# Glossary of Didit terms

Source: https://help.didit.me/getting-started/glossary
Updated: 2026-10-23

Plain definitions for the words that appear in the console, webhooks and API - session, workflow, application, vendor_data, warning, UBO, KYT, and the rest.

The three words that matter most: an **application** is a workspace with its own
workflows and API keys, a **workflow** is the set of checks you configured, and a
**session** is one person's attempt at that workflow.

The words below appear across the console, the webhook payloads, and the API. This page is the plain-language version.

## Core objects

**Organization** - your account. Holds your team, your billing balance, and everything below.

**Application** - a workspace inside an organization, with its own workflows, API keys and webhooks. The **Live** and **Sandbox** switch under its name moves between environments: new applications are Live, and Sandbox is your organization's shared test application. Use separate applications to separate products or brands.

**Product** - one of Didit's three products: Identity verification, Transaction monitoring & Travel Rule, and Authentication. Each application has the products you turn on for it, and each product has its own entry in the console sidebar, where turning products on per application has rolled out. See [products and what they include](https://help.didit.me/account-organization/products).

**Person** and **company** - the record that groups every verification, document, device and transaction belonging to one person or one company, by your `vendor_data`. Listed under **People** and **Companies** in the console. See [people and companies](https://help.didit.me/verification-sessions/people-and-companies).

**Workflow** - the set of checks you want run, in order, with any branching logic. Built visually in the console. A workflow's configuration is what determines the price of a session.

**Session** - one person's single attempt at a workflow. Has a `session_id`, a status, and a result per check. Sometimes called a verification.

**Business session** - the KYB equivalent: one company's attempt at a business verification workflow. Can spawn child sessions for the people behind the company.

**Feature** (also **module**, or **step**) - one individual check: ID verification, passive liveness, AML screening, and so on. You're billed per completed feature, not per session.

**Decision** - the full result object for a session: the status plus every feature's own result, extracted data, scores, and warnings.

## Statuses and outcomes

**Approved / Declined / In review** - the three outcomes that matter. In review means automated checks flagged something a human needs to settle. See [what each session status means](https://help.didit.me/verification-sessions/session-statuses).

**Warning** - a specific, named reason a check flagged something, like `DOCUMENT_EXPIRED` or `LOW_FACE_MATCH_SIMILARITY`. Warnings are why a session got its status. They are the thing to read when you want to know what actually happened.

**Resubmission** - asking a user to redo only the steps that failed, keeping the same session and audit trail.

**Decided** - a verdict exists: Approved, Declined, or KYC expired. A reviewer can reopen a decision and ongoing AML monitoring can move an approved session later, so keep handling updates. Abandoned sessions can also be resubmitted.

## Identifiers

**`session_id`** - Didit's identifier for a session. Use it when contacting support; it is the fastest way for anyone to look at exactly what you're looking at.

**`vendor_data`** - **your** identifier for the user, which you set when creating the session. It comes back on every webhook, and it's how Didit groups multiple sessions under one consolidated user. Set it to your internal user ID.

**`vendor_business_data`** - the same idea for a company in KYB.

**`txn_id`** - your identifier for a transaction in transaction monitoring, distinct from Didit's `transaction_id`.

## Verification concepts

**KYC** (know your customer) - verifying that a person is who they claim to be.

**KYB** (know your business) - verifying a company: that it exists, its registry data, and who owns and controls it.

**AML** (anti-money laundering) - screening a person or company against sanctions, PEP, and adverse media lists.

**KYT** (know your transaction) - monitoring transactions for risk after onboarding, including crypto wallet screening.

**PEP** - politically exposed person. Someone in a prominent public function, who carries higher risk and usually needs enhanced due diligence rather than an automatic refusal.

**RCA** - relative or close associate of a PEP, screened for the same reason.

**UBO** - ultimate beneficial owner. The natural person who ultimately owns or controls a company. Finding them is the point of KYB.

**Liveness** - proving the selfie came from a live human in front of the camera, not a photo, screen replay, or mask. **Passive** requires no user action; **active** asks for a movement or uses a light sequence.

**Face match 1:1** - comparing the selfie against the photo on the document. Produces a similarity score.

**Face search 1:N** - comparing the selfie against every face you've already verified, to spot duplicate accounts and blocklisted people.

**Biometric authentication** - re-verifying a returning user by face alone, without redoing the document.

**MRZ** - the machine-readable zone: the two or three lines of monospaced text at the bottom of a passport or ID. It carries checksums, so a failed MRZ check is a strong tamper signal.

**NFC** - reading the cryptographically signed chip inside an ePassport or chipped ID with a phone. The strongest document check available.

**PoA** - proof of address: verifying where someone lives from a utility bill, bank statement, or similar document.

**Database validation** - checking the data a user gave you against an authoritative source, rather than against their document.

**Document AI** - extracting structured data from an arbitrary supporting document that isn't an identity document.

## Investigation terms

Some of these are rolling out and may not be available to your organization yet.

**Inbox** - the place in the console that collects everything waiting for you to decide or read: verifications in review, AML hits, cases, networks, mentions and alerts. See [your Inbox](https://help.didit.me/investigations/inbox).

**Event** - one thing that happened, in one feed across your products: a verification, a transaction, an automated action, or a custom event you send, such as a login. See [the Events feed](https://help.didit.me/investigations/events).

**Case** - an investigation that groups the records behind it, moves through stages with a deadline, and closes with a recorded outcome. See [working with cases](https://help.didit.me/investigations/cases).

**Blueprint** - a case template: its stages and deadlines, checklist, assignment and approval rules.

**Network** - a group of verifications connected by something they share, such as a device, an IP address, a face or a document number. A lead to investigate, not proof of fraud on its own. See [fraud networks](https://help.didit.me/investigations/networks).

**Investigator** - Didit's AI agent that reads an item in review, checks it against your policy and recommends a decision with its evidence. A person stays in charge. See [the Didit Investigator](https://help.didit.me/investigations/investigator).

**Shadow mode** - the stage where the Investigator writes a report on every item and scores itself against your team's decisions, but decides nothing. It's never billed.

**Autonomy level** (also **tier**) - how much the Investigator may do in one queue: **Off**, **Suggest**, **Auto** or **Full auto**. See [the Didit Investigator](https://help.didit.me/investigations/investigator).

**Segment** - conditions, such as countries, risk, workflows or an amount range, that lower a queue's autonomy level or raise its confidence threshold for the items that match. See [control and oversee the Investigator](https://help.didit.me/investigations/investigator-automation-and-oversight).

**Lock** - your own rule that a matching item is never approved automatically, or never decided without a person.

**Guardrail** - one of the fixed rules of the Investigator that nobody can switch off, owners included: for example, sanctions matches always go to a person.

**Golden set** - reference items with the outcome you expect for each. Every policy change is checked against them before it's published. See [set up the Investigator and its policy](https://help.didit.me/investigations/investigator-setup-and-policy).

**Drift** - a drop in how often the Investigator agrees with your team, or a change in the kind of items it receives. With drift protection on, the queue steps down one autonomy level.

**Consistency check** - the Investigator reviews the same items again, three times each by default, to measure how often it repeats its recommendation. Free.

**Information request** (also **RFI**) - a private thread where the Investigator asks the person you verify for what's missing, with a deadline and reminders. See [the Investigator, the people you verify and their data](https://help.didit.me/investigations/investigator-end-users-and-privacy).

**SAR draft** (also **STR draft**) - a suspicious activity or suspicious transaction report the Investigator drafts, with a goAML file, for a person to sign and file with their financial intelligence unit. Didit never files it.

**Precedent** - a past decision your team took on an item with the same situations in the same queue, which a report shows next to its recommendation.

**Ask Didit** - the AI assistant docked in the console, also called Didit Copilot. See [how Didit Copilot works](https://help.didit.me/didit-copilot/how-didit-copilot-works).

## Integration terms

**Verification link** - a hosted URL (and QR code) that runs a workflow with no code on your side.

**Reusable link** (also **uni-link**) - one long-lived link that creates a new session per visitor, instead of one link per user.

**Webhook** - Didit calling your server when something changes. The recommended way to get results. See [getting results with webhooks](https://help.didit.me/integration/webhooks-basics).

**Signing secret** - the per-endpoint secret you use to verify a webhook's HMAC signature. Not the same thing as your API key.

**Environment** - `sandbox` or `live`, carried on every webhook so you can tell test traffic from real. In the console, the **Live** and **Sandbox** switch under the application name moves between them.

**White label** - running the verification flow under your own branding, optionally on your own subdomain.