HTTP API

The HTTP API provides server-to-server verification: your backend sends pre-read eMRTD files to the DocVal Server, which verifies and parses them.

• Parse the files (e.g. MRZ Info, Face Photo, ...).
• Verify the authenticity and integrity of the files (Passive Authentication).

INFO

Clone detection (Active Authentication, Chip Authentication) is not available via the HTTP API. Use the WebSocket API with the Connector SDKs for full verification including clone detection.

The eMRTD SDK Android / eMRTD SDK iOS can be used to read the required files from the eMRTD on the device.

Communication Overview

1. Client sends the eMRTD files (SOD + DataGroups) in binary form to your Server.
2. Your Server sends those files to the Document Validation Server.
3. The DocVal Server verifies the integrity and authenticity of the Data Groups (Passive Authentication). The DocVal Server parses the SOD, DG1, DG2, DG7, DG11 and DG12.
4. The eMRTD Result is returned to your Server.

Validate API Endpoint /v4/validate

• Verifies the integrity and authenticity of the Data Groups (Passive Authentication).
• Parses the SOD, DG1, DG2, DG7, DG11 and DG12.

POST /v4/validate

Set Request header Content-Type to multipart/form-data and provide the following values.

Name	Type	Description
client_id	text/plain	Serves as the API Access key. Mandatory
sod	application/octet-stream	SOD file in binary form. Mandatory
dg1 - dg16	application/octet-stream	Data Group files in binary form. Optional

If successful, returns 200 and an eMRTD Result JSON.

Curl Examples

kinegram.digital instance of the Document Validation Server.
See Privacy Notice.

https://docval.kurzdigital.com

Example eMRTD files are available in the emrtd-directory

Pia Sample

curl --request POST \
    --url "https://docval.kurzdigital.com/v4/validate" \
    --header "Content-Type: multipart/form-data" \
    --form "client_id=example_client" \
    --form "sod=@emrtd-samples/pia-sample/sod.ef" \
    --form "dg1=@emrtd-samples/pia-sample/dg1.ef" \
    --form "dg2=@emrtd-samples/pia-sample/dg2.ef"

Note: These are example files. The Document Certificate is not signed by a trusted Country Certificate. => Passive Authentication will be false.

Peter Parker

curl --request POST \
    --url "https://docval.kurzdigital.com/v4/validate" \
    --header "Content-Type: multipart/form-data" \
    --form "client_id=example_client" \
    --form "sod=@emrtd-samples/peter-parker/sod.ef" \
    --form "dg1=@emrtd-samples/peter-parker/dg1.ef" \
    --form "dg2=@emrtd-samples/peter-parker/dg2.ef" \
    --form "dg7=@emrtd-samples/peter-parker/dg7.ef" \
    --form "dg11=@emrtd-samples/peter-parker/dg11.ef" \
    --form "dg12=@emrtd-samples/peter-parker/dg12.ef" \
    --form "dg14=@emrtd-samples/peter-parker/dg14.ef" \
    --form "dg15=@emrtd-samples/peter-parker/dg15.ef"

Note: These are example files. The Document Certificate is not signed by a trusted Country Certificate. => Passive Authentication will be false.

Other Endpoints

There are some other endpoints that are not used for validation, but for providing meta information about the server.

Server Info /server-info

GET /server-info

Returns a JSON object with two fields: name and version

Certificate List /certificate-list

GET /certificate-list

Returns the list of certificates currently trusted by the server. Used for the list of supported countries and organizations.