Skip to main content
GET
cURL

Overview

Returns one PDF with the full verification history of a User entity, keyed by vendor_data. It is the same document the Console produces from User detail → Actions → Download PDF, so compliance teams can automate exports instead of clicking once per user. The report contains:
  • A cover page with the profile summary (name, date of birth, issuing states, approved emails and phones), the latest status of every feature, the session counters and an index of the sessions included.
  • One full session report per included session, in chronological order (oldest first). Each one is the same report Generate PDF returns for that session on its own.

Eligible sessions and cap

Only User Verification (KYC) sessions in Approved, Declined, In Review or Kyc Expired are included. Sessions in any other status (Not Started, In Progress, Abandoned, Expired, …) are skipped. The report is capped at the 20 most recent reportable sessions. When a user has more, the newest 20 are included and the cover page states how many older sessions were left out. Use List sessions filtered by vendor_data when you need the complete list as JSON.

Response

The body is the PDF itself (application/pdf), not a JSON wrapper or a download URL. The Content-Disposition header is attachment; filename=user_<didit_internal_id>.pdf, where didit_internal_id is the user’s stable Didit identifier.

White-label

When white-label customization is enabled on your application, the cover and every session report carry your logo and privacy-policy URL instead of Didit branding, exactly like the per-session endpoint. Configure it at Console → Customization.

Caching and latency

Nothing is cached: every call re-renders the report from the current data, so a report requested after a manual review reflects the reviewer’s decision. Two calls can produce byte-different files; archive the downloaded file when you need an immutable copy. Rendering is synchronous and downloads every stored image of every included session, so a user with many media-heavy sessions can take tens of seconds. Use a generous client read timeout (120 s recommended) and stream the body to disk. Generation stops at a server-side time budget rather than running until your client gives up: if that budget is reached, the report still returns a valid PDF with the most recent sessions and the cover states how many were omitted.

Trailing slash

The canonical route ends with a trailing slash (…/generate-pdf/). A request without it is served directly with the same response: there is no 301 redirect, so no client has to follow redirects and curl does not need -L. Use the slashed URL as in the samples; it is the form the OpenAPI spec and your logs show.

Errors

Examples

Permissions

Any active API key of the application can call this endpoint. Didit API keys are application-scoped, not role-scoped: the Console’s roles and permissions (read:users and the rest) decide what a person can do in the Console, and are not evaluated for Management API traffic. A key can only export users of its own application.

Authorizations

x-api-key
string
header
required

Path Parameters

vendor_data
string
required

Your unique identifier for the user — a free-form string (NOT a UUID). This is the same value you passed as vendor_data when creating the user's sessions, matched exactly as sent. URL-encode it; a value containing / cannot be addressed by this route.

Response

The rendered PDF document, returned directly as binary application/pdf — there is no JSON wrapper and no download-URL indirection. The body starts with the %PDF magic bytes. Save it to a .pdf file or stream it through to your caller.

The response is of type file.