Users

Liveness verification link

Issue a hosted link for a liveness check, and relay it to the person who has to take it. A liveness check needs an interactive session, so it cannot be done from an uploaded image.

You get one link for an individual, and one per beneficial owner for a business. Each entry says whose it is. The result arrives on the user.liveness_completed webhook — see Webhooks — which is the only place to read it: a person can reach your success page before the check is finished.

POST

users

{user_id}

liveness-link

curl --request POST \
  --url https://api.balampay.com/sandbox/v1/users/{user_id}/liveness-link \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '{}'

{
  "links": [
    {
      "subject": "ubo",
      "person_reference_id": "0123456789abcdef0123456789abcdef",
      "name": "Alice Smith",
      "liveness_link": "https://kyc.example.com/s/abc123",
      "expires_at": "2026-09-08T12:00:00.000Z"
    },
    {
      "subject": "ubo",
      "person_reference_id": "fedcba9876543210fedcba9876543210",
      "name": "Bob Jones",
      "liveness_link": "https://kyc.example.com/s/def456",
      "expires_at": "2026-09-08T12:00:00.000Z"
    }
  ]
}

Liveness is switched on per account, not per user. While it is off, every call answers 404 whichever user_id you pass. Ask your Kira contact to enable it before you build against this.

Authorizations

Authorization

string

header

required

The data.access_token value from Get access token.

x-api-key

string

header

required

API key issued by Kira.

Headers

X-Api-Version

string

Version applied to this request. It wins over your account's pinned version — see Versioning.

Example:

"2026-06-01"

Path Parameters

user_id

string<uuid>

required

The user the check is for. For a business, this is the business — the links come back per beneficial owner.

Body

application/json

The body is optional. Send it only to land the person on your own page afterwards; unknown fields are ignored.

redirect

object

Where to send the person after the session, instead of the default completion screen. Both URLs have to be HTTPS and their host has to be on your redirect allowlist, which your Kira contact sets up.

Show child attributes

Response

One link per person who has to take the check.

links

object[]

One entry for an individual, one per beneficial owner for a business.

Show child attributes

Across the API

Authentication

Versioning

Users

Virtual Accounts

Recipients

Quotations

Payouts

Catalogs

RFIs

Liveness verification link

Authorizations

Headers

Path Parameters

Body

Response