العمر والهوية والاستبعاد الذاتي في جلسة واحدة أكثر أمانًا.

You are integrating Didit into a regulated iGaming / sports-betting operator (UK Gambling Commission, Malta Gaming Authority, Curaçao, SIGAP, ANJ). Three obligations on every player and every deposit:

  - Onboarding: 18+ age gate, ID Verification, self-exclusion register cross-check.
  - Deposits: AML on above-threshold deposits, real-time deposit limits + loss caps.
  - Withdrawals + sensitive actions: biometric re-auth against the enrolment selfie.

Recommended recipe + pricing (verified live):
  - Onboarding session: $0.10 Age Estimation + $0.15 ID Verification + $0.10 Passive Liveness + $0.05 Face Match 1:1 + $0.20 AML (above threshold). Face Search 1:N against self-exclusion register: free. Average ~$0.40 per player.
  - Per-deposit / per-withdrawal transaction: $0.02 per call to Transaction Monitoring (rule engine + limits).
  - AML re-screening on flagged transactions: $0.20 per check.
  - Biometric re-auth on withdrawal: $0.10 per auth.
  - First 500 verifications free every month, forever.

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60s, no card).
  - Webhook endpoint with HMAC SHA-256 verification using the X-Signature-V2 header.
 HMAC-SHA256 verification MUST run against the raw body bytes (the raw payload as Didit sent it) BEFORE any JSON parsing — re-serialising the parsed body changes whitespace and key order, which invalidates the signature.  - A workflow_id from the Workflow Builder that bundles Age Estimation + ID Verification + Passive Liveness + Face Match 1:1 + Face Search 1:N (against your self-exclusion index) + AML Screening.
  - A self-exclusion index loaded into the Didit Face Search 1:N — your own banned-players list at minimum; GAMSTOP / RIGA / equivalent national register where the regulator participates.
  - Transaction Monitoring enabled in the Business Console with the rule bundle for sports-betting or online-casino seeded.

STEP 1 — Open the onboarding session at signup

  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "workflow_id": "<wf id with age gate + ID + AML + Face Search self-exclusion>",
      "vendor_data": "<your player id, max 256 chars>",
      "callback": "https://<your-app>/igaming/onboarding/callback",
      "metadata": {
        "regulator": "UKGC",
        "license_class": "remote_casino_betting",
        "min_age": 18
      }
    }

  Response: 201 Created with the hosted session URL. Redirect the player. Sub-2-second median verdict on completion.

STEP 2 — Read the signed webhook on the onboarding verdict

  Didit POSTs to your callback. Session statuses are Title Case With Spaces:

  Body (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<your player id>",
      "status": "Approved",
      "age_estimation": { "estimated_age": 27, "confidence": 0.92 },
      "id_verification": { "status": "Approved", "dob": "1997-03-12" },
      "face": { "status": "Approved", "similarity_score": 0.94 },
      "face_search": { "status": "Approved", "matches": [] },
      "aml": { "status": "Approved", "hits": [] }
    }

  Session status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

  Verify the X-Signature-V2 header BEFORE reading the body.

STEP 3 — Branch on the onboarding verdict

  Approved + 18+    → unlock the player account.
  Approved + Face Search hit on self-exclusion → block, log to compliance, surface support resources.
  Declined          → block, log AML hit detail.
  In Review         → hold the account, route to ops queue.

STEP 4 — Monitor every deposit + withdrawal

  POST https://verification.didit.me/v3/transactions/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "transaction_id": "<your deposit reference>",
      "transaction_category": "finance",
      "transaction_details": {
        "direction": "INBOUND",
        "amount": "150.00",
        "currency": "GBP",
        "currency_kind": "fiat",
        "action_type": "deposit"
      },
      "subject": {
        "entity_type": "individual",
        "vendor_data": "<your player id>",
        "full_name": "<player full name>"
      },
      "counterparty": {
        "entity_type": "individual",
        "full_name": "Player deposit"
      }
    }

  Response: status APPROVED | IN_REVIEW | DECLINED | AWAITING_USER. Rule engine evaluates against deposit limits, loss caps, velocity thresholds, and Reasonable-Affordability triggers in real time.

STEP 5 — Biometric re-auth on withdrawal

  Open a re-auth session before processing a withdrawal:

  POST https://verification.didit.me/v3/session/
  Body:
    {
      "workflow_id": "<wf id with Liveness + Face Match against enrolment selfie>",
      "vendor_data": "<your player id>",
      "metadata": { "trigger": "withdrawal", "withdrawal_amount": "500.00" }
    }

  Block the withdrawal until status: Approved with similarity above your threshold (default 0.85).

STEP 6 — Ongoing AML monitoring on the active player base

  Every Approved player is automatically re-screened DAILY by Didit's continuous AML monitoring at $0.07 per player per year. The same session webhook fires when the verdict flips.

WEBHOOK EVENT NAMES
  - Sessions: status changes flow through the standard session webhook.
  - Transactions: transaction.created · transaction.updated · transaction.status.changed · transaction.alert.generated.

  Verify X-Signature-V2 on every payload.

CONSTRAINTS
  - Session statuses use Title Case With Spaces (Approved, In Review). Transaction statuses use UPPER_SNAKE_CASE (APPROVED, IN_REVIEW, DECLINED, AWAITING_USER). They live in different APIs — don't mix them in the same code path.
  - Self-exclusion cross-check must happen BEFORE the player can deposit — a post-deposit check is useful for audit but creates a refund obligation.
  - Default audit retention is 5 years post-relationship per the UK Gambling Commission / Malta Gaming Authority requirements; configure per workflow in the Business Console.
  - 200+ fraud signals are evaluated on every onboarding session at no extra cost.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/transaction-monitoring/overview
  - https://docs.didit.me/core-technology/aml-screening/overview
  - https://docs.didit.me/integration/webhooks

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.