Noxtica Verification ID (NVID)

A Noxtica Verification ID (NVID) is a short reference that a hosted identity verification session receives when it completes or waits for review. Your customer sees it on the final hosted screen, your server reads it from the session, and anyone who holds it can check its status on a public page that shows no personal data. Backend engineers read it, and Backoffice administrators revoke or resend it.

What it is

Availability: Controlled availability. The NVID is part of identity verification, and Noxtica issues it when it is enabled for your organisation. Your account team confirms whether it applies to you.

An NVID looks like NVID-XXXX-XXXX-XXXX-XXXX. It has 16 characters from the Crockford base32 alphabet (digits and letters, without I, L, O and U), and the last character is a check character, so most typing mistakes are rejected before any lookup.

The public status is one of four values:

Results are signals. An NVID shows that a verification happened and what its status is. You still decide what it means for your customer.

Prerequisites

• Identity verification provisioned for your organisation, and Noxtica Verification IDs enabled for it. When they are not enabled, the status read has no nvid key and the hosted screen shows no ID.
• A server key with the identity permission to read the session status. See Identity verification integration.
• To see the NVID in Backoffice: a user who can open KYC Verifications. To revoke or resend: a user with the administrator role who can complete step-up verification (MFA).
• For the optional “email me my ID” form: email delivery set up for your environment. Backoffice shows “Email delivery is not configured for this environment” when it is not.

Steps

1. Read the NVID from your server

Read the session status (GET https://collect.noxtica.com/v1/kyc/sessions/{sessionId}) and take session.nvid:

{
  "ok": true,
  "session": {
    "id": "<uuid>",
    "status": "review_pending",
    "nvid": "NVID-XXXX-XXXX-XXXX-XXXX"
  },
  "requestId": "<request-id>"
}

Other session fields are left out of this excerpt.

• nvid is a string once an ID exists, and null when the session has none.
• The key is absent when NVIDs are not enabled for your organisation.
• A kyc.session.completed event carries data.nvid when an ID was issued. A revoke sends no event, so read the public status when you need the current one.
• Store the NVID next to your sessionId. Your subjectRef never goes to the public page.

2. Let your customer keep it

On the final hosted screen the customer sees “Your Noxtica Verification ID” with the ID, a “Copy ID” button, the current status and an “Open the status page” link. The screen explains that anyone the customer gives the ID to can open the status link, and that the link shows no personal data.

The screen can also offer “Email me my ID (optional)”. The customer must tick an unticked consent box before “Send my ID” becomes active. Noxtica sends the ID and the status link to that address. The address is not shown to you. The hosted page accepts up to 3 sends per session, at least 60 seconds apart.

3. Share the status link

The status page is https://verify.noxtica.com/v/<NVID>. Open it in a browser. It shows:

• the ID and its status, with a plain-language line such as “This verification is current.”
• “Verified on” and “Valid until” for a verified ID, “Expired on” for an expired one and “Revoked on” for a revoked one. A pending ID shows no dates.
• “Requested by”, the requesting business name, when one is available.
• a note that the page never shows a name, a document or a photo.

An ID that is malformed, unknown or no longer available shows the same “ID not found” screen. The page is not cached and is not for search engines.

The lookup behind the page is for browsers only. It accepts requests from the verification site’s own pages and nowhere else, so a call from your server or from your own site is refused with 403 origin_not_allowed. It also has a rate limit for each client IP address; bounds can change. To check an ID from your backend, use the session status in step 1.

4. Revoke or resend in Backoffice

Open Backoffice → Identity Verification → KYC Verifications, open the case, and select the Overview tab. In the “Session details” card you see “Noxtica Verification ID”, “Verification ID status”, “Verification ID issued”, “Email on file for the ID”, “Last emailed” and “Emails sent”.

Administrators also see these actions. Each needs fresh step-up verification (MFA):

The revoke reasons are “Issued in error”, “Fraud suspected”, “Requested by the subject” and “Requested by the business”. Revoking is recorded in the audit log. A session can be emailed up to 20 times in total, with at least 60 seconds between sends.

Verify it works

1. Finish a hosted session. The status read returns session.nvid in the format above.
2. Open https://verify.noxtica.com/v/<NVID> in a browser. While the session waits for review, the page shows “Pending review” and says the verification is not verified yet.
3. After a reviewer approves the case, reload the page. It shows “Verified” with “Verified on” and “Valid until”.
4. After you revoke the ID in Backoffice, reload the page. It shows “Revoked” with “Revoked on”. The status read keeps returning the same nvid string.

Troubleshooting

Related

• Identity verification integration — create sessions and read the status.
• Identity verification events and webhooks — the nvid field on kyc.session.completed.
• Identity verification FAQ and troubleshooting — review_pending and review decisions.
• Identity verification data — what is kept and how an administrator deletes it.
• Privacy — how Noxtica handles personal data.