# Start a verification

> Create a check from your signup or ticketing system, send the guest to their phone, and take the result from a signed webhook.

Canonical page: https://venuego.co.uk/docs

VenueGo reads a passport or driving licence in the camera. It does not look up DVLA, the passport office, or any other government database, and it does not read a passport chip. Documents in scope are UK, Irish and US passports (photo page) and driving licences (front and back).

The API base URL is `https://verify.venuego.co.uk/api/v1`. The same API is served on `verify.venueora.com`. Call it from your server. Never put an API key in a browser or app.

## How a check moves

1. Your server creates a session with your own `sessionId`. The response includes a `url`.
2. You send the guest to that URL. On a desktop they see a QR code and continue on their phone. The check takes about two minutes: face capture, the document, then a photo holding it.
3. VenueGo posts a signed webhook as the status changes. The same body is available from `GET /verification-sessions/:sessionId`.
4. A clear result is `approved` or `declined`. Anything uncertain is `needs_review` until your team, or VenueOra, decides.

A session stays open for 24 hours and allows 3 attempts. Repeating the same `sessionId` while it is still open returns that session. Once it has finished, that id returns `409` and `session_closed`, and you need a new `sessionId`.

## Create one

```bash
curl https://verify.venuego.co.uk/api/v1/verification-sessions \
  -H "Authorization: Bearer $VERIFYME_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sessionId": "order_8412",
    "minimumAge": 18,
    "webhookUrl": "https://example.com/webhooks/venuego",
    "successUrl": "https://example.com/checkout/verified",
    "failureUrl": "https://example.com/checkout/not-verified",
    "metadata": { "customerId": "cus_1043", "ticketType": "VIP" }
  }'
```

A new session returns `201` and `"created": true`. Repeating the same `sessionId` returns `200` and `"created": false` with the current payload.

```js
const res = await fetch("https://verify.venuego.co.uk/api/v1/verification-sessions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.VERIFYME_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    sessionId: order.id,
    minimumAge: 18,
    successUrl: `https://example.com/orders/${order.id}/verified`,
    failureUrl: `https://example.com/orders/${order.id}/not-verified`,
    metadata: { customerId: order.customerId },
  }),
});
const session = await res.json();
// Send the guest to session.url. Do not trust a later browser redirect on its own.
```

## What to build next

- [Add to your app](https://venuego.co.uk/docs/implement/agent.md) if a coding agent is wiring this into an existing signup or checkout.
- [Authentication](https://venuego.co.uk/docs/authentication/agent.md) for API keys.
- [Sessions](https://venuego.co.uk/docs/sessions/agent.md) for every field, idempotency, and cancel.
- [Webhooks](https://venuego.co.uk/docs/webhooks/agent.md) for the signature and retries.
- [Results](https://venuego.co.uk/docs/results/agent.md) for status, identity, and reason codes.

<p class="notice">Confirm the outcome from the webhook or a GET. <code>successUrl</code> and <code>failureUrl</code> are conveniences for the guest's browser. They can be opened by anyone who has the link.</p>