Lei Felcaに準拠。Felca対応の年齢確認で。

You are integrating Didit into a Brazilian platform to comply with Lei nº 15.211/2025 (the "Felca law") — Brazil's child-protection age + identity rule. Three obligations on every user that touches age-restricted content:

  - Verify the user is old enough (18+ for adult content; bespoke thresholds for gambling, alcohol, social-media reach).
  - Block users under 13 with a logged report (Felca-aligned).
  - Capture parental consent + identity for users 13-17 where the platform allows them.

Recommended recipe (cheapest path that satisfies the law):

  - Step 1: Age Estimation ($0.10) on every signup. Confident "18+" bands skip downstream checks.
  - Step 2: ID Verification ($0.15) + Passive Liveness ($0.10) only on borderline bands (15-21 confidence overlap).
  - Step 3: Parental consent + ID Verification on 13-17 users.
  - Step 4: Hard block + Felca reporting line on confident "under 13" detections.

Average per-user cost in production: ~$0.10-$0.15 (most users pay only Age Estimation; only borderline escalate).

PRE-REQUISITES
  - Production API key from https://business.didit.me (sandbox key in 60s, no card).
  - Webhook endpoint with HMAC SHA-256 verification using the X-Signature-V2 header and your webhook secret.
  - A workflow_id from the Workflow Builder that branches on Age Estimation confidence band: 18+ confident → allow; 16-19 borderline → escalate to ID + Liveness; 13-17 confident → parental consent flow; under 13 confident → block + report.
  - LGPD (Lei Geral de Proteção de Dados) consent copy approved by your legal team in Brazilian Portuguese.

STEP 1 — Open the age-gate session at signup

  POST https://verification.didit.me/v3/session/
  Headers:
    x-api-key: <your api key>
    Content-Type: application/json
  Body:
    {
      "workflow_id": "<wf id with Age Estimation + conditional ID + Liveness>",
      "vendor_data": "<your user id, max 256 chars>",
      "callback": "https://<your-app>/age-gate/callback",
      "metadata": {
        "law": "lei_felca_15211_2025",
        "platform_category": "social_app",
        "min_age_for_full_features": 18
      }
    }

  Response: 201 Created with a hosted session URL. Redirect the user (web or in-app webview). Sub-2-second median verdict on completion (Age Estimation alone; longer when ID + Liveness escalate).

STEP 2 — Read the signed webhook on the verdict

  Didit POSTs to your callback. Session statuses are Title Case With Spaces:

  Body (excerpted):
    {
      "session_id": "<uuid>",
      "vendor_data": "<your user id>",
      "status": "Approved",
      "age_estimation": { "estimated_age": 27, "lower_bound": 24, "upper_bound": 30, "confidence": 0.92 },
      "id_verification": { "status": "Approved", "document_type": "RG", "dob": "1997-03-12" },
      "liveness": { "status": "Approved" }
    }

  Status enum (exact case): Approved | Declined | In Review | Resubmitted | Expired | Not Finished | Kyc Expired | Abandoned.

  Verify the X-Signature-V2 header BEFORE reading the body — HMAC SHA-256 of the raw bytes with your webhook secret.

STEP 3 — Branch on the verdict + age

  Approved + 18+    → unlock the platform.
  Approved + 13-17  → route to parental consent capture; unlock limited features.
  Approved + under 13 (rare; only if document escalation overruled the estimation) → block; log to your Felca reporting line.
  Declined          → block; surface to ops.
  In Review         → soft-fail; pending manual review.

STEP 4 — Re-verify on age-threshold transitions

  When a user crosses an age threshold (turns 18, turns 16), open a re-verification session to update their tier. The original session URL is single-use; create a new session per re-verify.

WEBHOOK EVENT NAMES
  - Sessions: status changes flow through the standard session webhook.

  Verify X-Signature-V2 on every payload.

CONSTRAINTS
  - Session statuses use Title Case With Spaces (Approved, In Review). Do not lowercase or snake_case them.
  - Age Estimation is statistical, not deterministic. Confident bands (high model confidence + age comfortably above/below threshold) skip the document upload; borderline bands MUST escalate to ID Verification.
  - LGPD requires explicit consent capture before processing personal data. The Didit-hosted flow renders a consent screen in Brazilian Portuguese; if you self-host the UI via the mobile SDK, render the LGPD consent BEFORE opening the session.
  - Default retention is 5 years post-relationship per LGPD defaults; configure per workflow in the Business Console.
  - Brazilian documents supported live: RG (state ID across 27 states), CNH (driver's licence with DENATRAN cross-check), passport, CIN (new federal national ID). 14,000+ documents across 220+ countries total.

Read the docs:
  - https://docs.didit.me/sessions-api/create-session
  - https://docs.didit.me/core-technology/age-estimation/overview
  - https://docs.didit.me/core-technology/id-verification/overview
  - https://docs.didit.me/integration/webhooks

Start free at https://business.didit.me — sandbox key in 60 seconds, 500 verifications free every month, no credit card.