> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.hopnow.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Verification Session

> Create a hosted identity-verification session for an associated person

Creates a hosted verification session for the associated person and returns a link to share with them (by email or redirect). The person opens the hosted page and uploads their identity documents and completes the liveness (biometric) check there; identity documents for an individual are not uploaded through this API. Hosted capture should accept passports for all countries, and Singapore NRIC for Singapore individuals. If an active (non-expired, non-terminal) session already exists, that session is returned instead of creating a new one, so the call is safe to repeat. There is no request body.

Fails with `422` when the account's `kyc_status` is terminal, or when the person is already approved. A rejected person may be re-verified: calling this endpoint mints a fresh session and moves their `verification_status` back to `under_review`. Identity verification of the person completes once they finish document capture and the liveness check inside the session and its status is `passed`; progress surfaces through the person's `verification_status`, the account-level `requirements` block, and the `account.updated` webhook.

## Path Parameters

<ParamField path="customer_id" type="string" required>
  Id of the Platform customer.
</ParamField>

<ParamField path="account_id" type="string" required>
  Id of the parent account.
</ParamField>

<ParamField path="ap_id" type="string" required>
  Id of the associated person (e.g. `aap_…`).
</ParamField>

## Response

Returns `200` with the verification-session object. `status` is one of `pending`, `passed`, `failed`, `expired`.

<Warning>
  Treat `hosted_url` as an opaque, short-lived link — the hosting domain may change and the URL must not be stored long-term or embedded in an iframe.
</Warning>

<ResponseField name="object" type="string">
  Always `"verification_session"`.
</ResponseField>

<ResponseField name="id" type="string">
  Id of the verification session.
</ResponseField>

<ResponseField name="associated_person_id" type="string">
  Id of the associated person the session verifies (e.g. `aap_…`).
</ResponseField>

<ResponseField name="status" type="enum">
  One of `pending`, `passed`, `failed`, `expired`.
</ResponseField>

<ResponseField name="hosted_url" type="string">
  Link to the hosted verification page to share with the person. Opaque and short-lived — do not store long-term or embed in an iframe.
</ResponseField>

<ResponseField name="expires_at" type="string">
  ISO 8601 timestamp when the session expires.
</ResponseField>

<ResponseField name="created" type="string">
  ISO 8601 timestamp when created.
</ResponseField>

<ResponseField name="updated" type="string | null">
  ISO 8601 timestamp when last updated.
</ResponseField>

<ResponseField name="created_by" type="string">
  Id of the API key that created the session.
</ResponseField>

<ResponseField name="updated_by" type="string | null">
  Id of the API key that last updated the session.
</ResponseField>

<ResponseExample>
  ```json Response theme={null}
  {
    "object": "verification_session",
    "id": "3f6b2a91-4c8e-4f27-9d15-8a2e6c1b7d40",
    "associated_person_id": "aap_8rty2c1x7k2m9p4q1w8e5r3t",
    "status": "pending",
    "hosted_url": "https://verify.platform.example/s/3f6b2a91-4c8e-4f27-9d15-8a2e6c1b7d40",
    "expires_at": "2026-06-19T12:00:00Z",
    "created": "2026-06-12T09:32:00Z",
    "updated": null,
    "created_by": "ak_x7k2m9p4q1w8e5r3t6y0u2i4",
    "updated_by": null
  }
  ```
</ResponseExample>