# ThirdFactor Docs

> Developer documentation for Obsidian — ThirdFactor’s multi-tenant identity, KYC, AML and onboarding platform. Native document, liveness, face-match and NFC verification with web, iOS, Android and Flutter SDKs.

## Documentation

- [Authentication](https://docs.v3.thirdfactor.ai/docs/authentication): Tenant API keys, scopes, and the partner-signed JWT session flow.
- [ThirdFactor Obsidian](https://docs.v3.thirdfactor.ai/docs): Native identity, KYC, AML and onboarding — one hosted flow, client SDKs, server libraries, and a full REST API.
- [Quickstart](https://docs.v3.thirdfactor.ai/docs/quickstart): Verify your first user end-to-end in under 10 minutes.
- [Applications](https://docs.v3.thirdfactor.ai/docs/api-reference/applications): Partner /api/v1 hosted sessions (JWT), application reads, session-expiry control, stable decisions.
- [API reference](https://docs.v3.thirdfactor.ai/docs/api-reference): The full ThirdFactor Obsidian REST API — with an interactive Postman-style console, OpenAPI spec, and Postman collection.
- [API reference](https://docs.v3.thirdfactor.ai/docs/api-reference/introduction): Two REST surfaces, one tenant API key — ThirdFactor Verify (/v3) and partner (/api/v1).
- [Risk lists](https://docs.v3.thirdfactor.ai/docs/api-reference/lists): Tenant-scoped phone / email / identifier block lists — full CRUD, entry upsert / bulk add / replace-all, normalization rules, and errors.
- [Sessions](https://docs.v3.thirdfactor.ai/docs/api-reference/sessions): Full /v3/session/ lifecycle — create, read, decision, status, tags, logs, checklist, PDF.
- [Standalone tools](https://docs.v3.thirdfactor.ai/docs/api-reference/tools): One-shot /v3/tools/* utilities — AML, face search, signature verify/search/enroll, document extract — with full request/response and errors.
- [Usage & credits](https://docs.v3.thirdfactor.ai/docs/api-reference/usage): Per-workflow usage aggregates and the paginated credit ledger — reconcile spend and monitor the prepaid balance.
- [Workflows](https://docs.v3.thirdfactor.ai/docs/api-reference/workflows): List the tenant's KYC workflows and their enabled features, then route sessions to a specific workflow_id.
- [Architecture](https://docs.v3.thirdfactor.ai/docs/concepts/architecture): How the hosted flow, KYC engine, modules, SDKs and webhooks fit together, and which surfaces you actually call.
- [Credits](https://docs.v3.thirdfactor.ai/docs/concepts/credits): The credit model — the SESSION_CREATE fee, per-module rates, the 402 insufficient_credits response, and the usage and ledger endpoints.
- [Decisions](https://docs.v3.thirdfactor.ai/docs/concepts/decisions): The stable decision contract you branch on, the raw statuses you should not, and the decision_v3 per-module summary shape.
- [Sessions and applications](https://docs.v3.thirdfactor.ai/docs/concepts/sessions): Verification sessions and applications — their lifecycle, statuses, session_kind, vendor_data, expiry, and the endpoints to list, read and manage them.
- [Tenancy](https://docs.v3.thirdfactor.ai/docs/concepts/tenancy): Multi-tenant isolation — host-based tenant resolution, tenant-scoped API keys, per-tenant data and configuration.
- [Workflows](https://docs.v3.thirdfactor.ai/docs/concepts/workflows): KYC workflows as node graphs of feature modules, how enabled modules are server-enforced, and the GET /v3/workflows/ endpoint.
- [Go-live checklist](https://docs.v3.thirdfactor.ai/docs/guides/go-live): Keys, webhooks, idempotency, credits, error handling, and module choices before production traffic.
- [Testing](https://docs.v3.thirdfactor.ai/docs/guides/testing): Test sessions, the update-status override, reading logs and the checklist, and exercising every outcome.
- [Common use cases](https://docs.v3.thirdfactor.ai/docs/guides/use-cases): Typical module combinations and integration patterns by vertical — fintech, banking, crypto, marketplaces, telecom, healthcare, and rental screening.
- [Verify a user, end to end](https://docs.v3.thirdfactor.ai/docs/guides/verify-a-user): A complete integration — create a session, run the flow, handle the webhook, grant access.
- [Create a session](https://docs.v3.thirdfactor.ai/docs/hosted-flow/create-session): POST /v3/session/ in depth — every field, the 201 response, Idempotency-Key, and the 402 insufficient-credits path.
- [Customize the flow](https://docs.v3.thirdfactor.ai/docs/hosted-flow/customization): Branding, theme, locale, prefill and copy overrides for the hosted verification page.
- [No-code links](https://docs.v3.thirdfactor.ai/docs/hosted-flow/no-code-links): Ways to get an applicant into the hosted flow without your own backend calling the KYC API — console-generated links and the partner-signed JWT link flow.
- [Hosted flow overview](https://docs.v3.thirdfactor.ai/docs/hosted-flow/overview): The applicant-facing verification page ThirdFactor hosts for you at /verify/<token> — what it does, when to use it, and why the server drives it.
- [Event catalog](https://docs.v3.thirdfactor.ai/docs/integrations/events): Every Connect event type, when it fires, and what its payload carries.
- [n8n](https://docs.v3.thirdfactor.ai/docs/integrations/n8n): The community node package — a webhook trigger with dynamic event dropdowns and signature verification, plus an action node for sessions and tools.
- [Integrations overview](https://docs.v3.thirdfactor.ai/docs/integrations/overview): Granular event subscriptions for Zapier, n8n, and any webhook receiver — subscribe to exactly the events, workflows, and modules you care about.
- [Zapier](https://docs.v3.thirdfactor.ai/docs/integrations/zapier): Trigger Zaps on verification outcomes, AML hits, review cases, or any platform event — and create sessions, tags, and AML checks from other apps.
- [AML screening](https://docs.v3.thirdfactor.ai/docs/kyc/aml): Sanctions, PEP, adverse-media and POI screening against OpenSanctions plus your own custom lists — thresholds, hit routing, and ongoing monitoring.
- [Database validation](https://docs.v3.thirdfactor.ai/docs/kyc/database-validation): Cross-check identity data against an external authoritative database — requires a provider integration, and fails closed to review until one is wired.
- [Document verification](https://docs.v3.thirdfactor.ai/docs/kyc/document): OCR, MRZ and barcode extraction, authenticity and tamper checks, and the country/type document matrix.
- [Face match](https://docs.v3.thirdfactor.ai/docs/kyc/face-match): 1:1 selfie-to-document biometric comparison, plus 1:N face search across your enrolled identities.
- [Liveness](https://docs.v3.thirdfactor.ai/docs/kyc/liveness): Passive, colour-flash and 3D-action liveness — the server enforces the configured method and it cannot be downgraded client-side.
- [NFC verification](https://docs.v3.thirdfactor.ai/docs/kyc/nfc): Read the ePassport / eID chip on the device, validate it on the server — BAC/PACE, DG1/DG2/SOD and passive authentication.
- [KYC modules](https://docs.v3.thirdfactor.ai/docs/kyc/overview): The module catalog for ThirdFactor Verify — what each module does, where it runs, and how to pick the right set for your risk tier.
- [Proof of address](https://docs.v3.thirdfactor.ai/docs/kyc/proof-of-address): Capture an address document, classify it, check its freshness, and extract the applicant's address onto the identity.
- [Standalone tools](https://docs.v3.thirdfactor.ai/docs/kyc/tools): One-shot utilities — AML, face search, signature verify/search/enroll, document extract — with full request/response JSON and no session attached.
- [AI context (llms.txt)](https://docs.v3.thirdfactor.ai/docs/resources/ai-context): Feed these docs to ChatGPT, Claude, or any LLM using the machine-readable llms.txt endpoints.
- [Changelog](https://docs.v3.thirdfactor.ai/docs/resources/changelog): Notable changes to the ThirdFactor Obsidian API, SDKs, and hosted flows.
- [Errors](https://docs.v3.thirdfactor.ai/docs/resources/errors): HTTP status codes, stable error codes, and the per-surface response body shapes.
- [FAQ](https://docs.v3.thirdfactor.ai/docs/resources/faq): Answers to the questions integrators ask most — accounts, sessions, credits, privacy, SDKs, NFC, webhooks, testing, and data-subject requests.
- [Rate limits](https://docs.v3.thirdfactor.ai/docs/resources/rate-limits): Per-tenant /v3 buckets, 429 responses, and how to back off.
- [Troubleshooting](https://docs.v3.thirdfactor.ai/docs/resources/troubleshooting): Symptom-first fixes for the problems integrators actually hit — stuck sessions, missing webhooks, signature failures, 401/402 errors, camera and NFC issues, expiry, redirects, and duplicates.
- [Android SDK](https://docs.v3.thirdfactor.ai/docs/sdks/android): com.thirdfactor.kyc — open the hosted flow in a WebView via the Activity Result contract, coroutines, or Compose, with built-in ePassport NFC.
- [Bridge protocol](https://docs.v3.thirdfactor.ai/docs/sdks/bridge-protocol): The transport-agnostic flow → host event contract and the bidirectional native-capability channel. Protocol version 1.
- [.NET server SDK](https://docs.v3.thirdfactor.ai/docs/sdks/dotnet): ThirdFactor.SDK — create verification sessions, select workflows, retrieve decisions, and verify signed webhooks from .NET.
- [Flutter SDK](https://docs.v3.thirdfactor.ai/docs/sdks/flutter): thirdfactor_kyc — open the hosted flow in a full-screen WebView with one verify(context, url:) call, plus native ePassport NFC.
- [iOS SDK](https://docs.v3.thirdfactor.ai/docs/sdks/ios): ThirdFactorKYC (SwiftPM) — open the hosted flow in a WKWebView from UIKit or SwiftUI, with optional native ePassport NFC.
- [Java server SDK](https://docs.v3.thirdfactor.ai/docs/sdks/java): ai.thirdfactor:thirdfactor-sdk — create verification sessions, select workflows, retrieve decisions, and verify signed webhooks from Java.
- [NFC verification](https://docs.v3.thirdfactor.ai/docs/sdks/nfc): The native-only ePassport / eID chip read — read-on-device, validate-on-server; per-platform setup, standalone APIs, and the flow-delegated path.
- [SDKs](https://docs.v3.thirdfactor.ai/docs/sdks/overview): Thin native shells around the same hosted verification flow — one session model, one result vocabulary, one bridge.
- [Python server SDK](https://docs.v3.thirdfactor.ai/docs/sdks/python): thirdfactor-sdk — create verification sessions, retrieve decisions, manage risk lists, and verify signed webhooks from Python.
- [Web SDK](https://docs.v3.thirdfactor.ai/docs/sdks/web): @thirdfactor/web — open the hosted flow in a popup, cross-origin modal, or full-page redirect and resolve one typed result.
- [Events](https://docs.v3.thirdfactor.ai/docs/webhooks/events): The KYC session and application event types, and exactly when each fires.
- [Webhooks overview](https://docs.v3.thirdfactor.ai/docs/webhooks/overview): Signed server-to-server events — the authoritative channel for verification outcomes.
- [Verifying signatures](https://docs.v3.thirdfactor.ai/docs/webhooks/signatures): HMAC-SHA256 over the raw body with a timestamp — verify before you parse.

## Links

- [GitHub](https://github.com/thirdfactor)
- [Support](mailto:support@thirdfactor.ai)