Offsite Integration

In the offsite verification process Shufti’s merchants are solely responsible for managing data collection and providing it to Shufti to facilitate AML checks.

Parameters and Description

Parameters	Description
business_name	Required: Yes Type: string Max: 255 Characters This parameter receives the business name to run it against the AML list. Example: Shufti Pro Ltd
business_incorporation_date	Required: No Type: string Format: yyyy-mm-dd This parameter receives the incorporation date of the business to run it against the AML list. Example: 2016-01-01
biometric_search_image	Required: No Type: string Format: Base64 encoded JPG, JPEG, PNG Maximum: 5MB (decoded) A base64-encoded facial image of the business representative or subject being screened. Used for biometric matching against records across connected AML databases to improve the accuracy of match assessments.
ongoing	Required: No Accepted values: 0, 1 Default: 0 This Parameter is used for Ongoing AML Screening, and is allowed only on Production Accounts. If Shufti detects a change in AML statuses, then we will send you a webhook with event verification.status.changed. The new AML status can be checked using get status endpoint, or from the back-office.
ongoing_adverse_media	Required: No Accepted values: 0, 1 Default: 0 This parameter enables Ongoing Adverse Media Monitoring and is allowed only on Production Accounts. When set to 1, Shufti continuously monitors for changes in adverse media status and sends a webhook with event verification.status.changed when a change is detected. Note: This parameter only takes effect when adverse-media is included in the filters array.
filters	Required: No Type: Array Default: ["sanction", "warning", "fitness-probity", "pep", "pep-class-1", "pep-class-2", "pep-class-3", "pep-class-4", "adverse-media"] This key includes specific filter types, namely, alert or warning, that are linked to the AML search. Use these filters within the search to refine and narrow down the results.
match_score	Required: No Type: String match_score indicates the extent to which a search should accommodate variances between the search term and the terms being matched. A value of 0 signifies a loose match, while 100 indicates an exact match. Note: It ranges from 0-100. By default value is 100. Example: "100".
risk_score_engine_id	Required: No Type: string The ID of a custom risk-scoring engine to apply to the screening results. If none is provided, the default risk-scoring engine is applied. See Custom Risk Scoring Engine.
countries	Required: No Type: Array Array of countries based on which you want to filters reports. See Countries. Note: ISO 3166-1 alpha-2 country codes are supported. Example: ['CA','IN']
alias_search	Required: No Type: Boolean Alias search is used to specify whether user want to perform search within aliases or not. Note: The default value of alias_search is '0'. Example: "0".
rca_search	Required: No Type: Boolean RCA search is used to specify whether user want to perform search within rca or not. Note: The default value of rca_search is '0'. Example: "0".
unique_id	Required: No Type: string A unique identification number of the business, such as a company registry number, tax identification number, or business registration number, used to prioritise the most relevant records in the search results.
individual_face	Required: No Type: string Format: JPG, JPEG, PNG, PDF Maximum: 16MB A facial image of the individual being screened, submitted as a biometric input to match against records across connected AML databases and improve the accuracy of match assessments.
context	Required: No Type: string Additional information about the subject being screened, provided by the merchant to give the AI Compliance Agent richer context for a more accurate and targeted match assessment.

Request Payloads

Http

AML-for-businesses-service-sample-object

//POST / HTTP/1.1 basic auth
//Host: api.shuftipro.com
//Content-Type: application/json
//Authorization: Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw== 

{
    "aml_for_businesses": {
        "business_name": "ShuftiPro",
        "business_incorporation_date": "2016-01-01",
        "ongoing": "0",
        "alias_search": "0",
        "rca_search": "0",
        "unique_id": "",
        "individual_face": "",
        "context": "",
        "match_score": "100",
        "countries": [ "gb", "cy"],
        "filters": ["sanction", "warning", "fitness-probity", "pep", "pep-class-1", "pep-class-2", "pep-class-3", "pep-class-4"]
    }
}

Javascript

AML-for-businesses-service-sample-object

let payload = {
    reference         : `SP_REQUEST_${Math.random()}`,
    callback_url      : "https://yourdomain.com/profile/sp-notify-callback",
    redirect_url      : "https://yourdomain.com/site/sp-redirect",
    country           : "GB",
    language          : "EN",
    verification_mode : "any",
    ttl               :  60,
    aml_for_businesses: {
        business_name: "Shufti Pro Ltd",
        business_incorporation_date: "2016-01-01",
        ongoing: "0",
        alias_search: "0",
        rca_search: "0",
        unique_id        : "",
        individual_face  : "",
        context          : "",
        match_score: "100",
        countries: ["gb", "cy"],
        filters: ["sanction", "fitness-probity", "warning", "pep"]
    }
}

// BASIC AUTH TOKEN
// Use your Shufti account client id and secret key
var token = btoa("YOUR_CLIENT_ID:YOUR_SECRET_KEY"); // BASIC AUTH TOKEN
// if Access Token
// var token = "YOUR_ACCESS_TOKEN";

// Dispatch request via fetch API or with whatever else best suits you
fetch('https://api.shuftipro.com/', 
{
    method : 'post',
    headers : {
        'Accept'        : 'application/json',
        'Content-Type'  : 'application/json',
        'Authorization' : 'Basic ' + token       // if access token then replace "Basic" with "Bearer"
    },
    body: JSON.stringify(payload)
})
.then(function(response) {
     return response.json();
})

PHP

AML-for-businesses-service-sample-object

<?php
$url = 'https://api.shuftipro.com/';
$client_id = 'YOUR_CLIENT_ID';
$secret_key = 'YOUR_SECRET_KEY';

$payload = [
    'reference'         => 'SP_REQUEST_' . rand(),
    'callback_url'      => 'https://yourdomain.com/profile/sp-notify-callback',
    'redirect_url'      => 'https://yourdomain.com/site/sp-redirect',
    'country'           => 'GB',
    'language'          => 'EN',
    'verification_mode' => 'any',
    'ttl'               => 60,
    'aml_for_businesses' => [
        'business_name' => 'Shufti Pro Ltd',
        'business_incorporation_date' => '2016-01-01',
        'ongoing' => '0',
        'alias_search' => '0',
        'rca_search' => '0',
        'unique_id' => '',
        'individual_face' => '',
        'context' => '',
        'match_score' => "100",
        'countries' => ['gb', 'cy'],
        'filters' => ['sanction', 'fitness-probity', 'warning', 'pep']
    ]
];

$auth = $client_id . ':' . $secret_key;
$headers = ['Content-Type: application/json'];
$post_data = json_encode($payload);

$ch = curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_USERPWD, $auth);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);

$html_response = curl_exec($ch);
$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$headers = substr($html_response, 0, $header_size);
$body = substr($html_response, $header_size);
curl_close($ch);

$response_data = $body;
$decoded_response = json_decode($response_data, true);

return $decoded_response;

?>

Python

AML-for-businesses-service-sample-object

import requests, base64, json, hashlib
from random import randint

'''
Python 2
--------
import urllib2

Python 3
--------
import urllib.request
urllib.request.urlopen(url).read()
'''

url = 'https://api.shuftipro.com/'
client_id = 'YOUR_CLIENT_ID'
secret_key = 'YOUR_SECRET_KEY'

payload = {
    'reference': f'SP_REQUEST_{randint(1000, 9999)}',
    'callback_url': 'https://yourdomain.com/profile/sp-notify-callback',
    'redirect_url': 'https://yourdomain.com/site/sp-redirect',
    'country': 'GB',
    'language': 'EN',
    'verification_mode': 'any',
    'ttl': 60,
    'aml_for_businesses': {
        'business_name': 'Shufti Pro Ltd',
        'business_incorporation_date': '2016-01-01',
        'ongoing': '0',
        'alias_search': '0',
        'rca_search': '0',
        'unique_id': '',
        'individual_face': '',
        'context': '',
        'match_score': "100",
        'countries': ['gb', 'cy'],
        'filters': ['sanction', 'fitness-probity', 'warning', 'pep']
    }
}

auth = f'{client_id}:{secret_key}'
b64Val = auth.encode('ascii').hex()
headers = {
    'Content-Type': 'application/json',
    'Authorization': f'Basic {b64Val}'
}

response = requests.post(url, headers=headers, data=json.dumps(payload))

# Calculating signature for verification

# Clients registered with Shufti after March 15, 2023, must use secret key as follows
# secret_key = hashlib.sha256(secret_key.encode()).hexdigest()

calculated_signature = hashlib.sha256('{}{}'.format(response.content.decode(), secret_key).encode()).hexdigest()

sp_signature = response.headers.get('Signature', '')

json_response = response.json()

    if sp_signature == calculated_signature:
      return json_response

Ruby

AML-for-businesses-service-sample-object

require 'uri'
require 'net/http'
require 'base64'
require 'json'

url = URI("https://api.shuftipro.com/")
client_id = "YOUR_CLIENT_ID"
secret_key = "YOUR_SECRET_KEY"

payload = {
  "reference" => "SP_REQUEST_#{rand(1000..9999)}",
  "callback_url" => "https://yourdomain.com/profile/sp-notify-callback",
  "redirect_url" => "https://yourdomain.com/site/sp-redirect",
  "country" => "GB",
  "language" => "EN",
  "verification_mode" => "any",
  "ttl" => 60,
  "aml_for_businesses" => {
      "business_name" => "Shufti Pro Ltd",
      "business_incorporation_date" => "2016-01-01",
      "ongoing" => "0",
      "alias_search" => "0",
      "rca_search" => "0",
      "unique_id" => "",
      "individual_face" => "",
      "context" => "",
      "match_score" => "100",
      "countries" => ["gb", "cy"],
      "filters" => ["sanction", "fitness-probity", "warning", "pep"]
  }
}

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/json"
auth = Base64.strict_encode64("#{client_id}:#{secret_key}")
request["Authorization"] = "Basic #{auth}"
request.body = payload.to_json

response = http.request(request)

# Calculating signature for verification

# Clients registered with Shufti after March 15, 2023, must use secret key as follows
# secret_key = Digest::SHA256.hexdigest secret_key

calculated_signature = Digest::SHA256.hexdigest response.read_body + secret_key

sp_signature = response['Signature']

json_response = JSON.parse(response.read_body)

if sp_signature == calculated_signature
  return json_response
end

Java

AML-for-businesses-service-sample-object

import java.io.BufferedReader;
import java.io.DataOutputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

import javax.net.ssl.HttpsURLConnection;

public class Main {
    public static void main(String[] args) throws Exception {
        String url = "https://api.shuftipro.com/";
        String CLIENT_ID = "CLIENT_ID";
        String SECRET_KEY = "SECRET_KEY";
        URL obj = new URL(url);
        HttpsURLConnection con = (HttpsURLConnection) obj.openConnection();

        // Add request header
        con.setRequestMethod("POST");
        con.setRequestProperty("Content-Type", "application/json");
        String basicAuth = "Basic " + Base64.getEncoder().encodeToString((CLIENT_ID + ":" + SECRET_KEY).getBytes(StandardCharsets.UTF_8));    
        con.setRequestProperty("Authorization", basicAuth);

        String payload = "{\"aml_for_businesses\":{\"business_name\":\"Shufti Pro Ltd\",\"business_incorporation_date\":\"2016-01-01\",\"ongoing\":\"0\",\"alias_search\":\"0\",\"rca_search\":\"0\",\"match_score\":"100",\"countries\":[\"gb\",\"cy\"],\"filters\":[\"sanction\",\"fitness-probity\",\"warning\",\"pep\"]}}";

        // Send post request
        con.setDoOutput(true);
        DataOutputStream wr = new DataOutputStream(con.getOutputStream());
        wr.writeBytes(payload);
        wr.flush();
        wr.close();

        int responseCode = con.getResponseCode();
        System.out.println("\nSending 'POST' request to URL : " + url);
        System.out.println("Payload : " + payload);
        System.out.println("Response Code : " + responseCode);

        BufferedReader in = new BufferedReader(
                new InputStreamReader(con.getInputStream()));
        System.out.println(in.toString());
        String inputLine;
        StringBuffer response = new StringBuffer();

        while ((inputLine = in.readLine()) != null) {
            response.append(inputLine);
        }
        in.close();

        // Print the response
        System.out.println(response.toString());
    }
}

cURL

AML-for-businesses-service-sample-object

curl --location --request POST 'https://api.shuftipro.com' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw==' \
--data-raw '{
    "reference"    : "1234567",
    "callback_url" : "http://www.example.com/",
    "email"        : "[email protected]",
    "country"      : "GB",
    "language"     : "EN",
    "redirect_url": "http://www.example.com",
    "ttl"         : 60,
    "verification_mode" : "any",
    "aml_for_businesses": {
        "business_name": "Shufti Pro Ltd",
        "business_incorporation_date": "2016-01-01",
        "ongoing": "0",
        "alias_search": "0",
        "rca_search": "0",
        "unique_id": "",
        "individual_face": "",
        "context": "",
        "match_score": "100",
        "countries": ["gb", "cy"],
        "filters": ["sanction", "fitness-probity", "warning", "pep"]
    }
}'

C#

AML-for-businesses-service-sample-object

var client = new RestClient("https://api.shuftipro.com");
client.Timeout = -1;
var request = new RestRequest(Method.POST);
request.AddHeader("Content-Type", "application/json");
request.AddHeader("Authorization", "Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw==");
var body = @"{" + "\n" +
@"    ""reference""    : ""1234567""," + "\n" +
@"    ""callback_url"" : ""http://www.example.com/""," + "\n" +
@"    ""email""        : ""[email protected]""," + "\n" +
@"    ""country""      : ""GB""," + "\n" +
@"    ""language""     : ""EN""," + "\n" +
@"    ""redirect_url"": ""http://www.example.com""," + "\n" +
@"    ""ttl""         : 60," + "\n" +
@"    ""verification_mode"" : ""any""," + "\n" +
@"    ""aml_for_businesses"" : {" + "\n" +
@"        ""business_name""             : ""Shufti Pro Ltd""," + "\n" +
@"        ""business_incorporation_date"": ""2016-01-01""," + "\n" +
@"        ""ongoing""                   : ""0""," + "\n" +
@"        ""alias_search""              : ""0""," + "\n" +
@"        ""rca_search""                : ""0""," + "\n" +
@"        ""unique_id""      : """"," + "\n" +
@"        ""individual_face"": """"," + "\n" +
@"        ""context""        : """"," + "\n" +
@"        ""match_score""               : "100"," + "\n" +
@"        ""countries""             : [""gb"",""cy""]," + "\n" +
@"        ""filters""                   : [""sanction"",""fitness-probity"",""warning"",""pep""]" + "\n" +
@"    }" + "\n"
@"}";
request.AddParameter("application/json", body,  ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
Console.WriteLine(response.Content);

Go

AML-for-businesses-service-sample-object

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io/ioutil"
)

func main() {

  url := "https://api.shuftipro.com"
  method := "POST"

  payload := strings.NewReader(`{
    "reference"    : "1234567",
    "callback_url" : "http://www.example.com/",
    "email"        : "[email protected]",
    "country"      : "GB",
    "language"     : "EN",
    "redirect_url": "http://www.example.com",
    "ttl"         : 60,
    "verification_mode" : "any",
    "aml_for_businesses": {
        "business_name": "Shufti Pro Ltd",
        "business_incorporation_date": "2016-01-01",
        "ongoing": "0",
        "alias_search": "0",
        "rca_search": "0",
        "unique_id": "",
        "individual_face": "",
        "context": "",
        "match_score": "100",
        "countries": ["gb", "cy"],
        "filters": ["sanction", "fitness-probity", "warning", "pep"]
    }
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/json")
  req.Header.Add("Authorization", "Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw==")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := ioutil.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}