Auth and identity API¶

Authentication endpoints¶

Method	Path	Access	Purpose
`GET`	`/auth/egovph/start`	Public	Return partner-code metadata and configuration status
`POST`	`/auth/egovph/callback`	Public	Exchange a one-time SSO code and create an eAkto session
`POST`	`/auth/everify/start`	Public	Create a consented, expiring sign-in challenge
`GET`	`/auth/everify/{challenge_id}`	Public	Read challenge status and public SDK configuration
`POST`	`/auth/everify/complete`	Public	Complete demographics plus Face Liveness sign-in
`POST`	`/auth/everify/qr/complete`	Public	Complete signed QR plus Face Liveness sign-in
`GET`	`/auth/session`	Authenticated	Return the current minimized profile and session
`POST`	`/auth/sign-out`	Authenticated	Invalidate the current eAkto session

Start eGovPH¶

curl http://localhost:8000/api/v1/auth/egovph/start

Safe response shape:

{
  "partner_code": "CONFIGURED_PARTNER_CODE",
  "configured": true
}

The partner secret is never included.

Complete eGovPH¶

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"exchange_code":"ONE_TIME_EXCHANGE_CODE"}' \
  http://localhost:8000/api/v1/auth/egovph/callback

Never place a real exchange code in committed examples or logs.

Start eVerify¶

curl -X POST \
  -H "Content-Type: application/json" \
  -d '{"consent":true}' \
  http://localhost:8000/api/v1/auth/everify/start

The response contains a challenge ID, expiry/status information, and the public Web SDK key when configured. It does not expose the eVerify client secret.

Identity assurance endpoints¶

Method	Path	Access	Purpose
`POST`	`/identity/liveness/session`	Authenticated	Start a purpose-bound liveness session
`GET`	`/identity/liveness/{assurance_id}`	Authenticated	Refresh liveness state
`POST`	`/identity/everify`	Authenticated	Verify an assurance after successful liveness
`GET`	`/identity/assurance`	Authenticated	Return current assurance status

Example liveness request:

{
  "consent": true,
  "purpose": "DOCUMENT_VAULT_ACCESS"
}

Session response¶

An authentication completion returns:

a raw eAkto session_token once;
expiry and assurance information; and
a minimized citizen profile.

Applications must store the token in platform-secure storage and must not print it.