Changelog

🌱 Add check metadata and extracted identity to Business Website Verifications: Business Website Verifications now expose two additional sets of data:

1. Check metadata — The business_website_backlink_detection check now includes backlink-count (number of root domains linking to the site) and backlink-threshold (configured minimum to pass) in its metadata object. These values are captured at check-run time and remain stable even after raw verification data expires.

2. Extracted identity — A new top-level extracted-identity attribute exposes the business names, addresses, phone numbers, and email addresses found on the website as clean, flat arrays. Each entry includes the extracted value and the source URL it was found on. This data was previously only accessible nested inside the identity_comparison check.

See the Retrieve a Verification endpoint for details.

📝 Clarification — malicious website detection signals are in reasons: The business_website_malicious_website_detection check surfaces its IPQS and Google Web Risk detection signals (e.g. malware, phishing, spam-source) in the reasons array rather than metadata. If you are looking for which threat types were detected, inspect checks[].reasons on this check.

• Create a Relay returns the relay-token, relay-secret, and session access token needed to redeem the claim.
• Generate a Relay claim returns the claim payload. It is authenticated with a Privacy Pass token (RFC 9577) and requires the Persona-Relay-Secret header.
• Create a Privacy Pass blind-signs a client-provided token (Blind RSA, RFC 9578) so it can be redeemed anonymously when generating a claim.

🍃 Stop backfilling extraction-responses into extraction-results: For API versions before 2021-08-18, the extraction-results attribute on Document responses was being synthetically computed from extraction-responses. This backwards-compatibility behavior has been removed. If you are on an API version before 2021-08-18 and rely on extraction-results, please use the extraction-responses attribute instead.

🍃 Remove non-GET Document endpoint documentation: The create, update, and submit endpoints for Documents have been removed from the API reference. These endpoints are deprecated in favor of Transactions. The GET endpoints (retrieve and list) remain available.

🍃 Add optional session tokens or one time links to Inquiry creation responses: The Inquiry create response can now return a session token or a one time link if you pass in certain flags. If you pass in auto-create-inquiry-session as true, the response includes a meta.session-token attribute. If you pass in auto-create-one-time-link as true, the response includes meta.one-time-link and meta.one-time-link-short attributes.

🍃 Inquiry creation iOS App Attestation improvement: Inquiry create requests now accept meta.ios_app_attest_team_id and meta.ios_app_attest_bundle_id to allow iOS App Attestation on multiple apps on a single Inquiry Template. The properties override the template level configs and accepts either credential or both as overrides.