The Plaid Identity Verification API exposes 5 documented endpoints under the Plaid REST API at production.plaid.com. It is one of 31 APIs that Plaid publishes on the network, described by a machine-readable OpenAPI specification plus documentation. Plaid’s provider composite is 75.2 — exemplar — and its agent-readiness band is agent-native.
Five endpoints is a small surface for a large job.
What it does and what it sits next to
Identity Verification is the KYC step: prove the human on the other end is who they claim before money moves. Plaid’s catalog entry places it alongside twelve sibling APIs — Auth, Balance, Identity, Monitor Watchlist Screening, Beacon, Signal, Transfer, Bank Transfer, Transactions, Categories, Investments, and Liabilities.
Read that list as an architecture. Identity returns the account holder’s details as the bank has them. Identity Verification is a separate product that runs a document-and-selfie flow and returns a decision. Watchlist Screening and Beacon check that verified person against sanctions lists and a fraud network. Those are four different questions, and Plaid resisted collapsing them into one endpoint that returns a score.
That separation is the design decision worth copying. “Is this person real,” “is this person sanctioned,” and “has this person defrauded someone else on this network” have different failure modes, different regulatory exposure, and different retention rules. One combined /verify endpoint would have been easier to sell and impossible to reason about.
Five endpoints, one state machine
An identity verification is not a request/response — it is a session a human walks through over minutes or days, with retries, document re-uploads, and manual review. Five endpoints is what that costs when you model it as a resource with lifecycle rather than as a function call: create the attempt, read it, retry it, list them, and handle the review.
The consequence for integrators is that you cannot treat this API synchronously. You create a verification and you wait. Anyone wiring it up as a blocking call in a signup flow will discover this in production.
The artifact set
An OpenAPI specification and documentation. For an API this small that is close to sufficient — 5 endpoints described in a machine-readable contract is a surface an agent can resolve without guessing.
What is not in the artifact set is a described event surface. A product whose whole shape is “start something, find out later” is the canonical case for an AsyncAPI definition or documented webhooks in the catalog. Plaid sends webhooks; the catalog entry does not carry a machine-readable description of them. That is the gap between an exemplar score and a complete one.
Takeaway
Five endpoints, twelve siblings, and a deliberate refusal to merge four regulatory questions into one convenient answer. Plaid modelled identity verification as a lifecycle rather than a lookup, which is correct, and then left the asynchronous half of that lifecycle undescribed.
Read the docs at plaid.com/docs/identity-verification/, and the provider entry at apis.io/providers/plaid/.