# API overview

OneKYC exposes two public HTTP APIs for tenant-server integration:

- **Tenant API (KYC)** — manages individual (applicant) verification: creating sessions and verification links, fetching results, OCR data, AML screening, **manual review tasks**, statistics, and audit data.
- **KYB API** — a separate surface for business verification (including **KYB review tasks**). See [KYB API](/en/kyb).

Both surfaces are served from your tenant API domain. The Tenant API is mounted at `/tenant/v1/kyc/...`, the KYB API at `/tenant/v1/kyb/...`.

## Authentication [#authentication]

All server-to-server requests are signed with **HMAC-SHA256**.

Required headers:

- `Authorization: HMAC-SHA256 Credential=<key_id>, Signature=<hex_signature>`
- `X-Timestamp: <unix_seconds>` — allowed clock drift versus the server is ±5 minutes.

The string to sign: `timestamp\nmethod\npath\nbody_hash`, where `body_hash` is the lowercase hex SHA256 digest of the raw request body. For bodyless requests, use an empty string.

For the full algorithm description, JavaScript / Python / Go examples, key identifier formats (`kyc_live_*` / `kyc_test_*` / `kyb_live_*` / `kyb_test_*`), and the list of scopes, see [Authentication](/en/api/authentication).

## Environments [#environments]

| Environment | Key prefix | Purpose |
|-----------|---------------|------------|
| Production | `kyc_live_` / `kyb_live_` | Real verifications, billing, real webhooks |
| Test | `kyc_test_` / `kyb_test_` | Sandbox sessions, isolated data, no charge |

## Section structure [#section-structure]

- [Authentication](/en/api/authentication) — HMAC, scopes, key rotation.
- [Sessions](/en/api/sessions) — create, fetch, and cancel verification sessions.
- [Applicants](/en/api/applicants) — applicant records, history, AML data.
- [Documents and media](/en/api/documents-and-media) — supported document types, presigned URLs.
- [Flows](/en/api/flows) — verification scenario reference (managed in the [admin panel](/en/admin/flows)).
- [Verification links](/en/api/verification-links) — generating links and QR codes for end users.
- [Review tasks](/en/api/review) — manual review queue and decisions for integrators (HMAC).
- [Webhooks](/en/api/webhooks) — asynchronous event notifications, signature format, retry policy.
- [Metrics and analytics](/en/api/metrics) — session aggregates, conversion, export.
- [Audit](/en/api/audit) — log of API-side actions.
- [Errors and limits](/en/api/errors-and-limits) — error codes, rate limits, OTP parameters.
- [API reference (Swagger / OpenAPI)](/en/api/api-reference) — machine-readable specification.