Session

One user's attempt at a verification flow, with its own URL, expiry, status, and result.

---

Overview

A session is a single user's attempt at a verification flow. Every verification you run - whether you started it from AdminX, the API, an OIDC/SAML redirect, or a webhook callback produces exactly one session.

What a session contains

Field	Description
sessionId	Globally unique identifier. Use it to fetch results or cancel.
url	The hosted verification URL. Hand this to the user any way you like.
journeyTag	The flow this session was created against.
status	pending → in_progress → terminal state. See the lifecycle below.
expiresAt	When the session will time out if no further activity occurs.
referenceData	The first name, last name, and DOB you supplied (optional, used for name/DOB comparison).
result	Populated once the session reaches a terminal state. See Verification result.

Lifecycle

A session moves through a small state machine. Most paths converge on success or failed; a few branch off when the user walks away or your retention policy kicks in.

Status meanings

• pending — Session created. URL is live but not yet opened.

• in_progress — User has opened the URL. Document or biometric capture may be in flight.

• success — All required checks passed. result contains extracted fields and scores.

• failed — A required check failed. result.failureReason tells you which one. Common reasons: document expired, face match below threshold, AAMVA mismatch, document type not allowed.

• review — Verdict is ambiguous and requires a human reviewer. Only produced if your tenant has the manual-review queue enabled.

• abandoned — Session expired or the user closed the tab before reaching a verdict.

• not_performed — A particular sub-check (e.g. AAMVA) couldn't run because the upstream system was unreachable. The session as a whole may still succeed depending on flow strictness.

Expiry

Two timers govern when a session ends. Both are configured on the flow.

Timer	Default (Configurable)	What it controls
From Session Creation	7 days	How long the URL is valid if the user never opens it.
From Session Start	60 minutes	How long the user has to complete, once they've opened the URL.

Once either timer elapses without a terminal state, the session moves to abandoned.