ComplyAdvantage vs Plaid Identity Verification

ComplyAdvantage

The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person.

Plaid Identity Verification

Plaid Identity Verification has four typed endpoints in Plaid's public OpenAPI file, an idempotent create, a backend-only flow for data source checks and frequent changelog entries. Prices appear only after applying for Production, the secret has no scopes, and the rate-limit and error pages are disallowed to crawlers.

ComplyAdvantage

1. Exchange the access key and secret at POST /v3/token for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry
2. Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires
3. Create a screening configuration first and keep its configuration_identifier. Creating and screening a customer needs it
4. Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow
5. Read Ratelimit-Remaining and Ratelimit-Reset on every response. A 429 body is only API rate limit exceeded

Plaid Identity Verification

1. Pass is_idempotent: true to /identity_verification/create so a retry returns the existing session
2. Use the backend-only flow (data source template, gave_consent: true) when you already hold the user's details. Documents and selfies need the person in Link
3. Wait for the STATUS_UPDATED webhook or poll /identity_verification/get. Link's onSuccess doesn't mean the user passed
4. Don't issue retries casually. Each retry is a new session billed again
5. Enable Sandbox for Identity Verification on the Dashboard Products page before the first call