Read client documents, verify a profile, assess risk and run eID checks over one REST API. Test in sandbox with your key, then switch the environment field to production.
Go live in 4 steps
From access request to your first call. The partner API is switched on per workspace.
Ask for access
Request sandbox access. We switch the partner API on for your workspace.
Create an API key
In the console, create a key with the scopes you need: kyc:extract, kyc:verify, kyc:eid.
Call it in sandbox
Send environment=sandbox with test data. There is no separate sandbox host.
Go live
Send environment=production with the same kind of request when your workspace is ready.
Base URL
One host for every call. The environment field in each request selects test or real data: sandbox is the default, production goes live.
https://app.sahlfinancial.com/apiWhat the API covers today
Four capabilities are open to partner API keys. The rest of the platform lives in the console.
| Capability | What it does | Endpoints | Scope |
|---|---|---|---|
| Document reading | Reads 1 to 5 files per call (JPEG, PNG, WebP, TIFF or PDF, up to 30 MB each) into structured fields. | POST /v1/kyc/extract | kyc:extract |
| Verification | Checks a client profile and its documents and returns a verdict with the checks behind it. | POST /v1/kyc/verify | kyc:verify |
| Risk assessment | The same body as verification, plus a risk assessment built on the verdict. | POST /v1/kyc/assess | kyc:verify |
| eID | Starts an eID check, returns where it stands and downloads the report. | POST /v1/kyc/eid, GET /v1/kyc/eid/{key}, GET /v1/kyc/eid/{key}/report | kyc:eid |
| In the console | Bank connections, cases, scoring policies. Not available through partner API keys. | Console only | |
Read a document, then verify it
Two real calls. Set SAHL_API_KEY to a sandbox key and point the file at a test document.
# 1. Read a document (multipart). environment defaults to sandbox.
curl -X POST https://app.sahlfinancial.com/api/v1/kyc/extract \
-H "Authorization: Bearer $SAHL_API_KEY" \
-F "files=@passport-test.jpg" \
-F "doc_type=passport" \
-F "reference=client-0001" \
-F "environment=sandbox"
# 2. Verify the profile (send back the documents the first call returned).
curl -X POST https://app.sahlfinancial.com/api/v1/kyc/verify \
-H "Authorization: Bearer $SAHL_API_KEY" \
-H "Content-Type: application/json" \
-d '{"reference":"client-0001","environment":"sandbox","subject":"Test Client","kind":"individual","values":{"first_name":"Test","last_name":"Client"},"documents":[]}'Endpoints
Six endpoints on one host. The full request and response schemas are in the OpenAPI file and the docs.
Authentication
Send your API key as a Bearer token. Keys are created in the console with the scopes kyc:extract, kyc:verify and kyc:eid. A key without the scope for a call gets 403. Keep keys on your server, never in a browser or mobile app.
Authorization: Bearer <API key>| Method | Path | What it does | Scope |
|---|---|---|---|
| POST | /v1/kyc/extract | Read documents (multipart: files, doc_type, reference, environment) | kyc:extract |
| POST | /v1/kyc/verify | Verify a profile | kyc:verify |
| POST | /v1/kyc/assess | Verify and assess risk | kyc:verify |
| POST | /v1/kyc/eid | Start an eID check | kyc:eid |
| GET | /v1/kyc/eid/{key} | Get an eID check | kyc:eid |
| GET | /v1/kyc/eid/{key}/report | Download an eID report | kyc:eid |
Scoped keys
Each key carries only the scopes you give it: document reading, verification, eID.
One host, two environments
Sandbox and production share the host and differ by the environment field.
Filed for you
Send a reference and the case, its documents and the verdict are filed in your workspace, where your staff see them.