This page walks you through a complete sample verification flow, covering the key steps you'll work with in most integrations: generating an app token for authentication, creating an applicant and configuring their verification level, uploading identity documents, triggering a check, and processing the results delivered via webhook. Each step links to the relevant API reference for request parameters and response schemas.

Make sure you have a Sumsub account and access to the sandbox environment before you start — it lets you test the full flow without affecting production data or consuming real verifications. Note that the pricing model may change from per-user to per-transaction billing.

The following scenario provides an example verification flow:

Generate an app token to start working with the Sumsub API.
Create an applicant.
1. Set up the steps that your applicants must go through to complete verification by creating a verification level. For more information about the supported types of documents, see this article.
2. Provide as much information about your applicants as you have, for example, email, phone, and so on — it helps us with our anti-fraud checks.
Upload documents:
1. Make sure to upload all the documents that you require. If a document is double-sided, submit two images and set the idDocSubType properly (FRONT_SIDE and BACK_SIDE). Make sure to send BACK_SIDE if FRONT_SIDE was already sent; otherwise, the verification step will not be completed, and you will not be able to initiate the check.
2. If you have changed the list of restricted countries, we suggest rewriting it for applicants created before the change with this method.
Request a check. Once all required documents are uploaded, you must let us know that the applicant is ready to be reviewed by moving them to the Pending status. if you do not submit documents correctly, the applicant will be rejected (or will not be checked at all). Make sure to check all the cases on your side to avoid having incomplete applicants.
Set up webhooks and get verification results. The results are delivered by the applicantReviewed webhook that contains the reviewResult object that includes the reviewAnswer field indicating the verification status:
1. If you receive a GREEN response, all is fine; the applicant has been verified. If needed, you can also fetch the applicant data in a separate API call.
2. If you receive a RED response and rejectType is FINAL, block the applicant and let them resolve the issue via support. There are only 1-2% of such cases, and it can happen when, for example, there is a fake account or forged documents were used.
3. If you receive a RED response with rejectType set to RETRY, the applicant has issues with their documents that can potentially be resolved. Refer to Resubmit problematic documents to learn how to handle them.

🚧
Important
Applicants have a limit on document uploads during verification. Exceeding this limit will result in an automatic rejection for SPAM.

Resubmit problematic documents

When you receive a RED response with rejectType set to RETRY, only the documents with issues need to be resubmitted:

Retrieve the problematic images using this method and display the moderationComment to inform the applicant about the issue. For example: "The text on your identity document is not clearly visible. Upload a new photo."
Re-upload the documents from the problematic step to the same applicant, move the applicant to the Pending status, and wait for the verification results.

👍
Consider the following for successful verification:

If you submit applicant data and want it cross-checked against data extracted from documents, ensure applicants can update their information on your end. In this case, we will return a PROBLEMATIC_APPLICANT_DATA reject label.

If you do not have complex document rules, we recommend sending just one image for passports, and both sides for ID cards, driver's licenses, and residence permits.

For selfies, ensure applicants are aware that their ID document must be uploaded alongside the selfie and must be clearly readable.

Verifications statuses are handled correctly:

A FINAL rejection prevents applicants from submitting new documents. Applicants are notified accordingly.

Your system should be able to react to status changes. For example, if an applicant is initially approved but appears on a blocklist a week later, we will send a RED result to your webhook endpoint so you can handle the status change accordingly.