> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# 可复用 KYC：一次验证，跨应用安全共享

> Didit 可复用 KYC 让用户只需验证一次身份，即可在多个应用间安全复用。消除重复认证，大幅减少入驻摩擦。Didit 免费提供。

可复用 KYC 允许用户仅验证一次身份，即可在多个集成了 Didit 的应用之间安全地共享该验证结果。这在确保安全与合规的同时，大幅减少了入驻流程中的阻力。

可复用 KYC 集成提示词
        将提示词复制到剪贴板



      
      

\<pre>

\````# Goal
Integrate Didit Reusable KYC — hand off a finished verification session from one Didit application to another without re-running the verification. Two endpoints: **share** on the source application, **import-shared** on the receiving application.

\# Delivery mode
Cross-application share flow. Both calls authenticate with each side's own application API key (`x-api-key`). Source session must already be in a finished status (Approved / Declined / In Review).

\# Step 1 — Mint a share token (source application)
POST https://verification.didit.me/v3/session/{sessionId}/share/
x-api-key: YOUR_API_KEY
Content-Type: application/json

\```bash
curl -X POST 'https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/share/' \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"for_application_id": "a5f3bca2-46e2-411e-90ef-a580900a57ee",
"ttl_in_seconds": 7200
}'
\```
Response: { share_token, for_application_id, session_kind: "user" | "business" }.

\`ttl_in_seconds` — min 60, max 86400 (24h), default 3600 (1h).

\# JWT payload (token contents)
The HS256-signed JWT carries:
\- `session_id` — UUID of the source session being shared.
\- `session_kind` — "user" (KYC) or "business" (KYB) — drives which related rows are cloned.
\- `from_application_id` — calling application UUID.
\- `for_application_id` — receiving application UUID — only this app can redeem.
\- `iat` / `exp` — issued-at and expiry epoch seconds.

The token is not idempotent (each call mints a fresh JWT) and cannot be revoked — it simply expires.

\# Step 2 — Redeem the token (receiving application)
POST https://verification.didit.me/v3/session/import-shared/

\```bash
curl -X POST 'https://verification.didit.me/v3/session/import-shared/' \
-H 'x-api-key: RECEIVING_APP_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"share_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"trust_review": false,
"workflow_id": "9f9b1234-aaaa-bbbb-cccc-1234567890ab",
"vendor_data": "user-1"
}'
\```
Required: share_token, trust_review, workflow_id (must exist on the receiving app). Optional: vendor_data (defaults to source).

\`trust_review`:
\- `true` — cloned session keeps the source status (Approved stays Approved).
\- `false` — cloned session is forced to "In Review" so your reviewers re-decide.

Response (201): the V3 decision payload for both kinds — KYC for user sessions, KYB for business sessions — the same shape as GET /v3/session/{sessionId}/decision/, discriminated by `session_kind`. The cloned session has a fresh session_id and `shared_from_session` pointing at the source for audit.

\# Failure modes to handle
\- 400 "Invalid share token." — malformed JWT / wrong signature.
\- 400 "Share token has expired." — past exp.
\- 400 "This token is not valid for this application." — JWT `for_application_id` doesn't match the receiving app.
\- 400 "Original session does not exist." — source session deleted between mint and redeem.
\- 403 "This session has already been shared with your application." — same token can only be redeemed once per receiving app. Mint a new token.
\- 404 "Workflow does not exist for this application." — `workflow_id` is from a different application.
\- Source status not finished — 400 "Only finished sessions (Approved, Declined, In Review) can be shared."

\# What gets cloned
\- session_kind="user": KYC, Face, Liveness, FaceMatch, AML, POA, Phone, Location, DatabaseValidation rows + activity log.
\- session_kind="business": KYBCompany, KYBKeyPeopleCheck, KYBDocument + shared feature rows (AML, Phone, Email, Location, QuestionnaireResponse) + activity log.

\# See also
\- Mint share token: /sessions-api/share-session
\- Redeem share token: /sessions-api/import-shared-session
\- Canonical decision schema: /reference/data-models#overview
\- Full integration playbook: /integration/integration-prompt````

\</pre>



      
      

粘贴到

Didit Academy KYB 课程的本章节将继续讲解参与方验证以及 KYC 会话的复用。在 KYB Academy 课程中，7:04 处的章节展示了如何通过复用现有 KYC 会话来进行参与方验证，而不是让 UBO 进行两次验证。[参与方验证与复用 KYC 会话 — Didit Academy](https://www.youtube.com/embed/JEnW_sEe35Y?start=424\&rel=0\&playsinline=1)## 工作原理**1. 首次验证**用户完成标准 KYC 流程（身份证件验证 + 人脸识别）。验证数据经加密后存储在用户的 Didit ID 中，符合 eIDAS2 要求。**2. 在新应用中复用**当用户使用另一个集成了 Didit 的应用时，他们可以选择复用现有的 KYC。通过快速的人脸识别核验确认其身份后，用户同意共享特定数据。**3. 即时入驻**新应用会即时获取已验证的 KYC 信息：无需重新上传证件，无需等待。## 核心优势| 针对用户 | 针对企业 | 针对合规 |
| - | - | - |
| 一次验证，随处使用 | 更快速的用户入驻 | 严格遵循监管标准 |
| 掌控数据共享 | 降低流失率 | 完整的审计日志 |
| 数秒即可完成，而非数分钟 | 带来更高的转化率 | 支持跨司法管辖区 |## 安全与合规| 领域 | 详情 |
| - | - |
| **加密** | 对所有存储和传输的数据进行端到端加密 |
| **生物识别二次认证** | 每次复用均需进行人脸识别 |
| **监管合规** | 符合 eIDAS2 规范，满足 AML/KYC 合规要求 |
| **跨境适用** | 适用于不同司法管辖区 |![Didit 可复用 KYC 流程，允许已验证用户跨服务流转身份](https://mintcdn.com/didit-0f962782/z6T2GHM4Zh-iSj-K/images/reusable-kyc.png?fit=max\&auto=format\&n=z6T2GHM4Zh-iSj-K\&q=85\&s=12c89122aad772b3683a629343b6dabc)已完成首次验证的用户即可自动获得可复用 KYC 功能。用户可以随时选择复用其现有 KYC，或重新进行验证。


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.