> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# 为会话添加图片 API

> 为已完成的 KYC 会话的身份证件验证或地址证明结果附加额外的图片或 PDF，例如证件背面。Didit 提供支持。

为会话添加图片的 API 提示词
将提示词复制到剪贴板

<pre>
  \`Attach an extra image or PDF to a finished Didit User Verification (KYC) session through the API.

  Endpoint:
  PATCH [https://verification.didit.me/v3/session/\{session\_id}/add-images/](https://verification.didit.me/v3/session/\{session_id}/add-images/)

  Authentication:
  Send my Didit API key in the x-api-key header. A scoped key needs sessions: write.

  Goal:

  * Add evidence collected outside the verification flow (for example the back of an ID document, or a supporting letter) to the session's ID verification or Proof of Address result, so reviewers see it with the rest of the session.

  Request (multipart/form-data):

  * file (required): JPG, JPEG, PNG, WEBP, TIFF or PDF, at most 15 MB as uploaded. Didit compresses it and rejects it if it is still over 2 MB (2,097,152 bytes) after compression.
  * model\_type (required): "kyc" for the ID verification, "poa" for the Proof of Address.
  * file\_password (optional): the password of an encrypted PDF.

  Behavior:

  * The session must be Approved, Declined, In Review or Kyc Expired, and must have the result named by model\_type. Business (KYB) sessions are not supported.
  * When the step ran more than once, the file goes to the most recent result.
  * Each call adds one file and keeps the existing ones.
  * The file then appears in extra\_files of id\_verifications\[] or poa\_verifications\[] in GET /v3/session/{session_id}/decision/.
  * A FILE\_ADDED entry is added to the session's activity log. No webhook is sent and the session status does not change.
  * Rate limit: 10 requests per minute per API key.

  Example call:
  curl -X PATCH "[https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/add-images/](https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/add-images/)" \
  -H "x-api-key: YOUR\_API\_KEY" \
  -F "file=@back-of-id.jpg" \
  -F "model\_type=kyc"

  What to read from the response:

  * extra\_files: short-lived presigned links to every extra file of that result, including the new one. A scoped key without media: read receives them as null.

  Failure modes:

  * 400: file or model\_type missing, unsupported format, file too large before or after compression, encrypted PDF without the right file\_password.
  * 401: the API key has expired.
  * 403: missing key (a wrong, revoked or expired key gets 401), a key of another application, a scoped key without sessions: write, or a request from outside the key's IP allowlist.
  * 404: the session does not exist, was deleted, is outside a scoped key's limits, is not in a reviewable status, or has no result of that model\_type.
  * 429: more than 10 calls in a minute. Wait for Retry-After seconds.

  Side effects: stores the file with the session and adds an activity entry.

  For the full integration shape, see /integration/integration-prompt.\`
</pre>

粘贴到

`extra_files` 中的预签名链接会过期。需要使用这些文件时，请从[会话决策](https://docs.didit.me/zh/sessions-api/retrieve-session.md)中读取新的链接。若要更正从证件中提取的数据，请改用[更新会话数据](https://docs.didit.me/zh/sessions-api/update-data.md)。


## OpenAPI

````yaml zh/openapi-25.json PATCH /v3/session/{sessionId}/add-images/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/session/{sessionId}/add-images/:
    patch:
      tags:
        - Sessions
      summary: 向会话添加图片
      description: >-
        为已完成的用户验证（KYC）会话的身份证件验证（`model_type=kyc`）或地址证明（`model_type=poa`）结果附加一份额外的图像或
        PDF，例如在工作流外部收集的证明。该会话必须为 `Approved`、`Declined`、`In Review` 或 `Kyc
        Expired`，并包含由 `model_type`
        指定的结果；不支持企业验证（KYB）会话。每次调用都会追加一个文件（当该步骤运行多次时，追加到最新的结果中），保留现有文件，并在会话活动日志中记录一条
        `FILE_ADDED` 条目；上传不会发送 Webhook，也不会更改会话状态。文件在上传时会被压缩，并在会话决策的
        `extra_files` 中返回。此 endpoint 限制为每个 API 密钥每分钟 10 次请求。具有作用域限制的 API 密钥需要
        `sessions: write` 权限，若没有 `media: read` 权限，则接收到的 `extra_files` 链接为
        `null`。
      operationId: patch_v3_session_add_images
      parameters:
        - name: sessionId
          in: path
          required: true
          description: >-
            要向其添加文件的用户验证（KYC）会话的 UUID（`POST /v3/session/` 返回的
            `session_id`）。企业验证（KYB）会话 ID 将返回 `404`。
          schema:
            type: string
            format: uuid
            example: 11111111-2222-3333-4444-555555555555
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
                - model_type
              properties:
                file:
                  type: string
                  format: binary
                  description: >-
                    图像或
                    PDF。允许的扩展名：`jpg`、`jpeg`、`png`、`webp`、`tiff`、`pdf`。上传时最大支持 15
                    MB；随后文件会被压缩，若压缩后仍大于 2 MB（2,097,152 字节），将返回 `400`
                    并拒绝。空文件将被拒绝。
                model_type:
                  type: string
                  enum:
                    - kyc
                    - poa
                  description: '`kyc` 将文件添加至身份证件验证结果，`poa` 添加至地址证明结果。'
                  example: kyc
                file_password:
                  type: string
                  description: 加密 PDF 的密码。未提供或提供错误密码时，加密 PDF 将返回 `400`。
            example:
              file: (binary)
              model_type: kyc
      responses:
        '200':
          description: 文件已添加。返回该结果的所有额外文件，包括新添加的文件。
          content:
            application/json:
              schema:
                type: object
                required:
                  - extra_files
                properties:
                  extra_files:
                    type: array
                    description: >-
                      `model_type` 指定结果的所有额外文件的短期预签名链接，最早的文件排在最前。对于不具备 `media:
                      read` 权限的受限作用域 API 密钥，每个链接均为 `null`。后续可从会话决策中读取最新链接。
                    items:
                      type: string
                      format: uri
                      nullable: true
              example:
                extra_files:
                  - >-
                    https://media.example.com/session/11111111-2222-3333-4444-555555555555/kyc-extra-files/66666666-7777-8888-9999-000000000000.jpg?expires=1789383731&signature=abc123
        '400':
          description: >-
            验证错误。字段错误以 `{"<field>": ["<message>"]}` 形式返回；加密 PDF 错误以 `{"detail":
            "..."}` 形式返回。
          content:
            application/json:
              examples:
                Missing file:
                  summary: 表单中没有文件字段
                  value:
                    file:
                      - No file was submitted.
                Missing model_type:
                  summary: 省略了 model_type
                  value:
                    model_type:
                      - This field is required.
                Invalid model_type:
                  summary: model_type 不是 kyc 或 poa
                  value:
                    model_type:
                      - '"passport" is not a valid choice.'
                File too large:
                  summary: 上传超过 15 MB
                  value:
                    file:
                      - File size should not exceed 15 MB
                Too large after compression:
                  summary: 压缩后仍超过 2 MB
                  value:
                    file:
                      - File size is too big. Max allowed size is 2097152 bytes.
                Encrypted PDF:
                  summary: 未提供 file_password 的加密 PDF
                  value:
                    detail: >-
                      The PDF is encrypted. Please upload a decrypted PDF or a
                      photo instead.
                Wrong PDF password:
                  summary: file_password 无法打开该 PDF
                  value:
                    detail: >-
                      The PDF password is incorrect. Please provide the correct
                      password.
        '401':
          description: 作用域 API 密钥已过期。这是唯一返回 `401` 的情况：缺失、无效或已吊销的密钥将返回 `403`。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Expired key:
                  summary: 密钥的到期日期已过
                  value:
                    detail: This API key has expired.
        '403':
          description: >-
            身份验证或授权失败。缺少密钥，以及属于其他应用的密钥、缺少该 endpoint 所需权限的限定作用域密钥和来自该密钥 IP
            允许名单之外的请求均返回 `403`；错误、已撤销或已过期的密钥返回 `401`。可通过 `detail` 区分它们。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Missing or invalid credentials:
                  summary: 缺少 x-api-key 请求头，或该密钥验证失败
                  value:
                    detail: >-
                      Authentication credentials were not provided or are
                      invalid.
                Other application:
                  summary: 属于与该会话不同应用的有效密钥
                  value:
                    detail: You do not have permission to perform this action.
                Scoped key without sessions write:
                  summary: '作用域密钥缺少 sessions: write 权限'
                  value:
                    detail: This API key has no write access to sessions.
                IP not allowed:
                  summary: 来自密钥 IP 白名单之外的请求
                  value:
                    detail: This API key can't be used from this IP address.
        '404':
          description: >-
            会话不存在、已被删除或超出了限定作用域密钥的限制；为 KYB 会话或未处于 `Approved`、`Declined`、`In
            Review` 或 `Kyc Expired` 状态；或者没有所请求 `model_type`
            的结果（在验证文件之前检查）。会话查找在凭证检查之前执行，因此即使没有有效密钥，未知的 `sessionId` 也会返回 `404`。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Unknown session:
                  summary: 不存在具有此 ID 的会话，或该会话已被删除
                  value:
                    detail: Not found.
                Outside key limits:
                  summary: 会话超出了限定作用域密钥的工作流或仅限已通过状态的限制
                  value:
                    detail: Session not found.
                Not eligible:
                  summary: 会话尚未完成，或为 KYB 会话 ID
                  value:
                    detail: No Session matches the given query.
                No ID verification:
                  summary: 在未进行身份证件验证的会话上设置了 model_type=kyc
                  value:
                    detail: The session does not have KYC data.
                No Proof of Address:
                  summary: 在未提供地址证明的会话上设置了 model_type=poa
                  value:
                    detail: The session does not have POA data.
        '429':
          description: >-
            超出速率限制：每个 API 密钥每分钟 10 次添加图片请求（被拒绝的请求也计算在内）。同时适用每分钟 300
            次写入请求的共享额度。请等待 `Retry-After` 秒后再重试；`X-RateLimit-*` 响应头显示了额度。
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                    description: 便于人类阅读的错误消息。
              examples:
                Rate limited:
                  summary: 当前分钟的预算已耗尽
                  value:
                    detail: >-
                      Session add-images rate limit exceeded. You can make up to
                      10 requests per minute.
          headers:
            Retry-After:
              description: 重试前需要等待的秒数。
              schema:
                type: integer
                minimum: 1
                example: 30
        '503':
          $ref: '#/components/responses/DocumentProcessingBusy'
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: >-
            curl -X PATCH
            'https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/add-images/'
            \
              -H 'x-api-key: YOUR_API_KEY' \
              -F 'file=@./back-of-id.jpg' \
              -F 'model_type=kyc'
        - lang: python
          label: Python
          source: |-
            from didit import Didit

            # Reads DIDIT_API_KEY.
            client = Didit()

            result = client.sessions.add_images(
                "11111111-2222-3333-4444-555555555555",
                file=open("image.jpg", "rb"),
                model_type="kyc",
            )
            print(result)
        - lang: javascript
          label: Node.js
          source: >-
            import Didit, { fileFromPath } from "@didit-protocol/sdk-node";


            // Reads DIDIT_API_KEY.

            const didit = new Didit();


            const result = await
            didit.sessions.addImages("11111111-2222-3333-4444-555555555555", {
              file: await fileFromPath("image.jpg"),
              model_type: "kyc",
            });

            console.log(result);
        - lang: go
          label: Go
          source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Sessions.AddImages(ctx, \"11111111-2222-3333-4444-555555555555\", didit.SessionsAddImagesParams{\n\tFile:      didit.FileFromPath(\"image.jpg\"),\n\tModelType: \"kyc\",\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)"
        - lang: java
          label: Java
          source: >-
            import java.nio.file.Path;

            import me.didit.Didit;

            import me.didit.types.SessionsAddImagesParams;


            // Reads DIDIT_API_KEY.

            Didit client = new Didit();


            var result =
            client.sessions().addImages("11111111-2222-3333-4444-555555555555",
            SessionsAddImagesParams.builder()
                    .file(Path.of("image.jpg"))
                    .modelType(SessionsAddImagesParams.ModelType.of("kyc"))
                    .build());
            System.out.println(result);
        - lang: php
          label: PHP
          source: >-
            <?php


            require 'vendor/autoload.php';


            use Didit\DiditClient;

            use Didit\File;


            // Reads DIDIT_API_KEY.

            $didit = new DiditClient();


            $result =
            $didit->sessions->addImages('11111111-2222-3333-4444-555555555555',
            [
                'file' => File::fromPath('image.jpg'),
                'model_type' => 'kyc',
            ]);

            print_r($result->toArray());
        - lang: ruby
          label: Ruby
          source: |-
            require "didit"

            # Reads DIDIT_API_KEY.
            didit = Didit::Client.new

            result = didit.sessions.add_images(
              "11111111-2222-3333-4444-555555555555",
              file: Pathname("image.jpg"),
              model_type: "kyc"
            )
            puts result.to_h
        - lang: csharp
          label: .NET
          source: >-
            using System;

            using System.Text.Json;

            using Didit;


            // Reads DIDIT_API_KEY.

            using var client = new DiditClient();


            var result = await
            client.Sessions.AddImagesAsync("11111111-2222-3333-4444-555555555555",
            new SessionsAddImagesParams

            {
                File = FileUpload.FromPath("image.jpg"),
                ModelType = "kyc",
            });

            Console.WriteLine(JsonSerializer.Serialize(result));
components:
  responses:
    DocumentProcessingBusy:
      description: >-
        当前正在处理的证件过多，因此本次上传未被处理：未存储任何内容，且未消耗尝试次数。请在 `Retry-After`
        指定的秒数后再次发送相同文件。请根据 `code` 进行分支判断，而非根据消息文本。
      headers:
        Retry-After:
          description: 再次发送相同请求前需等待的秒数。
          schema:
            type: integer
            example: 10
      content:
        application/json:
          schema:
            type: object
            required:
              - detail
              - code
            properties:
              detail:
                type: string
              code:
                type: string
                enum:
                  - document_processing_busy
          example:
            detail: We are busy processing documents. Please try again in a moment.
            code: document_processing_busy
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        您的应用 API 密钥，可在 Business Console 的“开发者 -> API
        密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于
        IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP
        列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF
        URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅
        https://docs.didit.me/console/api-keys。

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.