Best of · Domain data
Best identity and business verification APIs for AI agents
The 10 highest-scoring of 11 identity and business verification APIs on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.
- 11 ranked
- 1 agent-ready
- 9 hosted endpoints
- Updated 9 October 2026
Top three
Picks by need
Worked out from the scores, prices and facts, so they change when the research does.
The shortlist
| # | Tool | Grade | Best for | Price | Where |
|---|---|---|---|---|---|
| 1 | Didit Didit Identity Spain, S.L. |
BB 75 | A team that wants document, liveness, screening and business registry checks from one API with public prices and no sales step, and an agent that has to set itself up. | $0.15 / tx | hosted and local |
| 2 | Persona Persona Identities, Inc. |
B 69.5 | A company that already runs Persona and wants an agent to create inquiries from templates, read verification and report results, screen against watchlists and work review cases with a permission-limited key. | $250 / mo | hosted |
| 3 | Sumsub Sum and Substance Ltd |
B 68.5 | An agent that starts verifications, sends links, reads results and AML cases, and works case queues for a regulated business, with one token limited to those permissions. | $1.35 / tx | hosted |
| 4 | ComplyCube ComplyCube (Teemo Technology Ltd) |
B 63.7 | An agent that creates clients, uploads documents, starts document, identity and AML screening checks and reads results for a regulated business, with low entry cost ($99 a month) and a scripted sandbox. | $99 / mo | hosted |
| 5 | Socure RiskOS Socure Inc. |
B 63.5 | A company in the United States that wants one decision from combined KYC, document, fraud and watchlist checks through a single evaluation call. | $0.80 / tx | hosted |
| 6 | Veriff Veriff OÜ |
C 61.1 | A team that needs document and selfie verification with public per-verification prices and a trial, and that can run a webhook receiver and HMAC signing. | $0.80 / tx | local |
| 7 | Middesk Middesk, Inc. |
C 59 | An agent onboarding or re-checking US businesses for a bank, lender or marketplace that already holds a Middesk contract, with registry, TIN, sanctions and lien data in one object. | Paid | hosted |
| 8 | Trulioo Trulioo Information Services Inc. |
C 58.2 | An agent doing business due diligence (search, verification, ownership, reports) or person checks across many countries for a company that already has a Trulioo contract, and for teams that want to test verification flows against synthetic data first. | Paid | hosted |
| 9 | Shufti Shufti Pro Limited |
C 57.8 | A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link. | $1.50 / tx | hosted |
| 10 | Jumio Jumio Corporation |
C 55 | An enterprise with a Jumio contract that wants document, selfie and liveness checks, watchlist screening and Latin American, Thai and Australian database checks behind OpenAPI-described endpoints. | Paid | local |
1 more are ranked in the full table.
How to choose
- Identity, business and screening checksCheck whether identity, business registry and watchlist screening are all covered, since a listing that covers only one leaves a gap the agent cannot close itself.
- Status events and callbacksCheck whether status changes arrive by callback, since an agent that polls for a result wastes calls and may read a stale status.
- Retention, deletion and redactionCheck how long documents and selfies are kept, whether they can be deleted, and if results are redacted, so stored personal data stays minimal.
- Result fields for each checkCheck which result fields come back for a person and a business, and whether a sandbox run returns the same fields as live, so tests reflect production decisions.
How the benchmark tests this category. One test person and one test business run through each listing's sandbox. A verification is started, completed with the vendor's test documents and read back, with a watchlist screen. We check the result fields, status events, retention controls and redaction. In this run listings are graded from public evidence against the published checklist.
Each one in detail
Didit
BB 75/100Didit is a hosted identity verification service for document, liveness, face match, sanctions screening and business registry checks. Developers reach it through a REST API with an OpenAPI spec, a hosted MCP server and client SDKs.
Verdict A self-serve verification API with public per-check prices, key registration by API, scoped keys and a 365-day audit log. The status page shows three incidents marked major between 22 July and 4 September 2026, each a partial outage of the core APIs, and the sub-processor list isn't public.
Choose it for A team that wants document, liveness, screening and business registry checks from one API with public prices and no sales step, and an agent that has to set itself up.
Strengths
- An account and API key can be created by API at
apx.didit.me/auth/v2/programmatic/register/, with an emailed code and no browser step - Public OpenAPI 3.0.0 spec with 256 operations, plus llms.txt and a Markdown copy of every docs page
- Named API keys take read or write access per resource, workflow limits, an IP allowlist and an expiry date, and rotation keeps the old secret for 24 hours
Weaknesses
- Three incidents marked major on status.didit.me from 22 July to 4 September 2026, each a partial outage of the core APIs traced to the primary database
- No server-side SDK in any language. The published SDKs are capture clients for web, iOS, Android, React Native and Flutter
- The data processing addendum says the sub-processor list is published at
/terms/sub-processors, but that address shows the legal index, which says the list is sent after a signed NDA
Price $0.15 / txAuth OAuth or keyx402 nohosted and local
Persona
B 69.5/100Persona is an identity verification platform from Persona Identities, Inc. Its REST API and hosted MCP server create inquiries, run government ID, selfie, document and database verifications, screen people and businesses against watchlists, and manage review cases.
Verdict The REST API has a public OpenAPI 3.1 file, llms.txt, API keys with per-resource permissions, idempotency keys on every POST and a 60-day sandbox trial with no card. Production needs a business review and a 12-month plan from $250 a month. The status page lists 11 incidents since 10 July 2026, including 70 minutes of timeouts across all products.
Choose it for A company that already runs Persona and wants an agent to create inquiries from templates, read verification and report results, screen against watchlists and work review cases with a permission-limited key.
Strengths
- Public OpenAPI 3.1 file with 231 operations and 141 webhook definitions, plus llms.txt and a Markdown copy of every docs page
- API keys take about 50 read and write permissions per resource, an IP allowlist, their own rate limit and an expiry endpoint
Idempotency-Keyon every POST, cursor pagination, andfieldsandincludeparameters that trim responses
Weaknesses
- Production access needs Persona's approval and a 12-month plan from $250 a month, and API-only integration is limited to Enterprise plans
- Eleven incidents on the status page since 10 July 2026, five marked partial outage, most on document and government ID verifications
- The MCP server lists all 190 tools whatever the key allows, with no annotations, toolsets or read-only subset, and OAuth isn't available yet
Price $250 / moAuth API keyx402 nohosted
Sumsub
B 68.5/100Sumsub verifies people from identity documents and a liveness check, verifies businesses against registries, and screens both against sanctions and watchlists. Agents reach it through a signed REST API and a hosted MCP server.
Verdict Per-token permissions, an IP allowlist, HMAC-signed requests and a public OpenAPI spec with Markdown docs suit an agent working on verification cases. No idempotency keys or Retry-After guidance were found, there is no server SDK, and production access needs a browser signup, a bank card and Sumsub's review of the integration.
Choose it for An agent that starts verifications, sends links, reads results and AML cases, and works case queues for a regulated business, with one token limited to those permissions.
Strengths
- App tokens carry per-token permissions, an optional IP allowlist and expiry date, and can be disabled with a recorded reason
- Requests are signed with HMAC-SHA256 over timestamp, method, path and body, so the secret key never travels
- Public OpenAPI 3.0.1 spec with 157 operations, llms.txt, and every docs page served as Markdown
Weaknesses
- No idempotency keys and no Retry-After or backoff guidance found in the reviewed documentation
- Only 24 of 157 operations in the OpenAPI spec carry a summary or description, and 154 declare only a default response
- No official server-side SDK. Sumsub publishes request-signing examples in seven languages instead
Price $1.35 / txAuth OAuth or keyx402 nohosted
ComplyCube
B 63.7/100ComplyCube verifies people from identity documents and a liveness check, screens people and companies against sanctions, PEP and adverse media lists, and runs address and bureau checks. Agents reach it through a REST API with separate test and live keys.
Verdict A sandbox with its own key and scripted outcomes, a public OpenAPI spec, Markdown docs and an audit log API suit an agent running verification checks. Each environment has one unscoped key, no idempotency keys were found, and the only published terms are undated and read as website terms.
Choose it for An agent that creates clients, uploads documents, starts document, identity and AML screening checks and reads results for a regulated business, with low entry cost ($99 a month) and a scripted sandbox.
Strengths
- Test and live environments have separate keys, and sandbox outcomes are set by test data such as a client last name of attention or failed
- Public OpenAPI 3.0.0 spec (version 1.7.3, 52 operations),
llms.txt, and every docs page served as Markdown - Audit log API records the team member, trigger, action and a field-level diff of old and new values
Weaknesses
- One API key per environment with no scopes. The docs say keys carry many privileges
- No idempotency keys, and no Retry-After header documented for 429 responses
- The only published terms are undated, read as website terms and cite the Data Protection Act 1998. No service agreement or DPA was found on a public page
Price $99 / moAuth API keyx402 nohosted
Socure RiskOS
B 63.5/100Socure RiskOS is an identity verification and risk decisioning platform from Socure Inc. Its Evaluation API runs configured workflows for KYC, document and selfie checks, fraud scoring and watchlist screening, and returns a decision with reason codes.
Verdict A public OpenAPI file, llms.txt, 15 documented error codes and dated release notes cover a ten-operation REST API, and Socure Launch publishes prices from $0.80 an evaluation with a free sandbox. API keys carry no scopes, no idempotency header is defined, no service terms are published, and production stays at zero requests until Socure activates it.
Choose it for A company in the United States that wants one decision from combined KYC, document, fraud and watchlist checks through a single evaluation call.
Strengths
- OpenAPI 3.0.3 file for ten operations and a 3.1 webhook file in a public GitHub repository, last synced 5 October 2026
- llms.txt indexes for every docs section and a Markdown copy of each page, with a robots.txt signal that allows AI input
- Socure Launch publishes four solutions at $0.80 to $1.30 per evaluation, with a free sandbox and $1,000 of monthly production credits
Weaknesses
- No service agreement or API terms are published. The only terms pages are website terms of use and end-user terms for document capture
- Each API key reaches every workflow, with no scopes or read-only keys, and an additional key has to be requested from Support
- The rate limit page advises idempotency keys, but neither the docs nor the OpenAPI file define an idempotency header
Price $0.80 / txAuth API keyx402 nohosted
Veriff
C 61.1/100Identity verification service from Veriff in Tallinn. It checks an identity document and a selfie, with liveness, database checks and PEP and sanctions screening. Sessions are created and read through the Public API v1, with results sent by webhook.
Verdict Per-verification prices are public from $0.80, with a 15-day trial of 50 sessions and no card. Each endpoint page is Markdown with an OpenAPI 3.0 fragment. There is no server SDK, MCP server or idempotency key, most calls need an HMAC signature, and the status page shows nine incidents between 20 July and 7 October 2026.
Choose it for A team that needs document and selfie verification with public per-verification prices and a trial, and that can run a webhook receiver and HMAC signing.
Strengths
- Public prices of $0.80, $1.39 and $1.89 a verification, with a 15-day trial of up to 50 sessions and no card
- llms.txt index and Markdown pages, each API endpoint with an OpenAPI 3.0.0 fragment, examples and error schemas
- Up to five shared secret keys per integration, shown once, with documented rotation and deletion
Weaknesses
- No server-side SDK and no MCP server. Official packages cover only browser and mobile capture
- No idempotency key on POST /v1/sessions, and no Retry-After or backoff guidance for the documented 429
- Nine status-page incidents between 20 July and 7 October 2026, mostly delayed decisions in the US region
Price $0.80 / txAuth API keyx402 nolocal
Middesk
C 59/100Business verification API from Middesk in San Francisco. It checks US and international businesses against registry, tax ID, sanctions and watchlist records, monitors them for changes, and files liens and state tax registrations, over REST and a hosted MCP server.
Verdict A public OpenAPI 3.1 contract for 87 operations, llms.txt, Markdown docs and a dated weekly changelog make the REST API readable to an agent, and OAuth has a read-only scope. Access is sales-led. No price, self-serve signup or official SDK was found, and the hosted MCP server rejects sandbox keys.
Choose it for An agent onboarding or re-checking US businesses for a bank, lender or marketplace that already holds a Middesk contract, with registry, TIN, sanctions and lien data in one object.
Strengths
- Public OpenAPI 3.1 spec with 87 operations and 373 schemas, plus llms.txt and a Markdown copy of every docs page
- Dated changelog with nine entries between 20 July and 5 October 2026, breaking changes labelled as such
- OAuth 2.0 with
read_onlyandread_writescopes and a revoke endpoint. The MCP server adds PKCE and dynamic client registration
Weaknesses
- No public price. Fees are set in an order form, and every docs page ends with a prompt to contact sales
- No official SDK found on npm, PyPI or RubyGems, and none in the vendor's GitHub organisation
- The hosted MCP server runs against production only, so a sandbox key fails on every call
Price PaidAuth OAuth or keyx402 nohosted
Trulioo
C 58.2/100Trulioo verifies people and businesses against registry and bureau data, checks identity documents and screens watchlists. Agents reach it through REST APIs with OAuth client credentials or a hosted MCP server, which is in early access.
Verdict The hosted MCP server has OAuth 2.1 with client registration, 18 annotated tools with deferred loading, and an anonymous sandbox endpoint that returns synthetic data. Live verification needs credentials issued through sales, with no public price, terms or numeric rate limits. The MCP server is in early access and the status page requires a login.
Choose it for An agent doing business due diligence (search, verification, ownership, reports) or person checks across many countries for a company that already has a Trulioo contract, and for teams that want to test verification flows against synthetic data first.
Strengths
- Hosted MCP server at mcp.trulioo.com/mcp with OAuth 2.1, PKCE and dynamic client registration, so no key is copied into the client
- An anonymous mock endpoint and an unbilled sandbox mode return synthetic results without Trulioo credentials
- All 18 listed tools carry read-only, destructive and idempotent annotations, with 35 more loaded on demand
Weaknesses
- No public prices, terms of service or SLA. Live credentials come from Trulioo's sales and support teams
- status.trulioo.com requires an account requested from support, so incident history isn't public
- No rate limits with numbers on either surface, and an account over its limit gets a 409
Price PaidAuth OAuthx402 nohosted
Shufti
C 57.8/100Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.
Verdict One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.
Choose it for A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.
Strengths
- Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page
- Hosted MCP server at
https://ai.shuftipro.com/mcpwith 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call - Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages
Weaknesses
- No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections
- The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call
- No idempotency key, Retry-After header or backoff guidance was found for the documented 429
Price $1.50 / txAuth OAuth or keyx402 nohosted
Jumio
C 55/100Identity verification service from Jumio Corporation in Sunnyvale. It checks identity documents and selfies with liveness, screens against sanctions and PEP lists, and runs government database checks. Transactions are started and read through regional REST APIs with OAuth2.
Verdict Five OpenAPI 3.0 files, an llms.txt index and OAuth2 clients limited to initiating or to retrieving and deleting make the API readable and containable. Access starts with an account manager, with no public price, trial or service agreement, and the status page shows four processing degradations and a 35-minute Singapore outage between 14 August and 2 October 2026.
Choose it for An enterprise with a Jumio contract that wants document, selfie and liveness checks, watchlist screening and Latin American, Thai and Australian database checks behind OpenAPI-described endpoints.
Strengths
- Five downloadable OpenAPI 3.0 files covering 25 operations, plus llms.txt and a 2.2 MB llms-full.txt of the docs in Markdown
- OAuth2 client credentials with 60-minute bearer tokens. Each client is limited to initiate, to retrieve and delete, or both, and can be deactivated
- Rate limits are published per tenant. Token requests 10 a second, new transactions 1 a second, retrievals 15 a second
Weaknesses
- No public price, free tier or trial. OAuth2 and workflow keys are activated by a Jumio account manager
- No service agreement or DPA is published. The public terms of use cover end users in the United States
- Four processing degradations and a 35-minute Singapore outage on the status page between 14 August and 2 October 2026
Price PaidAuth OAuthx402 nolocal
Head to head
- Didit vs Persona BB 75 vs B 69.5
- Didit vs Sumsub BB 75 vs B 68.5
- ComplyCube vs Didit B 63.7 vs BB 75
- Didit vs Socure RiskOS BB 75 vs B 63.5
- Persona vs Sumsub B 69.5 vs B 68.5
- ComplyCube vs Persona B 63.7 vs B 69.5
- Persona vs Socure RiskOS B 69.5 vs B 63.5
- ComplyCube vs Sumsub B 63.7 vs B 68.5
- Socure RiskOS vs Sumsub B 63.5 vs B 68.5
- ComplyCube vs Socure RiskOS B 63.7 vs B 63.5
Questions
What are the highest-rated identity and business verification APIs for AI agents?
Didit has the highest benchmark score of the 11 ranked identity and business verification APIs, 75 (BB). Persona is second with 69.5 (B).
How many identity and business verification APIs are agent-ready?
1 of the 11 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.
Which identity and business verification APIs accept x402 payments?
None of the ranked listings here accepts x402 for its main call yet.
How is this list ranked?
By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 9 October 2026.
How this list is made
The order is the Anchor benchmark score, the same number as on each listing and in the top list. Each listing is graded from public evidence against the benchmark checklist, and the picks above are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.
Full ranked table · 55 head-to-head comparisons · Best tools in every category