find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/infinihash-com:infinihash-com-audit-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Infinihash KYC Audit API
  version: 1.0.0
  description: 'Identity verification, KYB, sanctions screening, UBO orchestration and periodic review.


    Auth: send your key as `X-API-Key: ` (or `Authorization: Bearer `).


    Most endpoints are mounted twice — at the root (`/kyc/...`) and under `/api` (`/api/kyc/...`). Prefer the `/api` form; it is what the hosted portals and SDKs use.


    Python SDK: `pip install "git+https://github.com/Infinihash/kyc-python@v0.1.0"` (https://github.com/Infinihash/kyc-python; runnable examples in examples/).'
  contact:
    name: Infinihash
    url: https://kyc.infinihash.com
servers:
- url: https://kyc-api.infinihash.com
  description: Production
tags:
- name: Audit
paths:
  /kyc/{submissionId}/audit:
    get:
      x-route-source:
        file: routes/audit.js
        method: get
        path: /:submissionId/audit
      summary: Get audit events for a submission
      description: Returns the append-only audit events for one submission, newest first. The submission must belong to the caller's owner scope (cross-tenant access returns 404, not 403); a valid `X-Admin-Secret` bypasses the scope check. The router is mounted at both /kyc and /audit, so /audit/{submissionId}/audit also exists.
      tags:
      - Audit
      operationId: getSubmissionAudit
      parameters:
      - name: submissionId
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      - name: limit
        in: query
        required: false
        description: Max events (default 200, capped at 1000).
        schema:
          type: integer
          default: 200
          maximum: 1000
      - name: X-Admin-Secret
        in: header
        required: false
        description: Optional admin secret. A valid value bypasses the owner-scope check (cross-tenant read).
        schema:
          type: string
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Audit events
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuditEvent'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: audit_read_failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditReadError'
  /kyc/key/{apiKeyId}:
    get:
      x-route-source:
        file: routes/audit.js
        method: get
        path: /key/:apiKeyId
      summary: Get audit events for an API key
      description: Returns the append-only audit events attributed to one API key, newest first. The target key must be in the caller's owner scope (otherwise 404); a valid `X-Admin-Secret` bypasses the scope check. Canonical path is /audit/key/{apiKeyId}; /kyc/key/{apiKeyId} exists only because the router is mounted at both prefixes.
      tags:
      - Audit
      operationId: get_kyc_key_apiKeyId
      parameters:
      - name: apiKeyId
        in: path
        required: true
        schema:
          type: string
        description: apiKeyId
      - name: limit
        in: query
        required: false
        description: Max events (default 500, capped at 2000).
        schema:
          type: integer
          default: 500
          maximum: 2000
      - name: X-Admin-Secret
        in: header
        required: false
        description: Optional admin secret. A valid value bypasses the owner-scope check (cross-tenant read).
        schema:
          type: string
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Audit events
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuditEvent'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: audit_read_failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditReadError'
  /audit/{submissionId}/audit:
    get:
      x-route-source:
        file: routes/audit.js
        method: get
        path: /:submissionId/audit
      summary: Get audit events for a submission
      description: Returns the append-only audit events for one submission, newest first. The submission must belong to the caller's owner scope (cross-tenant access returns 404, not 403); a valid `X-Admin-Secret` bypasses the scope check. The router is mounted at both /kyc and /audit, so /audit/{submissionId}/audit also exists.
      tags:
      - Audit
      operationId: get_audit_submissionId_audit
      parameters:
      - name: submissionId
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      - name: limit
        in: query
        required: false
        description: Max events (default 200, capped at 1000).
        schema:
          type: integer
          default: 200
          maximum: 1000
      - name: X-Admin-Secret
        in: header
        required: false
        description: Optional admin secret. A valid value bypasses the owner-scope check (cross-tenant read).
        schema:
          type: string
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Audit events
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuditEvent'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: audit_read_failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditReadError'
  /audit/key/{apiKeyId}:
    get:
      x-route-source:
        file: routes/audit.js
        method: get
        path: /key/:apiKeyId
      summary: Get audit events for an API key
      description: Returns the append-only audit events attributed to one API key, newest first. The target key must be in the caller's owner scope (otherwise 404); a valid `X-Admin-Secret` bypasses the scope check. Canonical path is /audit/key/{apiKeyId}; /kyc/key/{apiKeyId} exists only because the router is mounted at both prefixes.
      tags:
      - Audit
      operationId: getApiKeyAudit
      parameters:
      - name: apiKeyId
        in: path
        required: true
        schema:
          type: string
        description: apiKeyId
      - name: limit
        in: query
        required: false
        description: Max events (default 500, capped at 2000).
        schema:
          type: integer
          default: 500
          maximum: 2000
      - name: X-Admin-Secret
        in: header
        required: false
        description: Optional admin secret. A valid value bypasses the owner-scope check (cross-tenant read).
        schema:
          type: string
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Audit events
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuditEvent'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: audit_read_failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditReadError'
  /kyc/{submissionId}/legal-hold:
    patch:
      x-route-source:
        file: routes/legalHold.js
        method: patch
        path: /:submissionId/legal-hold
      summary: Apply a legal hold
      description: 'Places a legal hold on a submission: the retention sweep skips every field of its documents (raw image, raw response, PII) until the hold is released. A previously released hold can be re-applied. Writes a legal_hold.set audit event.'
      tags:
      - Audit
      operationId: setLegalHold
      parameters:
      - name: submissionId
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LegalHoldSetRequest'
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Hold applied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LegalHoldApplied'
        '400':
          description: reason is required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: submission not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Already on hold
          content:
            application/json:
              schema:
                type: object
                required:
                - error
                - setAt
                properties:
                  error:
                    type: string
                    enum:
                    - already on hold
                  setAt:
                    type: string
                    format: date-time
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      x-route-source:
        file: routes/legalHold.js
        method: get
        path: /:submissionId/legal-hold
      summary: Get legal hold status
      description: Returns the hold record for the submission (active or released). 404 if the submission never had a hold.
      tags:
      - Audit
      operationId: getLegalHold
      parameters:
      - name: submissionId
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Hold record
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LegalHoldStatus'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: submission not found, or no hold record
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /kyc/{submissionId}/legal-hold/release:
    patch:
      x-route-source:
        file: routes/legalHold.js
        method: patch
        path: /:submissionId/legal-hold/release
      summary: Release a legal hold
      description: Releases the active legal hold so retention can resume. 404 if there is no active hold. Writes a legal_hold.release audit event. The body is optional.
      tags:
      - Audit
      operationId: releaseLegalHold
      parameters:
      - name: submissionId
        in: path
        required: true
        schema:
          type: string
        description: KYC submission id
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LegalHoldReleaseRequest'
      security:
      - ApiKeyAuth: []
      - BearerAuth: []
      responses:
        '200':
          description: Hold released
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LegalHoldReleased'
        '401':
          description: Missing or invalid API key
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: submission not found, or no active hold
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Rate limited (global per-IP limit)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    LegalHoldReleaseRequest:
      type: object
      properties:
        releaseReason:
          type: string
          description: Why the hold is released (optional).
        releasedBy:
          type: string
          description: Operator identity; defaults to the API key id.
    LegalHoldSetRequest:
      type: object
      required:
      - reason
      properties:
        reason:
          type: string
          description: Why the hold is applied.
        setBy:
          type: string
          description: Operator identity; defaults to the API key id.
    LegalHoldReleased:
      type: object
      required:
      - submissionId
      - onHold
      - releasedAt
      properties:
        submissionId:
          type: string
        onHold:
          type: boolean
          enum:
          - false
        releasedAt:
          type: string
          format: date-time
        releaseReason:
          type:
          - string
          - 'null'
    AuditReadError:
      type: object
      required:
      - error
      properties:
        error:
          type: string
        detail:
          type: string
    LegalHoldApplied:
      type: object
      required:
      - submissionId
      - onHold
      - setAt
      - reason
      - setBy
      properties:
        submissionId:
          type: string
        onHold:
          type: boolean
          enum:
          - true
        setAt:
          type: string
          format: date-time
        reason:
          type: string
        setBy:
          type: string
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: string
    AuditEvent:
      type: object
      required:
      - id
      - createdAt
      - action
      description: An append-only audit log entry (cannot be amended or deleted through the API).
      properties:
        id:
          type: string
        createdAt:
          type: string
          format: date-time
        apiKeyId:
          type:
          - string
          - 'null'
        submissionId:
          type:
          - string
          - 'null'
        documentId:
          type:
          - string
          - 'null'
        action:
          type: string
          description: e.g. document.upload, biometric.check, kyc.run, legal_hold.set, retention.purge.
        provider:
          type:
          - string
          - 'null'
        model:
          type:
          - string
          - 'null'
        hash:
          type:
          - string
          - 'null'
        costUsd:
          type:
          - number
          - 'null'
        latencyMs:
          type:
          - integer
          - 'null'
        meta:
          type:
          - string
          - 'null'
          description: JSON-encoded context blob (a string).
    LegalHoldStatus:
      type: object
      required:
      - submissionId
      - onHold
      - reason
      - setBy
      - setAt
      properties:
        submissionId:
          type: string
        onHold:
          type: boolean
          description: false once released.
        reason:
          type: string
        setBy:
          type: string
        setAt:
          type: string
          format: date-time
        releasedAt:
          type:
          - string
          - 'null'
          format: date-time
        releasedBy:
          type:
          - string
          - 'null'
        releaseReason:
          type:
          - string
          - 'null'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
    BearerAuth:
      type: http
      scheme: bearer