Create a Liveness Check API
/liveness_check
Creates a hosted liveness verification link. The end user is guided through a face liveness capture flow in their browser. The result (live human vs spoof attempt) can then be retrieved via the GET endpoint or pushed to your webhook. Configurable link validity, threshold and audit-image retention give you control over the flow without writing your own capture UI.
Example Request
POSTRequest Schema
return_url
Where to redirect the user after the flow completes (or hits a terminal state).
webhook_url
Optional webhook for lifecycle events.
link_valid_mins
Link validity window. Default 10.
threshold
Custom liveness score threshold. Default is the system value (currently 70).
audit_images
Number of additional audit frame images to retain (beyond the single probe image).
Available Response Data
5 Data Pointstoken
used with the GET endpoint to fetch the result
url
hosted liveness capture URL to share with the end user
secret
used for webhook signature verification HMAC SHA-256 hex digest of the payload
webhook_url
echoed when supplied
API reference UUID
API Data Scale & Coverage tag
Unmatched data depth to power your compliance and verification workflows.
Technical Use Cases tag
Standalone liveness verification
Run liveness as an independent step. For example, before a high-value transaction, account recovery, or password reset, without invoking the full ID Pass flow
Anti-spoofing for sensitive workflows
Defend against photo, screen replay and mask attacks at high-risk customer touchpoints using NIST-grade liveness detection.
Webhooks & Events tag
complete
The user has finished the liveness capture flow. Call GET /liveness_check?token=... from your authenticated backend to retrieve the result (passed boolean, confidence score, threshold applied, probe image, optional audit images). | link: /liveness_check (GET)
expired
The link expired before the user completed the capture. The result endpoint will return HTTP 410 for this token. Create a new liveness check if the customer still needs to be verified. | link: /liveness_check (POST)
Compliance & Security tag
Enterprise-grade infrastructure audited against the standards your regulators require.
Common Questions tag
Everything you need to know about implementation details and compliance infrastructure.
shield_lock Security
How do webhook signatures work?
add
How do webhook signatures work?
When an event fires, GlobalData POSTs the JSON body with a Signature HTTP header containing an HMAC SHA-256 hex digest of the payload, signed with the secret returned at creation. Verify the signature server-side to confirm authenticity. Webhooks come from a known set of IPs you can whitelist.
shield_lock Security
What's lc_token and should I trust it?
add
What's lc_token and should I trust it?
When the user is redirected back to your return_url, an lc_token query parameter is added (and an error parameter on terminal failure states). Treat lc_token as untrusted input. Always fetch the definitive result from the GET endpoint under your authenticated server context.
rocket_launch Implementation
What's the difference between threshold and audit images?
add
What's the difference between threshold and audit images?
threshold (0 to 99) is the score cutoff above which the liveness check is considered passed. audit_images (0 to 4) controls how many additional intermediate frame images are retained for around 30 minutes for audit and review purposes. The two are independent of each other.
API Testing Sandbox tag
Test the Create a Liveness Check API directly in your browser with live mock data and see instant results.
rocket_launch Request Sandbox AccessAccess to live sandbox environments requires manual approval from our compliance team.
Ready to integrate Create a Liveness Check API?
Talk to our team about credentials, sandbox access and the right combination of endpoints for your workflow.