PRODUCT

API

Integrate KYB with the Detelio API

Trigger onboarding checks, route decisions, and subscribe to monitoring events, with audit-ready logs.

Book a demo View quickstart

Webhook events • Retry-safe delivery • Audit-ready case files

Quickstart

01

Create an API key

Generate a key per environment and scope it to what you need.

02

Create a case

Send company inputs and requested checks to start the workflow.

03

Subscribe to webhooks

Receive decision and monitoring events automatically.

04

Fetch the case file

Pull a structured record for review, export, or storage.

Go from API key to review-ready case file in minutes.

Authentication and scopes

Secure access with scoped API keys and signed webhook events

Use Bearer auth: Send keys via the Authorization header.

Least privilege: Scope keys to required capabilities only.

Rotation-ready: Treat keys as replaceable, not precious.

Verify every event: Validate signature before processing.

Dedupe by event_id: Assume “at least once” delivery.

Retry-safe handlers: Idempotent processing prevents duplicates.

Sandbox vs production: Separate keys per environment.

Scope by workflow: Create, read, export, monitoring, admin.

Audit-friendly access: Limit who can create high-privilege keys.

Core resources

Detelio API

Core API resources

The objects you’ll use most to run KYB checks, route outcomes, and track change history.

Get started

*Request a demo of our API.

Cases

One workflow container for inputs, results, decisions, and history.

Companies

Entity profiles with identifiers, registry references, and risk context.

People & UBOs

Relationship-aware records for beneficial ownership and key roles.

Documents

Evidence uploads, verification artifacts, and export packages.

Decisions

Route outcomes (approve, restrict, escalate) with rationale fields.

Events

Append-only event stream for updates, webhooks, and audit traces.

Webhook events

Webhooks that fit your workflow

Subscribe to lifecycle events and process updates in near real time

Event stream, not polling

Receive decisions, monitoring triggers, and export-ready signals via signed events.

At-least-once delivery

Use event_id to dedupe and make handlers idempotent.

Retry-safe processing

Backoff-friendly, queue-friendly event handling.

Signed payloads

Verify signatures before accepting events.

Reliability patterns

Build retry-safe workflows with idempotency, dedupe, and predictable backoff.

❗️Treat webhooks as at least once
Verify signature, dedupe by event_id, and keep handlers idempotent.

Jump to Webhooks →

Idempotency keys
‍Retry POST requests without double-creating cases.

429 handling
‍Back off and retry using Retry-After when present.

Timeouts and queues
‍Acknowledge fast, process async, requeue on failure.

Partial failures
‍Log errors per event, don’t block the whole pipeline.

Limits

LIMITS

Rate limits and pagination

Predictable limits and cursor pagination for reliable integrations

What to expect

Implementation notes

Rate limits

Varies by plan

Include limit headers (limit/remaining/reset) for visibility

429 responses

Too Many Requests

Return Retry-After so clients can back off safely

Idempotency

Supported for safe retries

Recommend an idempotency key for POST create-case

Pagination

Cursor-based

Prefer cursor pagination for stability as datasets change

Pagination fields

next_cursor, has_more

Client passes cursor to fetch the next page (avoid offset drift)

Filtering/sorting

Supported on list endpoints

Keep filters explicit and documented (country, status, updated_since, etc.)

API security

Trust & Security

Security built into every integration

Security overview

Encryption, access controls, and operational security practices in one place.

View security

Audit trail

Append-only event history, exports, retention, and evidence for reviews.

View audit trail

FAQs

API FAQ

Answers to common integration questions, without the long scroll

Do you provide webhooks for decisions and monitoring?

Yes. Subscribe to case updates, decision outcomes, monitoring triggers, and export-ready events via webhooks.

How do we avoid duplicate processing from webhooks?

Treat delivery as at least once. Dedupe by event_id and make handlers idempotent.

Can we separate sandbox and production?

Yes. Use separate API keys per environment and keep least-privilege scopes.

How do rate limits work?

Limits vary by plan. Handle 429 responses and respect Retry-After when provided.

What should we store for audits or reviews?

Store the case file and relevant event history. Exports can be used for evidence packages and review workflows.

Where should we start if we’re evaluating Detelio?

Start with Quickstart on this page, then review Security and Data Coverage to confirm fit.