Signed results

GET https://api-verify.secuveri.com/v1/verifications/{id}/result with your API key, where id is the verification id or the session id, returns { "result": "<JWS>" } once the verification has finished (409 before). A key reads only its own environment's results.

JSON

{
  "iss": "https://api.secuveri.com",
  "aud": "<your organization id>",
  "sub": "VRF-7KQ2M9XA",
  "iat": 1792746902,
  "jti": "1f0b6c1e-…",
  "verification": {
    "verification_id": "VRF-7KQ2M9XA",
    "session_id": "6f1c2e0a-8f43-4f7e-9a51-2b7c1d9e4a10",
    "workflow_id": "<workflow id>",
    "vendor_data": "customer-1042",
    "metadata": null,
    "status": "COMPLETE",
    "verdict": "APPROVED",
    "trust_level": "HIGH",
    "outcome_reason": null,
    "expected_details": null,
    "document": {
      "type": "PASSPORT",
      "country": "CHE",
      "chip_verified": true,
      "outcome": null
    },
    "checks": {
      "document": "PASS",
      "morph": "PASS",
      "liveness": "PASS",
      "face-match": "PASS",
      "deepfake": "PASS"
    },
    "completed_at": "2026-10-23T09:15:01.902Z"
  }
}

Verify it

Pick the key whose kid matches the JWS header from /.well-known/jwks.json, require alg ES256, check the signature, and check that aud is your organization id. Cache the key set for a few minutes; when a kid is unknown, fetch it again (during a key change both keys are listed).

import { createPublicKey, verify } from "node:crypto";

// jwks: await (await fetch("https://api-verify.secuveri.com/.well-known/jwks.json")).json(), cached for a few minutes.
export function verifySecuveriResult(jws, organizationId, jwks) {
  const [header64, payload64, signature64] = jws.split(".");
  const header = JSON.parse(Buffer.from(header64, "base64url").toString());
  if (header.alg !== "ES256") throw new Error("Unexpected algorithm");
  const jwk = jwks.keys.find((key) => key.kid === header.kid);
  if (!jwk) throw new Error("Unknown signing key; fetch the JWKS again");
  const valid = verify(
    "sha256",
    Buffer.from(`${header64}.${payload64}`),
    { key: createPublicKey({ key: jwk, format: "jwk" }), dsaEncoding: "ieee-p1363" },
    Buffer.from(signature64, "base64url")
  );
  if (!valid) throw new Error("Invalid signature");
  const payload = JSON.parse(Buffer.from(payload64, "base64url").toString());
  if (payload.aud !== organizationId) throw new Error("Result is for another organization");
  return payload;
}