Glossary of Didit terms
Plain definitions for the words that appear in the console, webhooks and API - session, workflow, application, vendor_data, warning, UBO, KYT, and the rest.
The three words that matter most: an application is an environment with its own API key, a workflow is the set of checks you configured, and a session is one person's attempt at that workflow.
The words below appear across the console, the webhook payloads, and the API. This page is the plain-language version.
#Core objects
Organization - your account. Holds your team, your billing balance, and everything below.
Application - a workspace inside an organization, with its own workflows and its own API key. Each application has a mode of live or sandbox. Use separate applications to separate environments or products.
Workflow - the set of checks you want run, in order, with any branching logic. Built visually in the console. A workflow's configuration is what determines the price of a session.
Session - one person's single attempt at a workflow. Has a session_id, a status, and a result per check. Sometimes called a verification.
Business session - the KYB equivalent: one company's attempt at a business verification workflow. Can spawn child sessions for the people behind the company.
Feature (also module, or step) - one individual check: ID verification, passive liveness, AML screening, and so on. You're billed per completed feature, not per session.
Decision - the full result object for a session: the status plus every feature's own result, extracted data, scores, and warnings.
#Statuses and outcomes
Approved / Declined / In Review - the three outcomes that matter. In Review means automated checks flagged something a human needs to settle. See what each session status means.
Warning - a specific, named reason a check flagged something, like DOCUMENT_EXPIRED or LOW_FACE_MATCH_SIMILARITY. Warnings are why a session got its status. They are the thing to read when you want to know what actually happened.
Resubmission - asking a user to redo only the steps that failed, keeping the same session and audit trail.
Decided - a verdict exists: Approved, Declined, or Kyc Expired. Not the same as immutable - a reviewer can reopen a decision and ongoing AML monitoring can move an approved session later, so keep handling updates. Only Expired and Abandoned never move again.
#Identifiers
session_id - Didit's identifier for a session. Use it when contacting support; it is the fastest way for anyone to look at exactly what you're looking at.
vendor_data - your identifier for the user, which you set when creating the session. It comes back on every webhook, and it's how Didit groups multiple sessions under one consolidated user. Set it to your internal user ID.
vendor_business_data - the same idea for a company in KYB.
txn_id - your identifier for a transaction in transaction monitoring, distinct from Didit's transaction_id.
#Verification concepts
KYC (know your customer) - verifying that a person is who they claim to be.
KYB (know your business) - verifying a company: that it exists, its registry data, and who owns and controls it.
AML (anti-money laundering) - screening a person or company against sanctions, PEP, and adverse media lists.
KYT (know your transaction) - monitoring transactions for risk after onboarding, including crypto wallet screening.
PEP - politically exposed person. Someone in a prominent public function, who carries higher risk and usually needs enhanced due diligence rather than an automatic refusal.
RCA - relative or close associate of a PEP, screened for the same reason.
UBO - ultimate beneficial owner. The natural person who ultimately owns or controls a company. Finding them is the point of KYB.
Liveness - proving the selfie came from a live human in front of the camera, not a photo, screen replay, or mask. Passive requires no user action; active asks for a movement or uses a light sequence.
Face match 1:1 - comparing the selfie against the photo on the document. Produces a similarity score.
Face search 1:N - comparing the selfie against every face you've already verified, to spot duplicate accounts and blocklisted people.
Biometric authentication - re-verifying a returning user by face alone, without redoing the document.
MRZ - the machine-readable zone: the two or three lines of monospaced text at the bottom of a passport or ID. It carries checksums, so a failed MRZ check is a strong tamper signal.
NFC - reading the cryptographically signed chip inside an ePassport or chipped ID with a phone. The strongest document check available.
PoA - proof of address: verifying where someone lives from a utility bill, bank statement, or similar document.
Database validation - checking the data a user gave you against an authoritative source, rather than against their document.
Document AI - extracting structured data from an arbitrary supporting document that isn't an identity document.
#Integration terms
Verification link - a hosted URL (and QR code) that runs a workflow with no code on your side.
Reusable link (also uni-link) - one long-lived link that creates a new session per visitor, instead of one link per user.
Webhook - Didit calling your server when something changes. The recommended way to get results. See getting results with webhooks.
Signing secret - the per-destination secret you use to verify a webhook's HMAC signature. Not the same thing as your API key.
Environment - sandbox or live, carried on every webhook so you can tell test traffic from real.
White label - running the verification flow under your own branding, optionally on your own subdomain.