مرجع الواجهة البرمجية

Authorization: Bearer lx_live_…

curl https://api.lumex.id/v1/verifications \
  -H "Authorization: Bearer lx_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6f1c2b7e-signup-1042" \
  -d '{
    "reference": "user_1042",
    "document": "any",
    "locale": "ar",
    "redirect_url": "https://your-site.com/verified"
  }'

{
  "id": "vrf_7KQ2M9",
  "reference": "user_1042",
  "status": "created",
  "url": "https://verify.lumex.id/v/…",
  "expires_at": "2026-10-09T08:00:00Z",
  "created_at": "2026-10-08T08:00:00Z"
}

curl https://api.lumex.id/v1/verifications/vrf_7KQ2M9 \
  -H "Authorization: Bearer lx_live_…"

{
  "id": "vrf_7KQ2M9",
  "reference": "user_1042",
  "status": "approved",
  "decline_reasons": [],
  "document": {
    "type": "id_card",
    "country": "KWT",
    "number": "287041501234",
    "surname": "ALSALEM",
    "given_names": "FAHAD",
    "nationality": "KWT",
    "birth_date": "1987-04-15",
    "sex": "M",
    "expiry_date": "2029-03-01"
  },
  "checks": {
    "code_lines": "passed",
    "expiry": "passed",
    "liveness": "passed",
    "face_match": { "result": "passed", "score": 0.97 }
  },
  "metadata": {},
  "created_at": "2026-10-08T08:00:00Z",
  "completed_at": "2026-10-08T08:01:04Z"
}

{
  "id": "evt_3HZ81L",
  "type": "verification.approved",
  "created_at": "2026-10-08T08:01:04Z",
  "data": { /* the verification object */ }
}

import crypto from "node:crypto";

export function verifyLumex(rawBody, header, secret) {
  const p = Object.fromEntries(header.split(",").map(x => x.split("=")));
  const t = Number(p.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(`${t}.${rawBody}`).digest("hex");
  if (!p.v1 || p.v1.length !== expected.length) return false;
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(p.v1));
}

function verify_lumex(string $raw, string $header, string $secret): bool {
  parse_str(str_replace(',', '&', $header), $p);
  if (empty($p['t']) || abs(time() - (int)$p['t']) > 300) return false;
  $expected = hash_hmac('sha256', $p['t'] . '.' . $raw, $secret);
  return hash_equals($expected, $p['v1'] ?? '');
}

{ "error": { "code": "invalid_field", "message": "redirect_url must start with https://" } }