> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idmetagroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Biometrics Detection

> Screen a face against your duplicate watchlist and biometric blacklists in one call, without liveness or Trust Validation.

Use this endpoint when you orchestrate identity checks yourself and only need duplicate and blacklist screening on a face image. Each response includes a `transactionId` you can store; there is no Trust Flow, no Trust Validation, and no combined IDmeta outcome beyond the statuses below.

For liveness plus optional duplicate and blacklist screening on the same selfie, use [Biometrics Verification](/stateless-verification-api/compliance/biometrics-verification) instead.

## Before you call

<Warning>
  When `performDuplicateDetection` is `true`, the submitted face is **enrolled** into your company's duplicate watchlist as a side effect. That enrolment is what allows later calls to match it. Enable duplicate detection only when you intend to add this face to the watchlist under `name`.
</Warning>

Blacklists are **screen-only** on this endpoint. Faces enter a blacklist only through the blacklist upload flow, never through biometrics detection.

The image you submit is not stored. IDmeta logs that the call ran, which checks ran, and match counts — not the image, engine payload, or matched identities.

## Authentication and plan

Same as other `/api/v3` Stateless Verification API endpoints: Bearer token (`Authorization: Bearer <token>`) or HMAC headers (`X-HMAC-SIGNATURE`, `X-TIMESTAMP`, `X-USER-ID`). See [Introduction — Authentication](/stateless-verification-api/introduction#authentication).

Your company must hold the **`biometrics_detection`** plan. Without it, the API returns HTTP `403` before any screening runs.

## Verification status

| Status          | Code | When                                                                                  |
| --------------- | ---- | ------------------------------------------------------------------------------------- |
| `VERIFIED`      | 3    | Screening ran and matched nobody.                                                     |
| `REVIEW_NEEDED` | 2    | Duplicate detection, blacklist detection, or both found matches.                      |
| `FAILED`        | 6    | Screening could not run (unreadable image, no face, engine unreachable, and similar). |

<Note>
  **This endpoint never returns `REJECTED`.** A duplicate or blacklist hit is a finding for you to act on; IDmeta does not decide whether the subject should be blocked.
</Note>

## Interpret `data`

Request flags control which keys appear in `data`. Duplicate-only requests omit `blacklistDetection` entirely — not `null`, not an empty object.

When a requested check completes, read `hasMatches` as a boolean. When it could not run, `hasMatches` is **`null`** with an `error` string. **`null` is not a clean screen** — treat it as an unknown outcome and do not approve on that basis alone.

Duplicate matches always include `transactionId` (the earlier biometrics detection call that enrolled the matched face). Blacklist matches always include `blacklistFaceUploadId`. Other fields inside each match object come from the face-identity engine (similarity scores, names, and so on).

## Billing

A **completed** screening is billed whether or not it found matches. Validation errors, unresolvable blacklists, unreadable images, and engine failures release the credit reservation and are not charged.

## Examples

Replace `{environment-subdomain}`, `{your_api_token}`, and HMAC headers with your values.

### 1. Duplicate detection only, clean (`VERIFIED`)

```bash theme={null}
curl -X POST "https://{environment-subdomain}.idmetagroup.com/api/v3/verifications/biometrics-detection-passthrough" \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "data:image/jpeg;base64,/9j/4AAQ...",
    "name": "Applicant 88421",
    "performDuplicateDetection": true,
    "performBlacklistDetection": false
  }'
```

```json theme={null}
{
  "success": true,
  "message": "No matches found.",
  "data": {
    "duplicateDetection": {
      "hasMatches": false,
      "enrolled": true,
      "matches": []
    }
  },
  "verificationStatus": "VERIFIED",
  "verificationStatusCode": 3,
  "transactionId": "a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f",
  "verificationType": "biometrics_detection",
  "metadata": null,
  "createdAt": "2026-09-15T04:21:08Z"
}
```

### 2. Duplicate and blacklist, duplicate hit (`REVIEW_NEEDED`)

```bash theme={null}
curl -X POST "https://{environment-subdomain}.idmetagroup.com/api/v3/verifications/biometrics-detection-passthrough" \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "data:image/jpeg;base64,/9j/4AAQ...",
    "name": "Applicant 88421",
    "performDuplicateDetection": true,
    "performBlacklistDetection": true,
    "blacklistIds": ["6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89"]
  }'
```

```json theme={null}
{
  "success": true,
  "message": "Matches found.",
  "data": {
    "duplicateDetection": {
      "hasMatches": true,
      "enrolled": true,
      "matches": [
        {
          "name": "Prior applicant",
          "similarity_score": 97.2,
          "transactionId": "c0a8012e-5f44-4d2a-9b71-0e8f3a6c1d54"
        }
      ]
    },
    "blacklistDetection": {
      "hasMatches": false,
      "blacklists": [
        {
          "blacklistId": "6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89",
          "blacklistName": "Known fraud ring",
          "hasMatches": false,
          "matches": []
        }
      ]
    }
  },
  "verificationStatus": "REVIEW_NEEDED",
  "verificationStatusCode": 2,
  "transactionId": "b3e4f5a6-7c8d-4e9f-a0b1-2c3d4e5f6a7b",
  "verificationType": "biometrics_detection",
  "metadata": null,
  "createdAt": "2026-09-15T04:22:41Z"
}
```

### 3. Blacklist hit on one of two lists (`REVIEW_NEEDED`)

```bash theme={null}
curl -X POST "https://{environment-subdomain}.idmetagroup.com/api/v3/verifications/biometrics-detection-passthrough" \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "data:image/jpeg;base64,/9j/4AAQ...",
    "name": "Screening only",
    "performDuplicateDetection": false,
    "performBlacklistDetection": true,
    "blacklistIds": [
      "6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89",
      "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
    ]
  }'
```

```json theme={null}
{
  "success": true,
  "message": "Matches found.",
  "data": {
    "blacklistDetection": {
      "hasMatches": true,
      "blacklists": [
        {
          "blacklistId": "6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89",
          "blacklistName": "Known fraud ring",
          "hasMatches": true,
          "matches": [
            {
              "name": "Blocked subject",
              "similarity_score": 94.8,
              "blacklistFaceUploadId": "d4e5f6a7-8b9c-4d0e-a1b2-3c4d5e6f7a8b"
            }
          ]
        },
        {
          "blacklistId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
          "blacklistName": "Partner deny list",
          "hasMatches": false,
          "matches": []
        }
      ]
    }
  },
  "verificationStatus": "REVIEW_NEEDED",
  "verificationStatusCode": 2,
  "transactionId": "c4d5e6f7-8a9b-4c0d-b1c2-3d4e5f6a7b8c",
  "verificationType": "biometrics_detection",
  "metadata": null,
  "createdAt": "2026-09-15T04:24:15Z"
}
```

### 4. Unknown blacklist id (`404 BLACKLIST_NOT_FOUND`)

```bash theme={null}
curl -X POST "https://{environment-subdomain}.idmetagroup.com/api/v3/verifications/biometrics-detection-passthrough" \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "data:image/jpeg;base64,/9j/4AAQ...",
    "name": "Applicant 88421",
    "performDuplicateDetection": false,
    "performBlacklistDetection": true,
    "blacklistIds": ["00000000-0000-4000-8000-000000000000"]
  }'
```

```json theme={null}
{
  "success": false,
  "code": "BLACKLIST_NOT_FOUND",
  "message": "No active blacklist was found for the supplied blacklistIds.",
  "verificationStatus": "FAILED",
  "verificationStatusCode": 6,
  "transactionId": "a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f",
  "verificationType": "biometrics_detection",
  "metadata": null,
  "createdAt": "2026-09-15T04:21:08Z"
}
```

### 5. Engine unreachable (`FAILED`, `hasMatches: null`)

```bash theme={null}
curl -X POST "https://{environment-subdomain}.idmetagroup.com/api/v3/verifications/biometrics-detection-passthrough" \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "data:image/jpeg;base64,/9j/4AAQ...",
    "name": "Applicant 88421",
    "performDuplicateDetection": true,
    "performBlacklistDetection": false
  }'
```

```json theme={null}
{
  "success": false,
  "message": "Failed to process biometrics detection",
  "data": {
    "duplicateDetection": {
      "hasMatches": null,
      "error": "Face identity service unavailable."
    }
  },
  "verificationStatus": "FAILED",
  "verificationStatusCode": 6,
  "transactionId": "a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f",
  "verificationType": "biometrics_detection",
  "metadata": null,
  "createdAt": "2026-09-15T04:21:08Z"
}
```

HTTP status for this case is `502`. Responses that include a top-level `code` omit `data` entirely; this failure has no `code` and returns per-check errors in `data` instead.


## OpenAPI

````yaml stateless-verification-api/compliance/biometrics-detection.openapi.json POST /api/v3/verifications/biometrics-detection-passthrough
openapi: 3.0.3
info:
  title: Biometrics Detection Passthrough API
  version: 1.0.0
servers:
  - url: https://{environment-subdomain}.idmetagroup.com
    description: Your environment (replace `{environment-subdomain}`)
    variables:
      environment-subdomain:
        default: integrate
        description: IDmeta environment subdomain
security:
  - bearerAuth: []
paths:
  /api/v3/verifications/biometrics-detection-passthrough:
    post:
      tags:
        - Compliance Verification
      summary: Biometrics Detection
      description: >-
        Screen a face against your duplicate watchlist and one or more biometric
        blacklists in a single engine call — without liveness. Use this when you
        run your own orchestration and correlate calls only by the returned
        `transactionId`. There is no Trust Flow and no Trust Validation.


        **Duplicate detection** screens against your company's reserved
        duplicate watchlist and **enrols** the submitted face when
        `performDuplicateDetection` is `true`. **Blacklist detection** screens
        only; faces enter a blacklist exclusively through the blacklist upload
        flow, never through this endpoint.


        When `performDuplicateDetection` is `true`, the face is enrolled into
        the duplicate watchlist as a side effect. Call with duplicate detection
        on only when you intend that enrolment. The submitted image is never
        stored. IDmeta records that the call happened, which checks ran, and how
        many faces each matched — not the image, raw engine response, or
        identity of any match.


        **Plan:** your company must hold the `biometrics_detection` plan.
        Without it the call is rejected with HTTP `403` before anything runs.


        **Authentication:** same as other `/api/v3` endpoints — `Authorization:
        Bearer <token>` and HMAC headers (`X-HMAC-SIGNATURE`, `X-TIMESTAMP`,
        `X-USER-ID`). See
        [Introduction](/stateless-verification-api/introduction#authentication).


        **Request:** accept `application/json` or `multipart/form-data`. `image`
        must be a Base64 **data URI** (`data:image/jpeg;base64,...`) or a
        multipart file. A bare base64 string without the `data:` prefix is
        rejected. The service re-encodes to JPEG server-side. `name` (max 255)
        is the label used when enrolling into the duplicate watchlist; it is
        what a future duplicate match reports.


        `performDuplicateDetection` is required with no default.
        `performBlacklistDetection` defaults to `false`. **At least one** of the
        two `perform*` flags must be `true`; both `false` returns HTTP `400`.


        `blacklistIds` holds UUID strings. When `performBlacklistDetection` is
        `true`, you must supply ids that resolve to your active blacklists.
        Omitted, empty, unknown, inactive, or another company's ids are **not**
        validation errors — they all return HTTP `404` with `code`
        `BLACKLIST_NOT_FOUND`, nothing screened, no credit charged.


        **Response envelope** matches other Stateless Verification API endpoints
        (`success`, `message`, `data`, `verificationStatus`,
        `verificationStatusCode`, `transactionId`, `verificationType`,
        `metadata`, `createdAt`).


        **Verification status:** `VERIFIED` (`3`) when screening ran and matched
        nobody; `REVIEW_NEEDED` (`2`) when duplicate detection, blacklist
        detection, or both found matches; `FAILED` (`6`) when screening could
        not run (unreadable image, no face, engine unreachable). **This endpoint
        never returns `REJECTED`.** Whether a hit should block a subject is your
        policy; IDmeta reports the finding only.


        **`data` payload:** a check contributes a key only if it was requested.
        `duplicateDetection` and `blacklistDetection` are omitted entirely when
        not requested — not empty, not null. When a check completes, see the
        schema for `hasMatches`, `enrolled` (duplicate only), and `matches`.
        Each duplicate match includes `transactionId` — the earlier call that
        enrolled the matched face. Each blacklist match includes
        `blacklistFaceUploadId`. Other fields inside `matches` are passed
        through from the face-identity engine (similarity scores, labels, and so
        on).


        When a requested check could not run, that object returns `"hasMatches":
        null` and an `error` string. **`hasMatches: null` means no answer** —
        not the same as `false`. Do not treat `null` as clean.


        **Errors:** responses with a `code` omit `data` and return `code` +
        `message` instead. A `FAILED` screening without `code` may still return
        `data` with per-check `hasMatches: null` objects.


        **Billing:** a completed screening is billed whether or not it found
        matches. Validation failures, unresolvable blacklists, unreadable
        images, and engine outages release the reservation and are not charged.
      operationId: biometricsDetectionPassthrough
      parameters:
        - name: Authorization
          in: header
          required: true
          schema:
            type: string
            example: Bearer {your_api_token}
        - name: Accept
          in: header
          required: false
          schema:
            type: string
            default: application/json
        - name: Content-Type
          in: header
          required: false
          schema:
            type: string
            default: application/json
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BiometricsDetectionRequest'
            examples:
              duplicateOnly:
                summary: Duplicate detection only
                value:
                  image: data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD...
                  name: Applicant 88421
                  performDuplicateDetection: true
                  performBlacklistDetection: false
                  metadata:
                    customerReference: CUST-10294
              duplicateAndBlacklist:
                summary: Duplicate and blacklist screening
                value:
                  image: data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD...
                  name: Applicant 88421
                  performDuplicateDetection: true
                  performBlacklistDetection: true
                  blacklistIds:
                    - 6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89
                    - a1b2c3d4-e5f6-7890-abcd-ef1234567890
          multipart/form-data:
            schema:
              type: object
              required:
                - image
                - name
                - performDuplicateDetection
              properties:
                image:
                  type: string
                  format: binary
                  description: Face image file. Alternative to a Base64 data URI in JSON.
                name:
                  type: string
                  maxLength: 255
                  description: Label for duplicate watchlist enrolment.
                performDuplicateDetection:
                  type: boolean
                performBlacklistDetection:
                  type: boolean
                  default: false
                blacklistIds:
                  type: array
                  items:
                    type: string
                    format: uuid
                metadata:
                  type: object
                  additionalProperties: true
      responses:
        '200':
          description: >-
            Screening completed. Clean and match outcomes use HTTP 200. Match
            findings set `verificationStatus` to `REVIEW_NEEDED`; a clean screen
            sets `VERIFIED`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BiometricsDetectionSuccessResponse'
              examples:
                duplicateClean:
                  summary: Duplicate detection only, no matches
                  value:
                    success: true
                    message: No matches found.
                    data:
                      duplicateDetection:
                        hasMatches: false
                        enrolled: true
                        matches: []
                    verificationStatus: VERIFIED
                    verificationStatusCode: 3
                    transactionId: a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f
                    verificationType: biometrics_detection
                    metadata:
                      customerReference: CUST-10294
                    createdAt: '2026-09-15T04:21:08Z'
                duplicateHit:
                  summary: Duplicate and blacklist requested, duplicate match
                  description: >-
                    `verificationStatus` is `REVIEW_NEEDED` because duplicate
                    detection found a match. Blacklist may still be clean.
                  value:
                    success: true
                    message: Matches found.
                    data:
                      duplicateDetection:
                        hasMatches: true
                        enrolled: true
                        matches:
                          - name: Prior applicant
                            similarity_score: 97.2
                            transactionId: c0a8012e-5f44-4d2a-9b71-0e8f3a6c1d54
                      blacklistDetection:
                        hasMatches: false
                        blacklists:
                          - blacklistId: 6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89
                            blacklistName: Known fraud ring
                            hasMatches: false
                            matches: []
                    verificationStatus: REVIEW_NEEDED
                    verificationStatusCode: 2
                    transactionId: b3e4f5a6-7c8d-4e9f-a0b1-2c3d4e5f6a7b
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:22:41Z'
                blacklistHitOneOfTwo:
                  summary: Blacklist hit on one of two lists
                  value:
                    success: true
                    message: Matches found.
                    data:
                      blacklistDetection:
                        hasMatches: true
                        blacklists:
                          - blacklistId: 6f1c2a90-8d3b-4f2e-9c11-7ab5d0e34f89
                            blacklistName: Known fraud ring
                            hasMatches: true
                            matches:
                              - name: Blocked subject
                                similarity_score: 94.8
                                blacklistFaceUploadId: d4e5f6a7-8b9c-4d0e-a1b2-3c4d5e6f7a8b
                          - blacklistId: a1b2c3d4-e5f6-7890-abcd-ef1234567890
                            blacklistName: Partner deny list
                            hasMatches: false
                            matches: []
                    verificationStatus: REVIEW_NEEDED
                    verificationStatusCode: 2
                    transactionId: c4d5e6f7-8a9b-4c0d-b1c2-3d4e5f6a7b8c
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:24:15Z'
        '400':
          description: >-
            Validation failed, both perform flags false, or the image could not
            be processed. Reserved credit is released when no screening
            completes.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: >-
                      #/components/schemas/BiometricsDetectionValidationErrorResponse
                  - $ref: '#/components/schemas/BiometricsDetectionFailedResponse'
              examples:
                validationFailed:
                  summary: Request failed validation
                  value:
                    success: false
                    code: VALIDATION_FAILED
                    message: >-
                      The request could not be validated. Please check the
                      submitted fields.
                    errors:
                      name:
                        - The name field is required.
                      performDuplicateDetection:
                        - The perform duplicate detection field is required.
                    transactionId: null
                    verificationType: biometrics_detection
                    createdAt: '2026-09-15T04:21:08Z'
                noChecksRequested:
                  summary: Both perform flags false
                  value:
                    success: false
                    message: >-
                      At least one of performDuplicateDetection or
                      performBlacklistDetection must be true.
                    data: {}
                    verificationStatus: FAILED
                    verificationStatusCode: 6
                    transactionId: null
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:21:08Z'
                unreadableImage:
                  summary: Image could not be read or no face detected
                  value:
                    success: false
                    message: >-
                      No face detected in the image. Please ensure face is
                      clearly visible.
                    data: {}
                    verificationStatus: FAILED
                    verificationStatusCode: 6
                    transactionId: a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:21:08Z'
        '402':
          description: >-
            Plan is held but credit balance is exhausted with enforcement
            enabled.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BiometricsDetectionCodedErrorResponse'
              examples:
                insufficientCredit:
                  summary: Insufficient credit
                  value:
                    success: false
                    code: INSUFFICIENT_CREDIT
                    message: Insufficient credit to complete this verification.
                    transactionId: null
                    verificationType: biometrics_detection
                    createdAt: '2026-09-15T04:21:08Z'
        '403':
          description: The company does not hold the `biometrics_detection` plan.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BiometricsDetectionPlanForbiddenResponse'
              examples:
                planMissing:
                  summary: Plan not enabled
                  value:
                    success: false
                    message: Biometrics detection is not enabled for this company.
                    transactionId: null
                    verificationType: biometrics_detection
                    createdAt: '2026-09-15T04:21:08Z'
        '404':
          description: >-
            Blacklist screening was requested but no supplied `blacklistIds`
            resolved to an active blacklist for your company. Nothing screened,
            no credit consumed.
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/BiometricsDetectionBlacklistNotFoundResponse
              examples:
                blacklistNotFound:
                  summary: Unknown or inactive blacklist id
                  value:
                    success: false
                    code: BLACKLIST_NOT_FOUND
                    message: >-
                      No active blacklist was found for the supplied
                      blacklistIds.
                    verificationStatus: FAILED
                    verificationStatusCode: 6
                    transactionId: a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:21:08Z'
        '500':
          description: >-
            Unhandled failure on IDmeta side. Safe to retry; reserved credit is
            released.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/BiometricsDetectionCodedErrorResponse'
                  - $ref: '#/components/schemas/BiometricsDetectionFailedResponse'
              examples:
                internalError:
                  summary: Internal error
                  value:
                    success: false
                    code: INTERNAL_ERROR
                    message: An unexpected error occurred.
                    transactionId: null
                    verificationType: biometrics_detection
                    createdAt: '2026-09-15T04:21:08Z'
        '502':
          description: Face-identity engine unreachable or unusable. Safe to retry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BiometricsDetectionEngineFailedResponse'
              examples:
                engineUnavailable:
                  summary: Engine unreachable, per-check errors in data
                  value:
                    success: false
                    message: Failed to process biometrics detection
                    data:
                      duplicateDetection:
                        hasMatches: null
                        error: Face identity service unavailable.
                    verificationStatus: FAILED
                    verificationStatusCode: 6
                    transactionId: a2f1c0de-8b4a-4c1d-9e2f-1a3b5c7d9e0f
                    verificationType: biometrics_detection
                    metadata: null
                    createdAt: '2026-09-15T04:21:08Z'
components:
  schemas:
    BiometricsDetectionRequest:
      type: object
      required:
        - image
        - name
        - performDuplicateDetection
      properties:
        image:
          type: string
          description: >-
            Base64 data URI (`data:image/jpeg;base64,...`) or a multipart file
            when posting `multipart/form-data`. Bare base64 without the `data:`
            prefix is rejected.
        name:
          type: string
          maxLength: 255
          description: >-
            Label for enrolment into the duplicate watchlist. Reported on future
            duplicate matches.
        performDuplicateDetection:
          type: boolean
          description: >-
            When `true`, screens against the duplicate watchlist and enrols this
            face. Required; not defaulted.
        performBlacklistDetection:
          type: boolean
          default: false
          description: >-
            When `true`, screens against the blacklists in `blacklistIds`. Does
            not enrol into blacklists.
        blacklistIds:
          type: array
          description: >-
            UUID strings of active biometric blacklists. Required in practice
            when `performBlacklistDetection` is `true`. Unresolvable ids yield
            HTTP 404 `BLACKLIST_NOT_FOUND`.
          items:
            type: string
            format: uuid
        metadata:
          type: object
          additionalProperties: true
          nullable: true
          description: Free-form data echoed unchanged on the response.
    BiometricsDetectionSuccessResponse:
      type: object
      required:
        - success
        - message
        - data
        - verificationStatus
        - verificationStatusCode
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: true
        message:
          type: string
        data:
          $ref: '#/components/schemas/BiometricsDetectionData'
        verificationStatus:
          type: string
          enum:
            - VERIFIED
            - REVIEW_NEEDED
            - FAILED
          description: >-
            Never `REJECTED`. `VERIFIED` = no matches; `REVIEW_NEEDED` = at
            least one match; `FAILED` only when returned on error paths with
            screening failure.
        verificationStatusCode:
          type: integer
          enum:
            - 3
            - 2
            - 6
          description: '`3` = Verified, `2` = Review Needed, `6` = Failed.'
        transactionId:
          type: string
          format: uuid
          description: >-
            Correlate this call in your systems. Duplicate matches reference
            earlier enrolment transaction ids.
        verificationType:
          type: string
          example: biometrics_detection
        metadata:
          type: object
          additionalProperties: true
          nullable: true
        createdAt:
          type: string
          format: date-time
    BiometricsDetectionValidationErrorResponse:
      type: object
      required:
        - success
        - code
        - message
        - errors
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        code:
          type: string
          enum:
            - VALIDATION_FAILED
        message:
          type: string
        errors:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        transactionId:
          type: string
          format: uuid
          nullable: true
        verificationType:
          type: string
          example: biometrics_detection
        createdAt:
          type: string
    BiometricsDetectionFailedResponse:
      type: object
      required:
        - success
        - message
        - verificationStatus
        - verificationStatusCode
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
        data:
          type: object
          additionalProperties: true
        verificationStatus:
          type: string
          example: FAILED
        verificationStatusCode:
          type: integer
          example: 6
        transactionId:
          type: string
          format: uuid
          nullable: true
        verificationType:
          type: string
          example: biometrics_detection
        metadata:
          type: object
          additionalProperties: true
          nullable: true
        createdAt:
          type: string
    BiometricsDetectionCodedErrorResponse:
      type: object
      required:
        - success
        - code
        - message
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        code:
          type: string
          enum:
            - INSUFFICIENT_CREDIT
            - INTERNAL_ERROR
        message:
          type: string
        transactionId:
          type: string
          format: uuid
          nullable: true
        verificationType:
          type: string
          example: biometrics_detection
        createdAt:
          type: string
      description: Error responses with `code` omit `data`.
    BiometricsDetectionPlanForbiddenResponse:
      type: object
      required:
        - success
        - message
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
        transactionId:
          type: string
          format: uuid
          nullable: true
        verificationType:
          type: string
          example: biometrics_detection
        createdAt:
          type: string
    BiometricsDetectionBlacklistNotFoundResponse:
      type: object
      required:
        - success
        - code
        - message
        - verificationStatus
        - verificationStatusCode
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        code:
          type: string
          enum:
            - BLACKLIST_NOT_FOUND
        message:
          type: string
        verificationStatus:
          type: string
          example: FAILED
        verificationStatusCode:
          type: integer
          example: 6
        transactionId:
          type: string
          format: uuid
        verificationType:
          type: string
          example: biometrics_detection
        metadata:
          type: object
          additionalProperties: true
          nullable: true
        createdAt:
          type: string
    BiometricsDetectionEngineFailedResponse:
      type: object
      required:
        - success
        - message
        - data
        - verificationStatus
        - verificationStatusCode
        - transactionId
        - verificationType
        - createdAt
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
        data:
          $ref: '#/components/schemas/BiometricsDetectionData'
        verificationStatus:
          type: string
          example: FAILED
        verificationStatusCode:
          type: integer
          example: 6
        transactionId:
          type: string
          format: uuid
        verificationType:
          type: string
          example: biometrics_detection
        metadata:
          type: object
          additionalProperties: true
          nullable: true
        createdAt:
          type: string
    BiometricsDetectionData:
      type: object
      properties:
        duplicateDetection:
          $ref: '#/components/schemas/DuplicateDetectionResult'
        blacklistDetection:
          $ref: '#/components/schemas/BlacklistDetectionResult'
      description: Only keys for checks requested on the call are present.
    DuplicateDetectionResult:
      type: object
      properties:
        hasMatches:
          type: boolean
          nullable: true
          description: >-
            `true` or `false` when screening completed; `null` when it could not
            run (see `error`).
        enrolled:
          type: boolean
          description: >-
            Whether this face was added to the duplicate watchlist. Present when
            screening completed.
        matches:
          type: array
          items:
            $ref: '#/components/schemas/DuplicateDetectionMatch'
        error:
          type: string
          description: Present when `hasMatches` is `null`.
      description: Returned only when `performDuplicateDetection` was `true`.
    BlacklistDetectionResult:
      type: object
      properties:
        hasMatches:
          type: boolean
          nullable: true
          description: Whether any blacklist matched. `null` when screening could not run.
        blacklists:
          type: array
          items:
            $ref: '#/components/schemas/BlacklistScreeningResult'
          description: One entry per blacklist screened, including lists with no matches.
        error:
          type: string
      description: Returned only when `performBlacklistDetection` was `true`.
    DuplicateDetectionMatch:
      type: object
      properties:
        transactionId:
          type: string
          format: uuid
          description: Transaction id of the earlier call that enrolled the matched face.
      additionalProperties: true
      description: >-
        Engine-provided similarity fields are passed through. `transactionId` is
        always present on matches.
    BlacklistScreeningResult:
      type: object
      properties:
        blacklistId:
          type: string
          format: uuid
        blacklistName:
          type: string
        hasMatches:
          type: boolean
        matches:
          type: array
          items:
            $ref: '#/components/schemas/BlacklistDetectionMatch'
    BlacklistDetectionMatch:
      type: object
      properties:
        blacklistFaceUploadId:
          type: string
          format: uuid
          description: Identifier of the blacklist face upload that matched.
      additionalProperties: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Use your API token as a Bearer token in the `Authorization` header, or
        HMAC signature headers (`X-HMAC-SIGNATURE`, `X-TIMESTAMP`, `X-USER-ID`)
        as for other v3 endpoints.

````