> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verifyyou.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm a verification token

> Exchange the `vyt` token the user returned with for the authoritative verification result. **Secret key only.** Call this from your backend before granting access.



## OpenAPI

````yaml /v3/openapi.json get /v3/confirmations/{token}
openapi: 3.1.0
info:
  title: VerifyYou API
  description: >-
    The VerifyYou developer API. Start a verification from the browser with your
    publishable key, then confirm the result server-side with your secret key.
    Authenticate every request with `Authorization: Bearer <key>`.
  version: 0.1.0
servers:
  - url: https://trust.verifyyou.com
    description: Production
security: []
tags:
  - name: Verification Flow
    description: Start a hosted verification and get the URL to redirect the user to.
  - name: Confirmations
    description: Confirm a verification token, and lock it against replay (secret key).
  - name: API Keys
    description: Check whether a publishable or secret key is valid.
paths:
  /v3/confirmations/{token}:
    get:
      tags:
        - Confirmations
      summary: Confirm a verification token
      description: >-
        Exchange the `vyt` token the user returned with for the authoritative
        verification result. **Secret key only.** Call this from your backend
        before granting access.
      operationId: external-get_confirmation
      parameters:
        - name: token
          in: path
          required: true
          schema:
            type: string
            description: >-
              The `vyt` confirmation token the user returned with after
              verifying.
            title: Token
          description: The `vyt` confirmation token the user returned with after verifying.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConfirmationResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - HTTPBearer: []
components:
  schemas:
    ConfirmationResponse:
      properties:
        verified:
          type: boolean
          title: Verified
          description: >-
            Authoritative result: true only if the verification passed and the
            confirmation is unlocked. Gate access on this, not on the
            client-side `vyc` hint.
        id:
          anyOf:
            - type: string
            - type: 'null'
          title: Id
          description: The confirmation id for this person's pass through the verification.
        status:
          anyOf:
            - type: string
            - type: 'null'
          title: Status
          description: >-
            Verdict detail: pending, approved, flagged (passed with findings),
            denied.
        reasons:
          items:
            type: string
            enum:
              - collision_network
              - collision_company
              - identity_mismatch
              - external_identity_mismatch
              - duplicate_account
              - linked_denial
              - limit_reached
              - face_self_mismatch
              - age_blocked
              - geo_blocked
              - manual_override
              - guest_declined
          type: array
          title: Reasons
          description: >-
            Rule findings behind the status. A settled denied or flagged
            confirmation carries at least one; a clean pass is empty.

            - collision_network / collision_company: this face already holds a
            confirmation for another, unlinked person, within the network or
            company scope.

            - identity_mismatch: this face is registered to a different identity
            (identity lock on).

            - external_identity_mismatch: this external_id is already bound to a
            different person.

            - duplicate_account: this person already has a confirmation under a
            different external_id.

            - linked_denial: an account linked to this person was denied.

            - limit_reached: the re-verification limit for this person was hit.

            - face_self_mismatch: the face didn't match the same session's
            earlier capture.

            - age_blocked: the estimated age failed the configured age gate.

            - geo_blocked: the request came from a blocked region.

            - manual_override: a staff override set this status.

            - guest_declined: the person declined the verification.
        confirmed_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Confirmed At
          description: When the latest settled verdict landed.
        identity:
          anyOf:
            - $ref: '#/components/schemas/CollectedIdentityRef'
            - type: 'null'
          description: >-
            The identity collected during the flow, present only when the
            verification's identity config has sharing enabled. Secret-key
            responses only.
        external_id:
          anyOf:
            - type: string
            - type: 'null'
          title: External Id
          description: The `external_id` attached to the session at initialize, if any.
        verification:
          $ref: '#/components/schemas/VerificationRef'
      type: object
      required:
        - verified
        - external_id
        - verification
      title: ConfirmationResponse
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    CollectedIdentityRef:
      properties:
        phone:
          anyOf:
            - type: string
            - type: 'null'
          title: Phone
          description: The phone the flow collected/verified, if any.
        email:
          anyOf:
            - type: string
            - type: 'null'
          title: Email
          description: The email the flow collected/verified, if any.
      type: object
      title: CollectedIdentityRef
    VerificationRef:
      properties:
        external_id:
          anyOf:
            - type: string
            - type: 'null'
          title: External Id
          description: >-
            Your `external_id` for the verification, if one was set at
            initialize.
        external_tenant_id:
          anyOf:
            - type: string
            - type: 'null'
          title: External Tenant Id
          description: Your `external_tenant_id` for the verification, if one was set.
      type: object
      required:
        - external_id
        - external_tenant_id
      title: VerificationRef
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer

````