed-in user 169 tools: 80 read, 62 write and 27 destructive. The 17 Investigator tools are listed too, but they only work once the Investigator is enabled for your organization. Two more (didit_org_top_up and didit_org_reveal_application_api_key) are hidden from every OAuth-authenticated catalog and only appear on a local stdio server, which also adds five account-setup tools (see self-hosting). This page is generated from the tool registry in didit-protocol/mcp (src/index.ts, the version the hosted server reports in serverInfo). Names, types and required arguments come from the server’s own tools/list response; the role permission comes from src/permissions.ts.

How to read the table

Column	Meaning
Type	From the tool’s MCP annotations. Read is read-only. Write creates or changes something. Destructive deletes or overwrites data, changes something that takes effect at once (a published workflow, a session decision), reveals a secret or moves money; clients ask for confirmation before running these. Billable standalone checks count as writes.
Scope	The OAuth scope whose resources include the tool’s role permission: `didit:verification` for sessions, businesses, cases, networks, transactions and the blocklist; `didit:management` for workflows, questionnaires, lists, webhooks, integrations, members, roles, API keys, audit logs, the organization, applications, subscription and users. Either means analytics, which both scopes include, or a tool with no per-role check, which runs under whichever scope you approved. See Authentication.
Role permission	The permission your organization role must hold, as the Didit backend checks it. A dash means the endpoint is membership-scoped or has no per-role check. When your role lacks the permission the tool returns a `missing_scope` error naming it.

Every tool accepts optional organization_id and application_id to pin a scope. With a single org and app they are resolved for you; with several, the *_search tools and didit_analytics span all of them and the per-app *_list tools do the same when you pass no scope.

didit_session_delete and didit_session_batch_delete refuse to run without confirm: true in their arguments, as do the Investigator decision tools (accept, override, batch_accept, rereview, question_answer, question_dismiss) and the local-only didit_org_reveal_application_api_key. didit_case_manage needs it when filing a SAR, and didit_vendor_user_delete and didit_vendor_business_delete need it when delete_all is true.

Discovery and cross-app

These span every organization and application you can access in a single call; each row is tagged with its org and app.

Tool	Type	Scope	Role permission	What it does
`didit_context_get`	Read	Either	—	Every organization and application you can reach, nested, plus the default org and app when there is only one. Call it first.
`didit_session_search`	Read	`didit:verification`	`list:sessions`	Search verification sessions across all your apps and organizations, newest first.
`didit_transaction_search`	Read	`didit:verification`	`list:transactions`	Search monitored transactions across all your apps and organizations.
`didit_case_search`	Read	`didit:verification`	`list:cases`	Search investigation cases across all your apps and organizations.
`didit_vendor_user_search`	Read	`didit:management`	`list:users`	Find an end customer by name, email or `vendor_data` across all your apps.
`didit_vendor_business_search`	Read	`didit:verification`	`list:businesses`	Find a KYB business across all your apps.
`didit_workflow_search`	Read	`didit:management`	`read:workflows`	Find a workflow by id or label across all your apps; the result says which org and app own it.
`didit_analytics`	Read	Either	`read:analytics`	Aggregate analytics for a date window (request breakdown, feature funnel, conversion rate) across all your apps.

Sessions (KYC and KYB)

Tool	Type	Scope	Role permission	What it does
`didit_session_create`	Write	`didit:verification`	`create:sessions` or `write:sessions`	Create a verification session for a workflow. Returns `session_id`, `url` and `session_token`.
`didit_session_list`	Read	`didit:verification`	`list:sessions`	List sessions in one app. Spans every app when you give no scope.
`didit_session_get_decision`	Read	`didit:verification`	`read:sessions`	The full decision and all extracted data for a session.
`didit_session_get_location_evidence`	Read	`didit:verification`	`read:sessions`	The Precise Location evidence of one session for each Location step: the configuration that judged it, the verdict, every attempt, the reference points, the distances and the areas.
`didit_session_update_status`	Destructive	`didit:verification`	`write:sessions`	Approve, decline or request resubmission of a session.
`didit_session_update_data`	Write	`didit:verification`	`write:sessions`	Correct the data extracted from the ID document (reviewer override).
`didit_session_update_poa_data`	Write	`didit:verification`	`write:sessions`	Correct the data extracted from the proof-of-address document.
`didit_session_delete`	Destructive	`didit:verification`	`delete:sessions`	Permanently delete one session with its verification data and media. Needs `confirm: true`.
`didit_session_batch_delete`	Destructive	`didit:verification`	`delete:sessions`	Permanently delete many KYC sessions by session number, or every KYC session in the app. Needs `confirm: true`. KYB sessions are never touched.
`didit_session_generate_pdf`	Write	`didit:verification`	`read:sessions`	Generate a PDF verification report for a session.
`didit_session_list_reviews`	Read	`didit:verification`	`read:sessions`	The review history and activity log of a session.
`didit_session_add_review`	Write	`didit:verification`	`write:sessions`	Add a review note to a session, optionally changing its status.
`didit_session_share`	Write	`didit:verification`	`write:sessions`	Share a verified session with a trusted partner (Reusable KYC).
`didit_session_import_shared`	Write	Either	—	Import a session a partner shared with you (Reusable KYC).
`didit_session_create_import`	Write	Either	—	Start a bulk import job from a hosted CSV or NDJSON file.
`didit_session_get_import_template`	Read	Either	—	Download the import template (column headers and format).
`didit_session_get_import`	Read	Either	—	Status and summary of a bulk import job.
`didit_session_get_import_errors`	Read	Either	—	Per-row failures of a bulk import job.
`didit_session_explain_decision`	Read	`didit:verification`	`read:sessions`	Why a session ended Approved, Declined or In Review: the deciding feature, each warning that had an effect, every triggered status rule, any reviewer override, and the workflow setting behind each cause.
`didit_session_webhooks`	Read	`didit:verification`	`read:sessions`	The webhook deliveries sent for one session in the last 30 days: destination, HTTP status, timing, signing headers and a capped copy of the payload.
`didit_session_webhook_resend`	Write	`didit:verification`	`create:sessions`	Resend one recorded webhook delivery of a session to the configured endpoint, for example after the endpoint was fixed.

Workflows

Simple workflows are a flat feature list; graph workflows add branches, conditions and Document AI steps. See Advanced: branching workflows.

Tool	Type	Scope	Role permission	What it does
`didit_workflow_list`	Read	`didit:management`	`read:workflows`	List verification workflows. Spans every app when you give no scope.
`didit_workflow_create`	Write	`didit:management`	`write:workflows`	Create a simple, linear workflow from an ordered feature list. Publishes it unless you pass `status: "draft"`.
`didit_workflow_get`	Read	`didit:management`	`read:workflows`	The full configuration of one workflow, including which data points are returned per feature.
`didit_workflow_update`	Destructive	`didit:management`	`write:workflows`	Change a workflow’s top-level settings (label, default flag, retries, expiration, white-label, allow-lists).
`didit_workflow_delete`	Destructive	`didit:management`	`write:workflows`	Delete a draft workflow.
`didit_workflow_get_graph`	Read	`didit:management`	`read:workflows`	The node graph of a workflow with its status and editability. Large configs are summarized unless you ask for them.
`didit_workflow_get_field_definitions`	Read	`didit:management`	`read:workflows`	Every field you can branch on and the operators each one accepts.
`didit_workflow_get_feature_config_schema`	Read	Either	—	Every `config` key each workflow feature accepts, with type, bounds, default and meaning.
`didit_workflow_get_id_verification_methods_catalog`	Read	`didit:management`	`read:workflows`	Per country, which non-document lookups and digital-ID wallets are offered, whether they are live, and their lookup catalog prices.
`didit_workflow_get_kyb_registry_catalog`	Read	Either	—	Per country, which company-data tiers the registries offer and whether registry monitoring is sold, with prices. No org or app needed.
`didit_workflow_get_branch_fields`	Read	`didit:management`	`read:workflows`	The fields available at one branch point of a candidate graph.
`didit_workflow_validate_graph`	Read	`didit:management`	`read:workflows`	Dry-run validation of a full graph. Saves nothing.
`didit_workflow_edit_graph`	Destructive	`didit:management`	`write:workflows`	Modify an existing graph with small operations; the server fetches the full graph itself and saves a draft.
`didit_workflow_set_graph`	Destructive	`didit:management`	`write:workflows`	Replace a workflow’s entire graph. Saves a draft; publishing is a separate step.
`didit_workflow_create_draft`	Write	`didit:management`	`write:workflows`	Create an editable draft from a published workflow.
`didit_workflow_publish`	Destructive	`didit:management`	`write:workflows`	Publish the pending draft so new sessions use it.
`didit_workflow_build_graph`	Read	`didit:management`	`read:workflows`	Build a complete graph from a plain feature spec without saving anything.

Compliance assistant

Build a workflow from your regulatory profile: an adaptive interview, the obligations that apply to you with citations, and a generated multi-country workflow.

Tool	Type	Scope	Role permission	What it does
`didit_compliance_interview_next`	Read	`didit:management`	`read:workflows`	The next question of the adaptive compliance interview, or `done` when it is complete. Pass every answer collected so far on each call.
`didit_compliance_profile_get`	Read	`didit:management`	`read:workflows`	Your stored compliance profile: the interview answers and the attributes derived from them.
`didit_compliance_profile_set`	Destructive	`didit:management`	`write:workflows`	Store the completed interview answers, replacing any existing compliance profile.
`didit_compliance_requirements`	Read	`didit:management`	`read:workflows`	The regulatory obligations that apply to you, with citations, derived from the stored profile.
`didit_compliance_generate_workflow`	Read	`didit:management`	`read:workflows`	Generate a multi-country workflow graph from the stored profile: a common trunk plus per-country branches with the checks each country requires.
`didit_compliance_check_workflow`	Read	`didit:management`	`read:workflows`	Check which obligations a workflow version satisfies or violates, with citations.

Questionnaires

Tool	Type	Scope	Role permission	What it does
`didit_questionnaire_list`	Read	`didit:management`	`read:questionnaires`	List the custom questionnaires of an app.
`didit_questionnaire_create`	Write	`didit:management`	`write:questionnaires`	Create a questionnaire from an ordered list of questions.
`didit_questionnaire_append_choices`	Write	`didit:management`	`write:questionnaires`	Append answer options to one question of a draft questionnaire.
`didit_questionnaire_get`	Read	`didit:management`	`read:questionnaires`	The questions and options of one questionnaire.
`didit_questionnaire_update`	Destructive	`didit:management`	`write:questionnaires`	Update a questionnaire’s title, description or questions.
`didit_questionnaire_delete`	Destructive	`didit:management`	`write:questionnaires`	Delete a questionnaire.

Standalone verification APIs

Single billable calls with no session. Every one of them is a POST that consumes credits, even the ones that read like a query (kyb_search, face_search).

Tool	Type	Scope	Role permission	What it does
`didit_verify_id`	Write	`didit:verification`	`create:sessions`	Verify an identity document from its front (and optionally back) image.
`didit_verify_poa`	Write	`didit:verification`	`create:sessions`	Verify a proof-of-address document.
`didit_verify_database`	Write	`didit:verification`	`create:sessions`	Check identity data against national and global authoritative sources.
`didit_verify_kyb_search`	Write	`didit:verification`	`create:sessions`	Search official company registries by name or registration number; returns candidates.
`didit_verify_kyb_select`	Write	`didit:verification`	`create:sessions`	Pull the full registry record for a candidate returned by `didit_verify_kyb_search`.
`didit_verify_passive_liveness`	Write	`didit:verification`	`create:sessions`	Passive liveness from a single image.
`didit_verify_face_match`	Write	`didit:verification`	`create:sessions`	Compare two facial images (1:1).
`didit_verify_face_search`	Write	`didit:verification`	`create:sessions`	Search a face against previously verified faces (1:N).
`didit_verify_age`	Write	`didit:verification`	`create:sessions`	Estimate a person’s age from a facial image.
`didit_verify_aml`	Write	`didit:verification`	`create:sessions`	Screen a name against sanctions, PEP and watchlists, optionally adverse media.
`didit_verify_email_send`	Write	Either	—	Send a one-time code to an email address.
`didit_verify_email_check`	Write	Either	—	Check the code sent to an email address.
`didit_verify_phone_send`	Write	Either	—	Send a one-time code to a phone number.
`didit_verify_phone_check`	Write	Either	—	Check the code sent to a phone number.

Transaction monitoring

Tool	Type	Scope	Role permission	What it does
`didit_transaction_list`	Read	`didit:verification`	`list:transactions`	List monitored transactions in one app. Spans every app when you give no scope.
`didit_transaction_create`	Write	`didit:verification`	`create:transactions`	Submit a transaction for monitoring and rule evaluation.
`didit_transaction_get`	Read	`didit:verification`	`list:transactions`	One monitored transaction with its rule-evaluation result.
`didit_transaction_screen_wallet`	Write	`didit:verification`	`create:transactions`	Screen a crypto wallet address for AML risk without creating a transaction.
`didit_transaction_rule_list`	Read	`didit:verification`	`list:transactions`	List the transaction-monitoring rules of an app.
`didit_transaction_rule_get`	Read	`didit:verification`	`list:transactions`	One rule with its conditions, aggregation, scope, actions and counters.
`didit_transaction_rule_create`	Write	`didit:verification`	`write:transactions`	Create a custom rule.
`didit_transaction_rule_update`	Write	`didit:verification`	`write:transactions`	Partially update a rule.
`didit_transaction_rule_delete`	Destructive	`didit:verification`	`write:transactions`	Delete a custom rule.
`didit_transaction_rule_backtest`	Read	`didit:verification`	`list:transactions`	Dry-run a hypothetical rule against up to the 10,000 most recent transactions. Writes nothing.
`didit_transaction_rule_library_list`	Read	`didit:verification`	`list:transactions`	Browse Didit’s preset rule library with install status.
`didit_transaction_rule_install`	Write	`didit:verification`	`write:transactions`	Install preset rules by library key or bundle.
`didit_transaction_rule_uninstall`	Destructive	`didit:verification`	`write:transactions`	Remove installed preset rules by library key or bundle.
`didit_transaction_sdk_token`	Write	Either	—	Mint a short-lived token, bound to one end user, for submitting transactions from the client SDKs.

Travel Rule

Tool	Type	Scope	Role permission	What it does
`didit_travel_rule_get_settings`	Read	Either	—	Your Travel Rule settings: VASP profile, negotiation policy, proof methods, per-network modes and your travel address.
`didit_travel_rule_update_settings`	Write	Either	—	Change Travel Rule settings; send only the fields to change. Enabling requires a legal name.
`didit_travel_rule_search_vasps`	Read	Either	—	Search the VASP directory, with due-diligence scores and the networks each VASP is reachable on.
`didit_travel_rule_list_wallet_addresses`	Read	Either	—	The wallet address book that inbound transfers resolve against, with each address’s ownership-verification state.
`didit_travel_rule_add_wallet_address`	Write	Either	—	Add a wallet you control to the address book, optionally as already ownership-verified by self-declaration.
`didit_travel_rule_update_wallet_address`	Write	Either	—	Update the holder details of an address book entry.
`didit_travel_rule_delete_wallet_address`	Destructive	Either	—	Delete an address book entry; it stops matching new transfers immediately.
`didit_travel_rule_confirm_ownership`	Destructive	Either	—	Confirm or deny wallet ownership on a transfer that is waiting for an ownership proof.
`didit_travel_rule_transfer_action`	Destructive	Either	—	Finish an outbound transfer with its on-chain hash, cancel a transfer that is not final, or re-run counterparty routing.
`didit_travel_rule_get_vasp`	Read	Either	—	Get one VASP directory entry by id, with the same fields as a search row: routes, network listings, aliases, contacts and entities.
`didit_travel_rule_list_networks`	Read	Either	—	The state of each Travel Rule network for your application, with the reason, your participant record and the due-diligence questionnaire.
`didit_travel_rule_request_network`	Write	Either	—	Ask to join a Travel Rule network as a participant. The request waits until the due-diligence questionnaire is approved.
`didit_travel_rule_get_network_questionnaire`	Read	Either	—	The due-diligence questionnaire for network access: status, saved answers, the reviewer’s note and the status history.
`didit_travel_rule_update_network_questionnaire`	Write	Either	—	Save answers to the questionnaire draft. Send only the answers to change.
`didit_travel_rule_submit_network_questionnaire`	Destructive	Either	—	Submit the saved questionnaire for review. It cannot be edited while in review.
`didit_travel_rule_set_counterparty_vasp`	Write	Either	—	Pick the counterparty VASP of an outbound transfer that could not be routed, and re-run the exchange towards it.
`didit_travel_rule_list_messages`	Read	Either	—	The messages and document requests exchanged with the counterparty VASP on a transfer, oldest first.
`didit_travel_rule_send_message`	Write	Either	—	Send a message or a document request to the counterparty VASP of a transfer. Only transfers with another Didit customer or over email carry messages.
`didit_travel_rule_list_counterparty_contacts`	Read	Either	—	The compliance contacts used to reach a counterparty VASP by email: the platform’s and your application’s own.
`didit_travel_rule_add_counterparty_contact`	Write	Either	—	Add a compliance contact for a directory VASP, private to your application.
`didit_travel_rule_delete_counterparty_contact`	Destructive	Either	—	Delete one of your application’s own counterparty contacts.
`didit_travel_rule_get_sandbox_scenarios`	Read	Either	—	The Didit Test VASP that sandbox applications exchange with, and the scenarios (accept, decline, name mismatch, not reachable, timeout, self-hosted) each wallet address selects.
`didit_travel_rule_trigger_test_inbound`	Write	Either	—	Sandbox applications only: have the Didit Test VASP send you an inbound Travel Rule transfer.

Vendor users and businesses

Tool	Type	Scope	Role permission	What it does
`didit_vendor_user_list`	Read	`didit:management`	`list:users`	List verified users grouped by `vendor_data`. Spans every app when you give no scope.
`didit_vendor_user_create`	Write	`didit:management`	`create:users`	Create a user record manually.
`didit_vendor_user_get`	Read	`didit:management`	`read:users`	One user by `vendor_data`.
`didit_vendor_user_update`	Write	`didit:management`	`write:users`	Update a user’s profile fields.
`didit_vendor_user_update_status`	Write	`didit:management`	`write:users`	Set a user’s status to `ACTIVE`, `FLAGGED` or `BLOCKED`.
`didit_vendor_user_delete`	Destructive	`didit:management`	`delete:users`	Batch-delete users by `vendor_data`, or delete all users.
`didit_vendor_business_list`	Read	`didit:verification`	`list:businesses`	List verified businesses grouped by `vendor_data`. Spans every app when you give no scope.
`didit_vendor_business_create`	Write	`didit:verification`	`create:businesses`	Create a business record manually.
`didit_vendor_business_get`	Read	`didit:verification`	`read:businesses`	One business by `vendor_data`.
`didit_vendor_business_update`	Write	Either	—	Update a business’s profile fields.
`didit_vendor_business_update_status`	Write	`didit:verification`	`write:businesses`	Set a business’s status to `ACTIVE`, `FLAGGED` or `BLOCKED`.
`didit_vendor_business_delete`	Destructive	`didit:verification`	`delete:businesses`	Batch-delete businesses by `vendor_data` or internal id, or delete all businesses.

Lists, blocklist and allowlist

Tool	Type	Scope	Role permission	What it does
`didit_lists_list`	Read	`didit:management`	`read:lists`	All lists of an app: blocklists, allowlists and custom lists.
`didit_lists_create`	Write	`didit:management`	`create:lists`	Create an allowlist or custom list.
`didit_lists_get`	Read	`didit:management`	`read:lists`	One list by UUID.
`didit_lists_update`	Write	`didit:management`	`write:lists`	Rename a list or change its description.
`didit_lists_delete`	Destructive	`didit:management`	`delete:lists`	Delete a list and all its entries.
`didit_lists_entries_list`	Read	`didit:management`	`read:lists`	The entries of one list.
`didit_lists_entry_create`	Write	`didit:management`	`create:lists`	Add an entry to a list, by value or from a session.
`didit_lists_entry_upload_face`	Write	`didit:management`	`create:lists`	Add a face to a face list from an image, without a session.
`didit_lists_entry_delete`	Destructive	`didit:management`	`delete:lists`	Remove an entry from a list.
`didit_blocklist_get`	Read	`didit:verification`	`read:blocklist`	List blocklist entries (legacy helper).
`didit_blocklist_add`	Write	`didit:verification`	`write:blocklist`	Add an entry to the blocklist (legacy helper).
`didit_blocklist_remove`	Destructive	`didit:verification`	`write:blocklist`	Remove an entry from the blocklist (legacy helper).
`didit_allowlist_add`	Write	`didit:verification`	`write:blocklist`	Add an entry to the allowlist (legacy helper).

Cases

Tool	Type	Scope	Role permission	What it does
`didit_case_list`	Read	`didit:verification`	`list:cases`	List cases in one app. Spans every app when you give no scope.
`didit_case_get`	Read	`didit:verification`	`read:cases`	One case with its details.
`didit_case_create`	Write	`didit:verification`	`write:cases`	Open a case.
`didit_case_statistics`	Read	`didit:verification`	`list:cases`	Case counts by status and similar statistics.
`didit_case_manage`	Destructive	`didit:verification`	`write:cases`	Assign, resolve, reopen, escalate, comment on or update a case.

Fraud networks

Tool	Type	Scope	Role permission	What it does
`didit_network_list`	Read	`didit:verification`	`list:networks`	List the fraud networks in one app, with the console’s filters and KPIs.
`didit_network_get`	Read	`didit:verification`	`read:networks`	One fraud network with its members and signals; graph, map and timeline on request.
`didit_network_membership_get`	Read	`didit:verification`	`read:networks`	The fraud networks a session, business session, user, business or transaction belongs to.

Investigator

These tools appear in tools/list for every signed-in user, but they only work once the Investigator is enabled for your organization.

Tool	Type	Scope	Role permission	What it does
`didit_investigator_queue_list`	Read	Either	—	List the Investigator’s open reports, the review queue, with the recommendation and confidence of each.
`didit_investigator_report_get`	Read	Either	—	One Investigator report: recommendation, confidence, risk, narrative, evidence, precedents and questions.
`didit_investigator_record_get`	Read	Either	—	The Investigator’s newest review of one verification or one transaction, open or decided.
`didit_investigator_accept`	Destructive	Either	—	Accept the Investigator’s recommendation on one item; the item is decided and logged under your name.
`didit_investigator_override`	Destructive	Either	—	Decide one item with another action, a category and a reason instead of the recommendation.
`didit_investigator_batch_accept`	Destructive	Either	—	Accept up to 50 ready recommendations at once; an item that cannot be accepted is skipped with its reason.
`didit_investigator_add_note`	Write	Either	—	Add a fact about a report’s item as a team note that the next review reads.
`didit_investigator_rereview`	Destructive	Either	—	Ask the Investigator to review an item again; the new report replaces the open one.
`didit_investigator_question_list`	Read	Either	—	The policy questions the Investigator raises, newest first.
`didit_investigator_question_get`	Read	Either	—	One policy question with the team’s last 30 days on that situation and the possible answers.
`didit_investigator_question_answer`	Destructive	Either	—	Answer a policy question; most answers write a new policy version.
`didit_investigator_question_dismiss`	Destructive	Either	—	Close a policy question without an answer.
`didit_investigator_backtest_start`	Write	Either	—	Start a free backtest that replays the current policy on the last 30 or 90 days of decisions. It decides nothing.
`didit_investigator_backtest_get`	Read	Either	—	A stored backtest: agreement per queue, tier and threshold.
`didit_investigator_performance_get`	Read	Either	—	The Investigator’s agreement with your team, volume, time saved and overrides over 7, 30 or 90 days.
`didit_investigator_dashboard_get`	Read	Either	—	The Investigator dashboard: 30-day automation, weekly history, spend and overrides.
`didit_investigator_activity_list`	Read	Either	—	The Investigator’s activity log, newest first: what the agent and people did.

Reports, audit log and alerts

Tool	Type	Scope	Role permission	What it does
`didit_report_list`	Read	Either	—	List export reports.
`didit_report_get`	Read	Either	—	Status and details of one export report.
`didit_report_get_download_url`	Read	Either	—	A signed download URL for a finished report.
`didit_report_export`	Write	Either	—	Start an export (sessions, transactions, users or businesses).
`didit_audit_log_list`	Read	Either	—	Audit-log entries for an app: who changed what.
`didit_alert_list`	Read	`didit:management`	`read:applications`	The configured alerts of an app.
`didit_alert_configure`	Write	`didit:management`	`write:applications`	Configure one alert by type.

Webhooks

Tool	Type	Scope	Role permission	What it does
`didit_webhook_list`	Read	`didit:management`	`read:webhooks`	The webhook destinations of an app.
`didit_webhook_create`	Write	`didit:management`	`write:webhooks`	Create a webhook destination. The signing secret is redacted in the response; copy it from the console.
`didit_webhook_get`	Read	`didit:management`	`read:webhooks`	One webhook destination, with the signing secret redacted.
`didit_webhook_update`	Destructive	`didit:management`	`write:webhooks`	Change a destination’s URL, version, enabled flag or subscribed events.
`didit_webhook_delete`	Destructive	`didit:management`	`write:webhooks`	Delete a webhook destination.

Marketplace

Tool	Type	Scope	Role permission	What it does
`didit_marketplace_list_catalog`	Read	`didit:management`	`read:integrations`	The provider marketplace: blockchain analytics, AML screening, phone and bank verification providers and Travel Rule networks, with the credentials each needs.
`didit_marketplace_list_connections`	Read	`didit:management`	`read:integrations`	Your app’s marketplace connections and network memberships, with status and last use. Secrets are never returned.
`didit_marketplace_request_integration`	Write	`didit:management`	`write:integrations`	Ask for an integration that is not self-serve yet; the Didit team follows up.

Organization, members, billing and branding

Two tools in this group (didit_org_top_up, didit_org_reveal_application_api_key) are defined in the server but hidden from the catalog of every OAuth-authenticated caller; they are only listed on a local stdio server.

Tool	Type	Scope	Role permission	What it does
`didit_org_list`	Read	Either	—	The organizations you belong to.
`didit_org_list_applications`	Read	Either	—	The applications of one organization.
`didit_org_get_application`	Read	Either	—	Application details, with the API key redacted.
`didit_org_reveal_application_api_key`	Destructive	Either	—	Return the raw application API key. Needs explicit ids and `confirm: true`. Hidden on the hosted connector.
`didit_org_get_balance`	Read	`didit:management`	`read:subscription`	Credit balance and auto-refill settings.
`didit_org_top_up`	Destructive	Either	—	Create a Stripe checkout to add credits. Hidden on the hosted connector.
`didit_branding_get`	Read	`didit:management`	`read:customization`	The branding (logos, colors) applied to your verification UI.
`didit_branding_update`	Write	`didit:management`	`write:customization`	Upload new branding images.
`didit_org_list_members`	Read	`didit:management`	`list:members`	The members of an organization.
`didit_org_invite_member`	Write	`didit:management`	`write:members`	Invite a member by email with a role.
`didit_org_update_member`	Write	`didit:management`	`write:members`	Change a member’s role.
`didit_org_remove_member`	Destructive	`didit:management`	`delete:members`	Remove a member from the organization.
`didit_org_list_roles`	Read	`didit:management`	`list:roles`	The roles available in the organization.
`didit_org_list_api_keys`	Read	`didit:management`	`read:applications`	API-key metadata with the raw values redacted.

File inputs

Tools that take a file (didit_verify_id, didit_verify_poa, didit_verify_passive_liveness, didit_verify_face_match, didit_verify_face_search, didit_verify_age, didit_lists_entry_upload_face, didit_branding_update) accept it in one of two forms:

*_base64: the file content inline, as raw base64 or a data: URL. Use this against the hosted endpoint.
*_path: an absolute path on the machine running the server. Only works for a local stdio server that shares a filesystem with you.

Both forms enforce a 15 MB cap and a magic-bytes allow-list (PNG, JPG, WebP, GIF, BMP, ICO, PDF). The hosted transport accepts JSON bodies up to 25 MB.

Examples

Conversations that use these tools end to end.

Advanced

Roles, cross-app behavior, branching workflows, webhooks, self-hosting.

Guides

Authentication

Model Context Protocol (MCP)

Web SDKs

Native SDKs

Server SDKs

Integrations

Didit MCP Tools Reference: 169 Identity Tools

How to read the table

Discovery and cross-app

Sessions (KYC and KYB)

Workflows

Compliance assistant

Questionnaires

Standalone verification APIs

Transaction monitoring

Travel Rule

Vendor users and businesses

Lists, blocklist and allowlist

Cases

Fraud networks

Investigator

Reports, audit log and alerts

Webhooks

Marketplace

Organization, members, billing and branding

File inputs

Examples

Advanced

​How to read the table

​Discovery and cross-app

​Sessions (KYC and KYB)

​Workflows

​Compliance assistant

​Questionnaires

​Standalone verification APIs

​Transaction monitoring

​Travel Rule

​Vendor users and businesses

​Lists, blocklist and allowlist

​Cases

​Fraud networks

​Investigator

​Reports, audit log and alerts

​Webhooks

​Marketplace

​Organization, members, billing and branding

​File inputs

Examples

Advanced

How to read the table

Discovery and cross-app

Sessions (KYC and KYB)

Workflows

Compliance assistant

Questionnaires

Standalone verification APIs

Transaction monitoring

Travel Rule

Vendor users and businesses

Lists, blocklist and allowlist

Cases

Fraud networks

Investigator

Reports, audit log and alerts

Webhooks

Marketplace

Organization, members, billing and branding

File inputs