Skip to main content

Applications and invitations

An application is one subject, one explicit workflow version and one assurance lifecycle. Your externalReference binds it to your customer, account or onboarding record.

Create an individual application​

POST /v1/applications
Authorization: Bearer pl_live_…
Idempotency-Key: <unique-business-operation-key>
Content-Type: application/json
{
  "type": "individual",
  "workflowId": "wf_…",
  "channel": "hosted",
  "externalReference": "customer_845901",
  "recipientEmail": "person@example.com",
  "sendEmail": true,
  "person": {
    "givenName": "Amara",
    "familyName": "Vale",
    "dateOfBirth": "1992-06-14",
    "nationality": "SG",
    "email": "person@example.com"
  }
}

Create a business application​

{
  "type": "business",
  "workflowId": "wf_business_…",
  "channel": "web",
  "externalReference": "merchant_29310",
  "business": {
    "legalName": "Harbour Atlas Pte. Ltd.",
    "registrationNumber": "202612345N",
    "country": "SG"
  }
}

The workflow’s applicationType must match the application. Draft, retired, inaccessible or mismatched policies are rejected.

Assurance routing inputs​

FieldPurpose
channelRecords hosted, Web, iOS, Android or React Native delivery
requiredAssuranceRequested assurance target from 0–100
maximumCostMinorOptional route budget in the tenant billing currency
optimizerStrategyKeyApproved route-selection policy

These values cannot weaken mandatory workflow or Country Assurance Pack controls.

Read status​

GET /v1/applications/{applicationId}

The detailed response contains the pinned workflow, current status/step, risk result, evidence receipts, document and biometric signals, screening candidates, cases, invitation state and signed decision ledger that the caller is authorised to see.

Invitation operations​

OperationPurpose
GET /v1/applications/{id}/invitationRetrieve the current durable invitation and delivery state
POST /v1/applications/{id}/invitation/sendSend or resend to the supplied recipient
POST /v1/applications/{id}/invitation/regenerateRotate the token, optionally change expiry/recipient and invalidate the old URL
POST /v1/applications/{id}/invitation/revokeImmediately block access without deleting the application

Every mutation uses an idempotency key. Regeneration is a security action: old links stop working and cannot be recovered.

Rescreening​

POST /v1/applications/{applicationId}/rescreen

Use explicit rescreening for an immediate check. For approved subjects needing repeated checks, enrol them in ongoing assurance rather than scheduling unbounded application reads from your own cron job.

Store at minimum:

type AssayraLink = {
  prooflineApplicationId: string;
  externalReference: string;
  workflowId: string;
  lastKnownStatus: string;
  invitationExpiresAt: string;
  updatedAt: string;
};

Do not store the invitation token unless your delivery flow requires it. If retained, treat it as a secret and delete it when the journey completes or is revoked.