Exclude personal data from Verify ID
Add?excludePII=true to POST /liveness/verify-id and the response leaves out document_data, photo_urls, and video_urls. Everything else is unchanged. Without the parameter you get the full response, as before. Webhooks are not affected.Move accounts between lists, and update a list description
PATCH /list/{list_name} updates the description on a list.POST /list/{list_name}/account/move moves up to 1,000 accounts to another list in one call, and returns an outcome per account, such as moved, conflict, or not_found.Name signals on ID Check
Document signals includename_not_found, which fires when the name is missing from the document, and name_partially_missing, which fires when only part of it is found. Both work as rule conditions.Authenticate rejects a body that is missing an account
POST /session/authenticate returns 400 when the request body is missing a usable account object, for example when the keys arrive capitalized as Account and Session_id. These requests returned 500 before, so error handling keyed on the status code sees the new value.Account grids load in seconds
Opening a list’s accounts on a large project takes seconds. Measured on a project with 75 million accounts: the block list page at 3.5 seconds, down from 100 to 300 seconds, an unfiltered page at 2.6 seconds, a country filter at 2.8 seconds, and a 4.2 million member list at 3.3 seconds.Analyze with AI on ID Check and Face Match
The AI investigation panel runs on verification sessions. The liveness video analysis and the captured photos feed into it.On accounts, the analysis reads your project’s own scoring thresholds, the definitions of the lists the account is on, and the conditions of the rules it hit.Incomplete verification sessions
ID Check and Face Match sessions that ended before they completed open from the grid. Photos and videos captured up to that point are in their tabs, and the sections that need a finished session carry a placeholder explaining what is missing.Dashboards for every customer
Dashboards is in the sidebar for every customer, and you can build your own. Charts and tables built in an Agent chat can be added to them.Digital IDs on ID Check
A digital ID comes back as a risk signal, and you can write rules on it. When a digital ID is on screen, the video analysis view shows the clips that apply to it.Rule building
Domain Type, Country, and Mobile Languages offer value suggestions on contains conditions, with exact matches ranked first, so typingus gives United States.School ID and employee ID are available as document templates in rules.Numeric rule conditions require a value
Conditions using>, >=, <, and <= match when the field they read has a value. A rule on verification.id_age < 18 matches only when the document carries a readable date of birth. Missing values used to compare as zero, so rules of this shape match fewer accounts and sessions from now on.RulesThe sessions table has a Source column, filterable by web, iOS, and Android, and a Source Version column you can turn on from the column panel. Both values show in the session side panel and come along in CSV exports.You can write rules on session source.
Sessions from the iOS, Android, and Flutter SDKs now report the SIM carrier and the country that carrier operates in. Carrier country comes from the device, so it holds up when the IP is proxied.Every session returns
source (web, ios, or android) and source_version, so you can tell which integration produced a session and which SDK version it ran.Linked accounts return first_seen and last_seen, showing when two accounts were first connected and when that link was last active.Account timestamp format
first_seen and last_seen come back as normalized ISO 8601 timestamps, on the account itself and on linked accounts. Earlier responses passed through nanosecond precision, for example 2026-04-22T21:38:47.806000000Z, so anything parsing these fields sees a different string from now on.Account objectSessions with an out of range country code
A session persists even when network intelligence reports a country code outside the two letter form, such asCN-TW for Taiwan. The country code on that session is left unset, and the account behind it gets its scores, decision, and last_seen as usual. Sessions like these were dropped before, so they now appear in the sessions table and in Get Session.Rules and lists act on verification results
Two rule triggers are live in the dashboard: ID Check Completed and Face Match Completed. Rules on these triggers can read the verification decision, risk score, risk signals, document country, ID age, and the rest of the verification response.Rules apply to the account behind the verification. A rule likeIF risk signals contains id_age_below_16 → Add to Block List adds the account itself, tied to the session where the condition matched.List membership now flows through to verification decisions. Block-listed accounts return Fake on /verify-id and /verify-face, allow-listed accounts return Real. Both endpoints return lists and rules fields showing what was applied.If you already keep accounts on lists, some verification decisions will change to match the account decision.Automatic enrollment
Pass anaccount_id when you create a verification session and we enroll the account once the session completes. Enrollment was previously a separate call that had to happen in the right order, and sessions that skipped it returned confusing Fake results.Rules · Face Match session setup · ID Check session setupRule suggestions from the agent
Ask the dashboard agent for a rule and it proposes conditions backed by backtest numbers from your own data, then hands off to the rule create form with those conditions filled in. Suggestions arrive disabled and the backtesting drawer runs on arrival, so you see what the rule would have caught before you turn it on.Online presence signals on email
Email intelligence reports online presence in tiers.no_online_presence and sparse_online_presence come back as risk signals, moderate_online_presence and strong_online_presence as trust signals. All four work as filters on the email table. Rows scored before this change stay filterable on online_presence_detected.Email IntelligenceRisk signal details
Sessions returnrisk_signal_details, a set of named reason codes that explain why a risk score is elevated. It comes back on Authenticate, Unauthenticated, and Get Session.- Network: 13 signals covering the proxy, VPN, and location scores, such as
ip_on_vpn_listandtrue_country_mismatch. - Device: 22 signals covering device risk, such as
browser_tampering_detectedandandroid_emulator_or_rooted. This includes emulator and jailbreak detection, factory reset boot profiles, Play Integrity verdicts, and device brand signals.
Mobile device facts
Sessions from the iOS and Android SDKs return amobile block: brand, model, RAM, boot count, uptime, battery, languages, and OEM integrity verdicts. Native sessions also improve the existing device fields with values a WebView masks or misreports.All of it works in rules, as filterable columns in the sessions table, and in the session side panel. You may need to enable the new columns to see them.Risk Signals · MobileAndroid time settings signal
Device risk signals includeandroid_manual_time_settings, which fires when a device has automatic time or automatic time zone turned off. It works in rules and as a filter on the sessions table.Duplicate a rule, and create rules disabled
You can duplicate an existing rule, which opens the create form with its conditions and actions filled in.The create and edit forms carry a Status switch, so you can save a rule disabled and turn it on once you have reviewed it. New rules default to enabled.Equals and not equals on lists
Rules on the Lists field take Equals and Not equals. Matching is on exact list membership, so a condition onadvertiser 10 treats advertiser 100 as a separate list.Account fields in the accounts table
The accounts table shows a Phone column, with Username, First Name, Last Name, and Expected Countries available from the column panel. All five filter, and the filters sync to the URL.Share a view, and clear a custom date range
Tables and analytics pages have a Share button beside the date picker. It copies the current URL, which already carries the date range and the filters you have applied.An active custom date range gets an X beside it that clears the range and returns the page to the default 7 day period.RulesFive optional fields are accepted on the account object, through Authenticate Session and Update Account:
phone, first_name, last_name, username, and expected_countries.Phone, name, and username feed multi-accounting. They become additional identifiers for linking accounts. A shared phone number or username is a full match on its own. A shared name supports links alongside device, network, and email matches. Matches appear in linked accounts with their match type. Values are normalized behind the scenes, so +1 (415) 555-0123 matches +1-415-555-0123 and José García matches jose garcia.Expected countries feed location spoofing. Declare where an account should be operating, for example ["US", "CA"]. Sessions from outside those countries, or far from them, factor into that account’s location spoofing score.All five fields are optional and additive. Send nothing and behavior stays the same. Updating a field later works as you would expect, with last write winning per field.Account object · Multi-Accounting · Expected CountriesDashboardDeviceNetworkVerifications
Upgraded risk models, the dashboard AI agent, and rebuilt verifications
Upgraded real-time models
We improved how device and network data is collected. Measured against the previous models:- 31% better catch rate on sophisticated proxies and anti-detect browsers
- 10 to 14% fewer false positives on location spoofing and proxy/VPN, with the largest gains on slow networks
- 18 to 20% faster session IDs and API responses
AI agent in the dashboard
There is an agent in the bottom-left corner of the dashboard. It has access to your project data in a privacy-preserving sandbox, which is never shared with model providers or used for training. It can run investigations, build charts, slides, and CSVs, and take actions such as adding accounts to lists.Prompts worth trying:- “Pull all accounts linked to at above 50% strength, three levels deep”
- “Compare fake and suspicious users over the last 7 days against the prior 7. What is driving the change?”
- “Here are 100 emails. Find their accounts and add them to the block list.”
- “Build a report on the last 30 days: fraud rates, key drivers, trends”
Face Match and ID Check
We rebuilt the data processing and risk engine behind both products, and we now capture and return session video in the dashboard.- 30% more accurate ID data capture
- 82% fewer false positive risk flags, while catching more fraud
- Video makes phone handoffs, digital IDs, and background characteristics visible during review
- ID Check returns a face age estimate on the verification response.
- Network intelligence identifies satellite connections as a distinct connection type.
- The
id_agedocument signal description now states what it measures: the age derived from the date of birth on the document. - Email intelligence groups the Identity Intelligence signals together and marks them as such in the API reference.
Face Match and ID Check responses include a URL for the recorded session video. The same video is available in the dashboard on the verification detail view.Video shows the context around a capture: a phone handed between people, an ID held up on another screen, and the surroundings the capture happened in.
You can serve the Verisoul browser SDK from a subdomain you own, for example
verify.yourcompany.com. Requests go to your domain and reach us behind it.Setup is a nameserver delegation on a subdomain you dedicate to us. We handle the certificate and keep it renewed.Traffic to a first-party domain gets past ad blockers and tracker blocklists, which raises the share of sessions that produce a full signal set.Custom HostnameSessions and accounts return a
location_spoofing score. It combines the signals we collect about where a session claims to be and where it appears to actually be: timezone, locale, GPS where available, IP geolocation, and network routing.The score is in the API reference for Get Session and Get Account, in the sessions and accounts tables, and available in rules.Get Session · Network IntelligenceEmail intelligence used to run only as part of a real-time session through
/session/authenticate. It is now a standalone endpoint, so you can submit an email on its own and get a full assessment back.Email carries history, and history takes years to fake. It also links out to names, phones, and locations, which adds identity context to device and network signals.What comes back:- Risk score from -1 (high trust) to +1 (high risk), with a decision label of
high_trust,trusted,moderate,risky, orhigh_risk, plus the trust and risk signals behind it. - Online history and age: how long the address has existed, where it has appeared, and breach history with dates.
- Social signals: which platforms the address is registered on, such as Google, Facebook, and LinkedIn.
- Deliverability: whether the address can receive mail, with a recommendation of
send,send_with_caution, ordo_not_send. - Domain intelligence: disposable, fresh, and fake domains, classified as personal, business, education, government, relay, or inactive.
- Identity intelligence: pass an expected name, phone, and country, and we match those claims against external data, then return connected names and phone numbers.