ComplyAdvantage vs Didit

ComplyAdvantage

The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person.

Didit

A self-serve verification API with public per-check prices, key registration by API, scoped keys and a 365-day audit log. The status page shows three incidents marked major between 22 July and 4 September 2026, each a partial outage of the core APIs, and the sub-processor list isn't public.

ComplyAdvantage

1. Exchange the access key and secret at POST /v3/token for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry
2. Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires
3. Create a screening configuration first and keep its configuration_identifier. Creating and screening a customer needs it
4. Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow
5. Read Ratelimit-Remaining and Ratelimit-Reset on every response. A 429 body is only API rate limit exceeded

Didit

1. Register with POST https://apx.didit.me/auth/v2/programmatic/register/, then verify-email with the emailed 6-character code. Use a real inbox, because reserved test domains return 500.
2. Send the key as x-api-key to https://verification.didit.me/v3/. The JWT from registration works only on apx.didit.me.
3. Create a workflow before POST /v3/session/. workflow_id is the only required field, and an unfinished session with the same vendor_data is returned again.
4. Read results from webhooks and use GET /v3/session/{sessionId}/decision/ for back-fill. Every per-feature result is a plural array.
5. The MCP server at https://mcp.didit.me/mcp takes OAuth sign-in only, never an API key. Approve didit:verification alone when the task doesn't change workflows or keys.