Fetch a verification with its captures

curl --request GET \
  --url https://platform-staging.get-rial.com/v1/verifications/{id} \
  --cookie rial_session=

const options = {method: 'GET', headers: {cookie: 'rial_session='}};

fetch('https://platform-staging.get-rial.com/v1/verifications/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform-staging.get-rial.com/v1/verifications/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_COOKIE => "rial_session=",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform-staging.get-rial.com/v1/verifications/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("cookie", "rial_session=")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://platform-staging.get-rial.com/v1/verifications/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["cookie"] = 'rial_session='

response = http.request(request)
puts response.read_body

{
  "id": "vfy_01HXYZABCDEFGHJKMNPQRSTVWX",
  "status": "completed",
  "capture_url": "https://verify.get-rial.com/v/vfy_01HXYZABCDEFGHJKMNPQRSTVWX",
  "created_at": "2026-05-28T13:00:00.000Z",
  "expires_at": "2026-05-28T14:00:00.000Z",
  "captures_count": 3,
  "config": {
    "max_captures": 3,
    "steps": [
      {
        "key": "capture_1",
        "type": "image",
        "description": "",
        "min": 3,
        "max": 3
      }
    ],
    "signals_required": [
      "screen",
      "ai"
    ],
    "context": {
      "kind": "damage_claim",
      "summary": "Toyota Corolla front bumper"
    },
    "webhook_url": "https://api.acmeinsurance.com/rial/webhooks",
    "metadata": {
      "claim_id": "CLM-9912"
    }
  },
  "narrative": "Front bumper damaged after low-speed collision in supermarket parking lot.",
  "verdict": {
    "label": "verified",
    "score": 0.92,
    "signals": {
      "screen_detection": {
        "screen_detected": false,
        "confidence": 0.97
      },
      "ai_detection": {
        "label": "likely_human",
        "confidence": 0.88
      }
    }
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

Verifications

Fetch a verification with its captures

Returns the verification and every capture submitted against it (inlined). Capture image_url fields are presigned with a 1-hour TTL — the dashboard can drop them into <img src> with no auth handshake. The S3 bucket policy itself stays private.

Channel-hiding: an unknown id and a cross-tenant id both return 404 with the same body. A truthful 403 would let an operator probe for other tenants’ verification ids by guessing.

GET

verifications

{id}

Fetch a verification with its captures

curl --request GET \
  --url https://platform-staging.get-rial.com/v1/verifications/{id} \
  --cookie rial_session=

const options = {method: 'GET', headers: {cookie: 'rial_session='}};

fetch('https://platform-staging.get-rial.com/v1/verifications/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform-staging.get-rial.com/v1/verifications/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_COOKIE => "rial_session=",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform-staging.get-rial.com/v1/verifications/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("cookie", "rial_session=")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://platform-staging.get-rial.com/v1/verifications/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["cookie"] = 'rial_session='

response = http.request(request)
puts response.read_body

{
  "id": "vfy_01HXYZABCDEFGHJKMNPQRSTVWX",
  "status": "completed",
  "capture_url": "https://verify.get-rial.com/v/vfy_01HXYZABCDEFGHJKMNPQRSTVWX",
  "created_at": "2026-05-28T13:00:00.000Z",
  "expires_at": "2026-05-28T14:00:00.000Z",
  "captures_count": 3,
  "config": {
    "max_captures": 3,
    "steps": [
      {
        "key": "capture_1",
        "type": "image",
        "description": "",
        "min": 3,
        "max": 3
      }
    ],
    "signals_required": [
      "screen",
      "ai"
    ],
    "context": {
      "kind": "damage_claim",
      "summary": "Toyota Corolla front bumper"
    },
    "webhook_url": "https://api.acmeinsurance.com/rial/webhooks",
    "metadata": {
      "claim_id": "CLM-9912"
    }
  },
  "narrative": "Front bumper damaged after low-speed collision in supermarket parking lot.",
  "verdict": {
    "label": "verified",
    "score": 0.92,
    "signals": {
      "screen_detection": {
        "screen_detected": false,
        "confidence": 0.97
      },
      "ai_detection": {
        "label": "likely_human",
        "confidence": 0.88
      }
    }
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

Authorizations

rial_session

string

required

Dashboard / operator session cookie. Set by /v1/auth/google/callback after Google OAuth, JWT signed with the rotating rial-platform/session-signing HMAC. Read on every request the SPA makes with credentials: include. Browser-only — server-to-server callers use bearerApiKey instead.

Path Parameters

string

required

ULID with vfy_ prefix.

Pattern: ^vfy_[0-9A-HJKMNP-TV-Z]{26}$

Example:

"vfy_01HXYZABCDEFGHJKMNPQRSTVWX"

Response

Verification including inlined captures with presigned image URLs.

Canonical wire shape for a verification. narrative is present only after POST /v1/verifications/:id/finalize ran. verdict is present only after analysis completed. case_analysis is the structured Gemini multi-image rubric, embedded inline by the sync finalize path when analysis succeeded.

string

required

Pattern: ^vfy_[0-9A-HJKMNP-TV-Z]{26}$

status

enum<string>

required

Lifecycle state. pending → first capture flips to partially_captured → analysis sets the verdict and transitions to completed. Terminal: completed, expired, failed. abandoned is a side-branch off pending/partially_captured, reported by the capture screen via POST /v1/verifications/:token/progress when the end user leaves before finishing — NOT terminal: a later capture resurrects the row to partially_captured like any other.

Available options:

pending,

partially_captured,

completed,

expired,

failed,

abandoned

capture_url

string<uri>

required

created_at

string<date-time>

required

expires_at

string<date-time>

required

captures_count

integer

required

Required range: x >= 0

config

object

required

Tenant-supplied configuration baked into the token at issue time. Immutable after creation — changing config means issuing a new verification. steps is the normalized capture spec: requests that sent max_captures: N read back as a single anonymous step { key: "capture_1", min: N, max: N }.

Show child attributes

answers

object

Show child attributes

record_seal

object

Integrity seal over the verification record including answers. Present only when answers exist and sealing is on (seal !== false). The hash proves the stored answers have not changed — it does NOT claim they are true or sensor-attested; answers_provenance carries that distinction explicitly.

Show child attributes

verdict

object

Aggregate verdict produced by the per-capture analysis pipeline. label is the human-readable bucket; score is the confidence in the verdict.

Show child attributes

narrative

string

Maximum string length: 2000

case_analysis

object

Structured output from the multi-image case-analysis worker (Gemini batch reasoning). Per-dimension scores 0..1 where 0 = nothing suspicious on that dimension and 1 = that dimension alone is grounds to reject. overall_risk_score aggregates with cross-dimensional reasoning, not a simple average.

Show child attributes

object_match

object

Object-check result. Present only when the verification was created with expected_object. Independent of the fraud verdict.

Show child attributes

condition

object

Condition assessment. Present only when the verification was created with condition_aspects — the free-form tenant-defined aspect names (any language, any domain). score is the one-decimal average of aspect scores; label buckets it (>=7.5 good, >=5 fair, else poor). Independent of the fraud verdict.

Show child attributes

progress

object

Latest funnel-progress snapshot reported via POST /v1/verifications/:token/progress. A snapshot, not an event log — each call overwrites the previous one. Operator-only; never present on the public projection.

Show child attributes

⌘I

Get started

Core concepts

SDKs

CLI

API reference

Fetch a verification with its captures

Authorizations

Path Parameters

Response