Check a session

Server-to-server confirmation of a verification session's real status. Use this, or the signed webhook, instead of trusting the browser redirect alone.

The browser redirect is only a convenience for the end user. Your backend should treat this endpoint as the source of truth.

Authentication

API key, as a bearer token. Scoped to your own client.

Path parameters

Field	Type	Required	Description
token	string	required	The token from the verify_url or the redirect query string.

Request

GEThttps://api-faceverify.bluufun.com/v1/sessions/7yV0N3z8_26yZpxtUKZRVRvy04KeHT5-

Headers

Authorization: Bearer sk_live_...

Response

200 OK

{
  "event": "verification.completed",
  "status": "verified",
  "external_user_id": "user_8841",
  "confidence": 97.4,
  "livenessPassed": true,
  "duplicate": false,
  "risk": "LOW",
  "reason": null,
  "frontImageUrl": "https://...signed, expires in 15m"
}

The response is additive. Existing fields remain present, and the new fields mirror the completion response and webhook payload.

Error responses

Field	Type	Required	Description
404	—	optional	Token doesn't exist or belongs to a different client.