ThirdFactor
ThirdFactor Docs

Reference

API reference

The full ThirdFactor Obsidian REST API — with an interactive Postman-style console, OpenAPI spec, and Postman collection.

The ThirdFactor Obsidian API has two surfaces that share one tenant API key:

  • /v3 — the native KYC engine. Sessions, decisions, standalone tools, workflows, usage and credits. Authenticated with x-api-key.
  • /api/v1 — the partner API. Hosted applications and tenant risk lists. Authenticated with Authorization: Bearer.

Interactive API Explorer

A Postman-style console — set your key, fill parameters, send real requests, and read the response. Auto-generates code in cURL, Node, Python, Ruby & PHP.

Authentication

API keys, the /v3 vs /api/v1 auth models, and the partner JWT flow.

Try it now

The API Explorer is a live, in-browser request console for every endpoint below. Paste your tenant API key into the Authentication panel, pick an operation, and hit send — no Postman install required.

Info

The Explorer sends requests from your browser to the server URL you set. For the live console to reach your deployment, that origin must allow CORS from the docs site (or run the Explorer against a staging host). Reading the reference, the schemas, and the generated code samples works with no configuration.

Download

OpenAPI 3.1 spec

The machine-readable spec. Import into Postman, Insomnia, Stoplight, or generate a client with openapi-generator.

Postman collection

Every endpoint (/v3 + /api/v1) as a ready-to-import Postman collection, generated from the OpenAPI spec. (A partner-only /api/v1 collection with a matching environment is also available.)

Endpoint reference

Prefer prose with copy-paste examples? Each area has a full page:

Sessions

Create, read, list, and manage /v3 verification sessions.

Applications

The /api/v1 JWT session + application lifecycle.

Lists

Tenant risk lists and their entries.

Workflows

List KYC workflows and their enabled feature keys.

Usage & credits

Usage per workflow and the credit ledger.

Tools

One-shot AML, face, signature, and document tools.

Conventions

  • Base URL — your Obsidian deployment, e.g. https://v3.thirdfactor.ai.
  • Idempotency — send Idempotency-Key on session creation; retries return the original session and are never double-charged.
  • Errors — branch on the HTTP status first, then the stable string code. The body shape differs per surface ({ detail } on /v3; { ok, error, detail } or { error } on /api/v1). See Errors.
  • Rate limits — /v3 is rate-limited per tenant; over-limit requests get 429. See Rate limits.