# Re-authentication

Confirm that a returning customer is the same person, with only a selfie. Send `"type": "reauth"` and your `vendor_data` for the customer; the selfie, with liveness, is matched against the face of their last approved verification: the chip portrait if it was read, else their approved selfie, else the document portrait. It is charged like the liveness and face match steps.

```shell
curl -X POST https://api-verify.secuveri.com/v1/sessions \
  -H "x-api-key: $SECUVERI_API_KEY" \
  -H "content-type: application/json" \
  -d '{"type":"reauth","vendor_data":"customer-1042"}'
```

The answer adds `reference` (the verification whose face is used and its source: `stored_chip`, `stored_selfie` or `stored_document`). The signed result carries the same as `reauth_of`. Stored faces are deleted on your biometric retention period (Settings → Organization); when there is none left, the answer is 409 with `code` `no_reference`, and the customer needs a full verification. Earlier re-authentications are never used as the reference.