A sandbox where you pick the outcome.

Authentication

One key, two environments

Every request carries your API key as a bearer token. The older x-api-key header is still accepted and will not be removed — existing integrations do not need to change.

curl -X POST https://verifia.anybanq.lk/v1/verifications/nic \
  -H "Authorization: Bearer divp_test_…" \
  -H "Content-Type: application/json" \
  -d '{
    "nicNumber": "199012340000",
    "fullName": "Nimal Perera",
    "consentGiven": true
  }'

Amounts are in minor units wherever a field says so, and every amount carries an explicit currency. Nothing is assumed to be LKR.

Sandbox

The last four digits choose the outcome

The scenario is keyed on the last four digits of an NIC or account number, not a magic prefix — a Sri Lankan NIC carries a birth year up front and an account number carries a branch, so a prefix scheme would force you to use structurally invalid identifiers. Punctuation and a trailing letter are ignored; only digits count. Anything that is not one of these codes succeeds, so your own realistic test data gives you a working flow.

A sandbox key works while your account is still onboarding or awaiting review, so you can build the integration before the paperwork is finished. It stops working only if the account is suspended.

Webhooks

Signed, retried, de-duplicable

Results are posted to your endpoint as JSON. A failed delivery is retried with exponential backoff — 10s, 30s, 2m, 10m, 30m, then 2h — for six attempts by default, after which it sits in the dead-letter list for you to replay from the dashboard.

POST https://your-app.lk/hooks/verifia
x-divp-event: verification.completed
x-divp-signature: sha256=<hex hmac of the raw body>
x-divp-delivery-id: 0f2c…
x-divp-attempt: 1

{
  "event": "verification.completed",
  "data": {
    "verificationId": "…",
    "type": "NIC",
    "status": "APPROVED",
    "outcome": "PASS",
    "score": 100
  },
  "sentAt": "2026-09-16T04:21:08.114Z"
}

const expected = crypto
  .createHmac("sha256", process.env.VERIFIA_WEBHOOK_SECRET)
  .update(rawBody)           // the exact bytes we sent, not a re-serialised object
  .digest("hex");

// Retries resend an identical body, so the signature never changes.
// Dedupe on x-divp-delivery-id.

Getting keys

Sandbox first, live after approval

1. 1

   Register

   Create the account at /register. We review it — you are told when sign-in opens.

2. 2

   Take the sandbox key

   A divp_test_ key comes back on the registration screen itself, before any review, so you can call the sandbox the same minute. It is shown once; we store only an Argon2id hash of it and cannot recover it for you. Lost it, or signed up earlier? Settings → API keys mints another.

3. 3

   Finish onboarding

   Business registration number, BR certificate, at least one director and a settlement account. Submitting runs a business (KYB) verification.

4. 4

   Request live access

   Once it is granted, live keys unlock. Ask for one before then and the API says so plainly: this account is not approved for live keys yet.

Keys can be scoped and revoked individually, and every live key can be revoked at once if you ever need to. Each key records when it was last used.