> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# 创建会话审核 API：人工 KYC

> 向 Didit 身份验证会话提交人工审核备注或状态变更。支持程序化合规审核与审计追踪，按次计费。



创建会话审核提示词
        将提示词复制到剪贴板



      
      

\<pre>

\``Goal: Push a manual decision (Approve / Decline / mark In Review) onto a Didit verification session and write an immutable audit-trail row. Programmatic equivalent of the Console manual-review buttons.

Endpoint: POST https://verification.didit.me/v3/sessions/{session_id}/reviews/
Auth header: x-api-key: YOUR_API_KEY
Content-Type: application/json

Path param:
\- session_id (UUID, REQUIRED) — verification session UUID. Must belong to the same application as the API key (cross-application writes return 404).

Request body:
\- new_status (string, REQUIRED) — one of "Approved" | "Declined" | "In Review". Workflow-internal statuses ("In Progress", "Awaiting User", "Resubmitted", "Expired", "Kyc Expired", "Abandoned", "Not Started") are NOT accepted (400).
\- comment (string, optional, max 10,000 chars) — reviewer rationale. Supports @email mentions which trigger Console notifications.

curl:
curl -s -X POST 'https://verification.didit.me/v3/sessions/8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d/reviews/' \
-H "x-api-key: $DIDIT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"new_status": "Approved", "comment": "POA cross-checked against utility bill; matches address on file."}'

Response 201 (compact ReviewSerializer shape — different from the GET response):
\{
"user": "API Client",                       // actor display label
"new_status": "Approved",
"comment": "POA cross-checked...",
"created_at": "2026-04-21T16:42:50.445Z"
}
To fetch the full activity row (uuid, activity_type, previous_status, ...) call GET /v3/sessions/{session_id}/reviews/ afterwards. See /reference/data-models for the full ReviewItem shape.

Side effects:
1\. Inserts a Review row with activity_type=STATUS_UPDATED, actor_type=API_KEY.
2\. Updates Session.status to new_status if it differs from the current status.
3\. Fires the status.updated webhook on configured destinations (see /integration/webhooks).
4\. Notifies previous reviewers and @email-mentioned Console users.
NOT idempotent — every call writes a new audit row. Re-posting the same new_status when it equals the current status is a no-op for Session.status but still writes an audit entry.

Failure modes (envelope {"detail": "..."} unless noted):
\- 400 — { "new_status": ["\\"Expired\\" is not a valid choice."] } (or missing new_status)
\- 401 — missing/invalid `x-api-key` header.
\- 403 — API key valid but wrong app or revoked.
\- 404 — session UUID not found / deleted / wrong app.
\- 429 — rate-limited.

For end-to-end Didit integration, paste in the full prompt at /integration/integration-prompt.``

\</pre>



      
      

粘贴到



## OpenAPI

````yaml zh/openapi-25.json POST /v3/sessions/{session_id}/reviews/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/sessions/{session_id}/reviews/:
    post:
      tags:
        - Sessions
      summary: 向会话的审计日志添加审核备注
      description: >-
        向用户验证（KYC）会话的审核 / 活动动态追加一条备注。**此 endpoint 仅记录一条条目，绝不会更改会话。** 会话的
        `status` 保持不变，不执行状态流转验证，也不触发任何
        Webhook。若要实际通过、拒绝或重新打开会话（这也会向该动态写入一条具有完整归属信息的 `STATUS_UPDATED` 条目），请改用
        `PATCH /v3/session/{session_id}/update-status/`。


        请求体中的两个字段均为可选，也接受空的 JSON 对象。`new_status`
        仅作为条目上的标签存储，接受十个会话状态值中的任意一个（区分大小写）。`comment` 中的 `@email`
        提及仅作为纯文本存储，它们不会在此 endpoint 上触发任何通知，并且条目的 `mentioned_emails` 保持为空。


        关于归属信息的说明：此处创建的条目不携带任何操作者信息。在动态中，它们显示 `actor_display:
        "Unknown"`、`actor_type: "CONSOLE_USER"` 和 `activity_type:
        "STATUS_UPDATED"`（存储默认值），且 `201` 响应体中的 `user` 字段为 `"Unknown"`。
      operationId: create_session_review
      parameters:
        - name: Content-Type
          in: header
          required: false
          description: 发送 JSON 请求体时设为 `application/json`。
          schema:
            type: string
            example: application/json
        - name: session_id
          in: path
          required: true
          description: >-
            用户验证（KYC）会话的 UUID。必须属于与 API 密钥相同的应用 — 跨应用 UUID、已删除会话以及企业验证（KYB）会话 ID
            均返回 `404`。
          schema:
            type: string
            format: uuid
            example: 8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                new_status:
                  type: string
                  nullable: true
                  enum:
                    - Not Started
                    - In Progress
                    - Approved
                    - Declined
                    - In Review
                    - Expired
                    - Abandoned
                    - Kyc Expired
                    - Resubmitted
                    - Awaiting User
                  description: >-
                    可选的记录在条目上的状态标签。接受任何区分大小写的会话状态值（`"approved"` 会被拒绝并返回
                    `400`）。在此处记录状态**不会**更改会话的实际状态，如需更改请使用更新状态的 endpoint。
                  example: In Review
                comment:
                  type: string
                  nullable: true
                  description: 可选的自由文本备注（无强制长度限制）。按原样存储；此 endpoint 不会处理 `@email` 提及。
                  example: Flagging for manual document re-check.
            examples:
              NoteWithStatusLabel:
                summary: 附带状态标签的备注（会话状态未变更）
                value:
                  new_status: In Review
                  comment: Flagging for manual document re-check.
              CommentOnly:
                summary: 无状态标签的普通备注
                value:
                  comment: Customer emailed an updated utility bill; awaiting upload.
      responses:
        '201':
          description: >-
            在会话的审计日志中记录的条目。会话本身保持不变，其 `status` 保留先前的值，且不发送 Webhook。新条目还会显示在 `GET
            …/reviews/` 的顶部（带有 `actor_display: "Unknown"`）。
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    type: string
                    description: 条目创建者的显示名称。通过此 endpoint 创建的条目始终为 `"Unknown"`，因为其不记录操作者归属。
                    example: Unknown
                  new_status:
                    type: string
                    nullable: true
                    enum:
                      - Not Started
                      - In Progress
                      - Approved
                      - Declined
                      - In Review
                      - Expired
                      - Abandoned
                      - Kyc Expired
                      - Resubmitted
                      - Awaiting User
                    description: 记录在条目上的状态标签，如果未发送则为 `null`。会话的实际状态不受影响。
                    example: In Review
                  comment:
                    type: string
                    nullable: true
                    description: 条目上记录的备注；若未发送任何备注，则为 `null`。
                    example: Flagging for manual document re-check.
                  created_at:
                    type: string
                    format: date-time
                    description: 条目写入的时间，ISO 8601 UTC 格式。
                    example: '2026-06-12T00:18:44.466537Z'
              examples:
                NoteWithStatusLabel:
                  summary: 带有状态标签的备注
                  value:
                    user: Unknown
                    new_status: In Review
                    comment: Flagging for manual document re-check.
                    created_at: '2026-06-12T00:18:44.466537Z'
                CommentOnly:
                  summary: 普通备注
                  value:
                    user: Unknown
                    new_status: null
                    comment: Note without status.
                    created_at: '2026-06-12T00:18:44.504157Z'
        '400':
          description: 验证错误，作为按字段划分的消息映射返回。通常原因是 `new_status` 值不是十个允许的状态之一 — 该检查区分大小写。
          content:
            application/json:
              schema:
                type: object
                properties:
                  new_status:
                    type: array
                    items:
                      type: string
                    example:
                      - '"approved" is not a valid choice.'
              examples:
                InvalidStatusChoice:
                  summary: 小写/未知的状态值
                  value:
                    new_status:
                      - '"approved" is not a valid choice.'
        '403':
          description: >-
            缺少、格式错误、已过期或已撤销的 `x-api-key`。身份验证在会话查找之前检查，因此即使会话 UUID 不存在，缺少密钥也会返回
            `403`。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    example: You do not have permission to perform this action.
              examples:
                InvalidKey:
                  summary: x-api-key 请求头缺失或无效
                  value:
                    detail: You do not have permission to perform this action.
        '404':
          description: >-
            您的应用不可见具有此 UUID 的用户验证（KYC）会话：该 UUID 不存在、会话已被删除，或属于其他应用。企业验证（KYB）会话
            ID 在此处也返回 `404`，审核动态仅支持 KYC 会话。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    example: Session not found.
              examples:
                NotFound:
                  summary: 未知、已删除或跨应用的会话 UUID
                  value:
                    detail: Session not found.
        '429':
          description: >-
            超出速率限制。请检查 `Retry-After` 和 `X-RateLimit-*`
            响应头。参见[速率限制](/zh/integration/rate-limiting)。
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: >-
            # Records an audit-trail note only -- the session's status does NOT
            change.

            curl -s -X POST
            https://verification.didit.me/v3/sessions/8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d/reviews/
            \
              -H 'x-api-key: YOUR_API_KEY' \
              -H 'Content-Type: application/json' \
              -d '{
                "new_status": "In Review",
                "comment": "Flagging for manual document re-check."
              }'
        - lang: python
          label: Python
          source: |-
            from didit import Didit

            # Reads DIDIT_API_KEY.
            client = Didit()

            result = client.sessions.reviews.create(
                "8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d",
                new_status="In Review",
                comment="Flagging for manual document re-check.",
            )
            print(result)
        - lang: javascript
          label: Node.js
          source: >-
            import Didit from "@didit-protocol/sdk-node";


            // Reads DIDIT_API_KEY.

            const didit = new Didit();


            const result = await
            didit.sessions.reviews.create("8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d",
            {
              new_status: "In Review",
              comment: "Flagging for manual document re-check.",
            });

            console.log(result);
        - lang: go
          label: Go
          source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Sessions.Reviews.Create(ctx, \"8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d\", didit.SessionsReviewsCreateParams{\n\tNewStatus: didit.Some(didit.SessionsReviewsCreateParamsNewStatus(\"In Review\")),\n\tComment:   didit.String(\"Flagging for manual document re-check.\"),\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)"
        - lang: java
          label: Java
          source: >-
            import me.didit.Didit;

            import me.didit.types.SessionsReviewsCreateParams;


            // Reads DIDIT_API_KEY.

            Didit client = new Didit();


            var result =
            client.sessions().reviews().create("8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d",
            SessionsReviewsCreateParams.builder()
                    .newStatus(SessionsReviewsCreateParams.NewStatus.of("In Review"))
                    .comment("Flagging for manual document re-check.")
                    .build());
            System.out.println(result);
        - lang: php
          label: PHP
          source: >-
            <?php


            require 'vendor/autoload.php';


            use Didit\DiditClient;


            // Reads DIDIT_API_KEY.

            $didit = new DiditClient();


            $result =
            $didit->sessions->reviews->create('8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d',
            [
                'new_status' => 'In Review',
                'comment' => 'Flagging for manual document re-check.',
            ]);

            print_r($result->toArray());
        - lang: ruby
          label: Ruby
          source: |-
            require "didit"

            # Reads DIDIT_API_KEY.
            didit = Didit::Client.new

            result = didit.sessions.reviews.create(
              "8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d",
              new_status: "In Review",
              comment: "Flagging for manual document re-check."
            )
            puts result.to_h
        - lang: csharp
          label: .NET
          source: >-
            using System;

            using System.Text.Json;

            using Didit;


            // Reads DIDIT_API_KEY.

            using var client = new DiditClient();


            var result = await
            client.Sessions.Reviews.CreateAsync("8c2f3a14-7e9b-4d23-9e83-3f7d5e8a1c6d",
            new SessionsReviewsCreateParams

            {
                NewStatus = new SessionsReviewsCreateParamsNewStatus("In Review"),
                Comment = "Flagging for manual document re-check.",
            });

            Console.WriteLine(JsonSerializer.Serialize(result));
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        您的应用 API 密钥，可在 Business Console 的“开发者 -> API
        密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于
        IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP
        列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF
        URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅
        https://docs.didit.me/console/api-keys。

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.