Sessions and states

A session is one verification of one applicant. You create it, the applicant completes it, a reviewer decides, and you are told.

Statuses

Status	Meaning
`created`	The link exists and has not been opened yet
`in_progress`	The applicant started the flow
`submitted`	The applicant sent everything; waiting for a reviewer
`in_review`	A reviewer has claimed it
`approved`	Final decision: approved
`rejected`	Final decision: rejected, with reason codes
`resubmission_requested`	The reviewer asked for specific items again; the same link works again
`expired`	Not completed in time (links last 7 days)
`cancelled`	You cancelled it before it was submitted

approved and rejected are final decisions. A lead reviewer can still change a decision within 72 hours; you get a session.decision_changed webhook when that happens.

Resubmissions

When something is wrong but fixable (a blurry photo, an old proof of address), the reviewer asks for the specific items. The status becomes resubmission_requested, the applicant is told what to redo, and the session returns to submitted after the new upload. The number of rounds is limited per flow.

What you get back

GET /api/v1/sessions/{id} returns the status, decision, reason_codes, the result according to the flow's result detail, names of the automatic check flags, the timeline, and media_purge_at, the date the photos and videos are deleted. Media is never part of the API or the webhooks; owners, admins and members see it in the dashboard until the purge date, and every view is audited.

Billing

A live session counts once, when it reaches its first final decision. Test sessions, expired, cancelled and abandoned sessions, resubmission requests and re-decisions do not count.

Expiry and cleanup

Links expire after 7 days; applicants who have not started get reminders at 24 and 72 hours (invites only).
Media of abandoned sessions is purged after 72 hours.
Test sessions are deleted 24 hours after their last activity.
To erase a verification now (data-subject request) use the dashboard or DELETE /api/v1/sessions/{id}; you get a session.erased webhook with no personal data.