Identity Platform

Identity Platform

KYC onboarding and continuous step-up authentication, purpose-built for the Indonesian KTP.

What it does

Identity Platform handles two distinct jobs that share the same biometric stack:

Onboarding KYC. Capture a customer's KTP, run anti-spoof and tamper checks, extract OCR fields, enroll a face reference. Outputs a verified Customer with a KYC tier (none → basic → standard → premium).
Continuous step-up authentication. On every sensitive action (large transfer, password change, new device login), run a live selfie against an enrolled reference. Sub-second match decision. Use your own client-supplied reference image if you have one.

What we explicitly do NOT do

We do not issue or validate non-KTP documents (passport, driver's license, etc.). KTP only.
We do not call Dukcapil from our side. You call Dukcapil and post the verdict to us — see Dukcapil verdict ingest.

Core concepts

Concept	What it is
Customer	Your end-user. Persistent across all verifications and KYC tier transitions.
Verification	A single check (NIK format, KTP capture, face liveness, face match, Dukcapil verdict). Immutable.
CaptureBundle	A signed bundle of frames + sensor data submitted by the SDK. Sealed at rest, hash-attested.
FaceEnrollment	A reference embedding for a customer (ArcFace v3, 512-dim). Sources: `dukcapil` (best), `ktp_extract`, `onboarding_selfie`, `step_up_promotion`.
KYC tier	`none` · `basic` · `standard` · `premium`. Computed from verification history.
Flash challenge	A short single-use color sequence the SDK shows on screen. Used to defeat replay attacks.

KYC tier ladder

Tier	Requires	Common use case
`none`	Nothing	Account exists, nothing verified
`basic`	Valid NIK format	Open a pre-funded wallet
`standard`	KTP capture passed (anti-spoof + tamper) OR Dukcapil verdict received	Transact under regulated tier-1 limits
`premium`	`standard` + face liveness + face match to enrolled reference	Withdraw to bank, large transfer, mortgage open

Common integration shape

A typical Indonesian fintech wires Identity Platform this way:

Onboarding

1
POST/api/customers
Create the customer.
2
POST/api/identity/document/ktp/challenge
Issue a flash challenge — the SDK uses it during capture.
3
POST/api/identity/document/ktp/capture
SDK posts captured frames + OCR fields.
4
POST/api/identity/nik/dukcapil
Post your client-side Dukcapil verdict.
Optional, but bumps the tier to standard.
5
GET/api/identity/kyc/{customerId}
Check the resulting KYC tier.

Step-up auth (per sensitive action)

1
POST/api/identity/face/flash-challenge
Issue a selfie challenge.
2
POST/api/identity/auth/step-up
Atomic liveness + match decision.
Returns `{ allow: true | false }`.

Endpoints at a glance

Group	Endpoints
Auth	`POST /api/auth/login` · `POST /api/auth/logout` · `GET /api/auth/me`
WebAuthn / passkey	`POST /api/auth/webauthn/register/{begin,finish}` · `POST /api/auth/webauthn/auth/{begin,finish}`
Customers	`GET/POST /api/customers` · `GET /api/identity/customers/{id}` · `POST /api/identity/customers/{id}/erase` (UU PDP)
KTP	`POST /api/identity/document/ktp/challenge` · `POST /api/identity/document/ktp/capture`
Face	`POST /api/identity/face/flash-challenge` · `POST /api/identity/face/liveness` · `POST /api/identity/face/match`
Step-up auth	`POST /api/identity/auth/step-up`
Dukcapil	`POST /api/identity/nik/dukcapil`
KYC	`GET /api/identity/kyc/{customerId}` · `POST /api/identity/kyc/{customerId}/upgrade`
Enrollments	`GET /api/identity/face/enrollments`
Devices	`POST /api/identity/devices/register` (called by native SDKs, not directly by your service)
Attempts	`GET /api/identity/attempts` · `GET /api/identity/customers/{id}/attempts`
Search (dashboard)	`GET /api/identity/search?q=...` — analyst-only, free-text across customer name / NIK / email
Review queue (dashboard)	`GET /api/identity/review-queue` · `POST /api/identity/review-queue/{id}/decision`
Tier events (dashboard)	`GET /api/identity/tier-events` — KYC tier history feed
Exports (dashboard)	`GET /api/identity/export/customers.csv` · `GET /api/identity/export/verifications.csv`
Audit log	`GET /api/identity/audit-log`
Webhooks	`GET/POST /api/identity/webhooks` · `POST /api/identity/webhooks/{id}/test`
API keys	`GET/POST /api/identity/api-keys`
Health	`GET /api/healthz`

Routes marked (dashboard) are intended for analyst UI use and require an internal-scope key; integrations consuming the public API don't typically need them.

Production considerations

Concern	Answer
Data residency	All biometric captures, embeddings, and KTP frames live in `id-jkt-1`. Sealed at rest with AES-256-GCM. Never replicated cross-border.
Biometric model	Face matcher is ArcFace v3 (`modelId: qe-face-v3`); 512-dim embeddings. Default match threshold 0.45 for step-up (tunable per-org for target FAR ~1e-4).
Retention	Onboarding capture frames: 3 years (OJK requirement). Step-up frames: 90 days. Verification rows + audit log: 7 years (regulated record). Embeddings retired on erasure but the row stays for the regulated window.
Rate limits	KTP challenge: 10/min/customer. KTP capture: 5/min/customer. Face liveness: 20/min/customer. Step-up: 60/min/customer. Erasure: 10 per 5 min per org.
Idempotency	Capture bundles dedupe on the bundle nonce within 24h. Repeated submits with the same nonce return the original verification ID.
Right to erasure	`POST /api/identity/customers/{id}/erase` — UU PDP-compliant, irreversible. See Data deletion →.
Audit	Every customer action, KYC transition, capture, match, dukcapil submit, erasure is audit-logged. Immutable, 7 years.
Webhook signing	HMAC-SHA256 over the raw body, header `X-Identity-Signature: sha256=<hex>`. A suite-wide migration to `X-Quantum-Signature` is on the 2026 roadmap — accept both for forward compatibility.