Amani REST API

Overview

The Amani REST API uses JSON Web Token (JWT) authentication and accepts/returns JSON. All requests must be made over HTTPS. Use your regional base URL for all requests.

Token Types

API Sections

Authentication

All API requests require a valid JWT token in the Authorization header. Obtain a token by logging in with your credentials. Tokens expire periodically — use the refresh endpoint to get a new access token without re-authenticating.

Login

Authenticate with your credentials to receive a user token. Must be performed server-side.

POST {base_url}/api/v2/user/login

curl '{base_url}/api/v2/user/login' \
  -H 'Content-Type: application/json' \
  --data '{
    "username": "user@account.com",
    "password": "password"
  }'

Response includes the access token, refresh token, and user details:

{
  "id": "user-uuid",
  "username": "username",
  "first_name": "First",
  "last_name": "Last",
  "access": "ACCESS_TOKEN",
  "refresh": "REFRESH_TOKEN",
  "groups": [...],
  "permissions": [...]
}

Refresh Token

When your access token expires (you'll receive a 401 Unauthorized response), use the refresh token to obtain a new access token:

POST {base_url}/api/v2/token/refresh/

curl '{base_url}/api/v2/token/refresh/' \
  -H 'Content-Type: application/json' \
  --data '{"refresh": "<REFRESH_TOKEN>"}'

{
  "access": "<NEW_ACCESS_TOKEN>"
}

Profiles

Customer profiles are the core entity in Amani. Create a profile to register a customer, retrieve the profile token for SDK initialization, and update profile data or status as needed.

Documents

The Documents API manages identity documents submitted during verification. You can upload documents on behalf of customers, retrieve submitted documents, and manage their lifecycle.

Webhooks

Webhooks let Amani push real-time verification event notifications to your server. Each request is signed with an HMAC signature using your webhook secret — always verify the signature before processing the payload.

AML

The AML (Anti-Money Laundering) API screens individuals against a global database of sanctions lists, PEP (Politically Exposed Person) registries, and adverse media sources.

IP Whitelist

The IP Whitelist API lets you restrict API access to a defined set of trusted IP addresses — useful for locking down server-to-server integrations and preventing unauthorized access.