Please wait
API version history and release notes.
KYA prompt screening reports what screened a prompt: every response carries a screening object with its outcome (blocked, review, passed_screening or not_screened), the engine, and whether a model produced the verdict.
A prompt is allowed only when a screening model looked at it. With no model verdict and no blocking signature, POST /api/v1/kya/verify and the dashboard verify route answer 503 not_screened and nothing is allowed or issued.
One signature blocks on its own, instruction_override: an instruction to ignore previous instructions that also asks, in the same or the next sentence, for the agent's own system prompt or for a canary word such as PWNED. Every other signature is weak: it never blocks, and it keeps a clean model verdict at review. DAN and other jailbreak personas, developer mode, SYSTEM labels and chat-template markers, overrides in other languages and encoded or hidden text are refused as not screened until a model is deployed.
injectionScore is the model's probability that the prompt is an injection, and is null when no model screened it. The analysis object is removed, and the dashboard route no longer answers "approved".
Prompts are limited to 32,000 characters (413 above that). POST /api/v1/kya/verify refuses an empty prompt with 400; omit prompt for an identity-only certificate.
POST /api/v1/kya/verify answers with allowed, true only when a screening model passed the prompt, as the dashboard route does.
Without a prompt, POST /api/v1/kya/verify answers action "identity_only" where it answered "allow": "allow" now always means a screening model passed a prompt.
POST /api/v1/kya/verify issues a certificate only for action "allow" and "identity_only". A review, like a block, gets none.
A test key on POST /api/v1/kya/verify gets a sandbox fixture labelled environment "sandbox": the live signatures, no screening model, nothing counted against kya_checks, and for identity_only an unsigned certificate (alg "none") that GET /api/v1/kya/certificate/{id} refuses.
POST /api/v1/escrow/initiate is withdrawn. It answers 410 Gone with code escrow_api_unavailable, and nothing is created. The answer does not depend on the API key or on who the parties are. Escrow is opened from the TrustVerify dashboard. GET /api/v1/escrow/{escrowId} still returns escrows created before the withdrawal.
Initial public release. KYC, KYB, AML, KYA, Escrow, Workflows, four PDF report types, and regulatory evidence bundles (RPT-016) now live.
Features included at launch: individual identity verification (passport, national ID, driving licence, proof of address), business verification against Companies House / HMRC / FCA FS Register, sanctions, PEP and watchlist screening, Know Your Agent checks (KYA), escrow lifecycle management, named workflows, the RPT-001 / RPT-002 / RPT-003 / RPT-KYA PDF reports, and RPT-016 evidence bundles. The remaining RPT codes are planned and return 501 — see Report types.
API updates and maintenance notices are announced in the changelog above and emailed to your account address.