Didit Email Verification API

Overview

Three standalone endpoints:

1. Send a one-time code to an email address: POST /v3/email/send/
2. Check the code the user typed and get the email report: POST /v3/email/check/
3. Risk (no code sent): score an address in one call: POST /v3/email/risk/

Key constraints (send + check):

• The check finds the verification by your application + the email address. It does not take request_id.
• A pending verification lives 5 minutes from the first send. Retries do not extend it.
• 3 code attempts per verification. Wrong codes 1 and 2 return "Failed"; the 3rd wrong code finalizes it as "Declined" (EMAIL_CODE_ATTEMPTS_EXCEEDED).
• One resend per pending verification: a second send for the same address inside the window returns "Retry" with the same request_id and a fresh code (the previous code stops working). A further send starts a new verification with a new request_id.
• Codes are compared case-insensitively. Only the most recent code is valid.
• No pending verification (never sent, already finalized, undeliverable at send, or older than 5 minutes): the check returns HTTP 200 with status: "Expired or Not Found".
• Each new verification is stored as an API session: request_id works with GET /v3/session/{sessionId}/decision/, shows in the Business Console, and fires status.updated webhooks as it progresses. Each risk call also creates an API session.