Offsite Integration

Offsite Verification means Shufti doesn't interact directly with the end-user. The merchant collects the account holder name and bank account details on its own platform and shares them with Shufti, which checks them against banking data sources in the destination country.

caution

Bank Account Verification is available for Offsite verification only. There is no end-user journey, document upload or redirect.

caution

Which check runs is decided by the fields you submit. On a country that supports both, leaving out the account holder name does not return a validation error — it runs the weaker IBAN Check, and an accepted result then means only that the IBAN is well formed. Send the account holder name whenever you intend to verify ownership, and check verification_mode in the response.

Parameters and Descriptions

Parameters	Description
reference	Required: Yes Type: string Minimum: 6 characters Maximum: 250 characters Each request is issued a unique reference ID which is sent back to Shufti's client with each response. This reference ID helps to verify the request. The client can use this ID to check the status of already performed verifications.
country	Required: Yes Type: string Length: 2 characters The country of the bank account. It decides which fields are required in the bank_account_verification object. Country code must be a valid ISO 3166-1 alpha-2 country code from the Supported Countries list.
email	Required: No Type: string Minimum: 6 characters Maximum: 128 characters This field represents the email of the end-user.
callback_url	Required: No Type: string Minimum: 6 characters Maximum: 250 characters A number of server-to-server calls are made to Shufti’s client to keep them updated about the verification status. Note: The callback domains must be registered within the Backoffice to avoid encountering a validation error. For registering callback domain, click here. e.g: example.com, test.example.com
bank_account_verification	Required: Yes Type: object Contains the bank account details to verify. The keys required inside this object depend on the country, and on which check you want to run. See Supported Countries and Choosing the Check.
account_holder_name	Required: Depends on country Type: string The name of the person or business that holds the account. It must not contain digits or the characters =, + and _. The maximum length depends on the country; accented and non-Latin characters each count as several characters towards it. Chile, Colombia, Ecuador, Saudi Arabia and the United Arab Emirates have no maximum. In Thailand the name is required but is not matched against the bank's record (see Validation Types).
given_name	Required: Depends on country Type: string The account holder's first name. Used instead of account_holder_name for the United States.
surname	Required: Depends on country Type: string The account holder's last name. Used instead of account_holder_name for the United States.
bic	Required: Depends on country Type: string Format: 8 or 11 characters The BIC (SWIFT) code of the account holder's bank.
clearing_system_id	Required: Depends on country Type: string The national bank code of the account's branch: ABA routing number (US, 9 digits), sort code (GB, 6 digits), IFSC code (IN, 11 characters) or BSB code (AU, 6 digits).
identification_type	Required: Depends on country Type: string The type of identification number provided in identification_value. For Saudi Arabia, use NATIONAL_ID when account.account_holder_type is PERSONAL, and UNIFIED_NUMBER or COMMERCIAL_REGISTRATION when it is BUSINESS.
identification_value	Required: Depends on country Type: string The account holder's identification number, such as the CPF / CNPJ (Brazil), VAT / NIP / REGON (Poland) or the national ID number (Saudi Arabia).
account	Required: Yes Type: object Contains the account identifiers listed below.
account.account_number	Required: Depends on country Type: string The bank account number, or the local equivalent such as the CLABE (Mexico, exactly 18 digits), CBU (Argentina), CCI (Peru), NUBAN (Nigeria) or card number (China).
account.iban	Required: Depends on country Type: string The account's IBAN, for countries that verify by IBAN. Submitting this field on its own, with no account holder name and no other account details, runs an IBAN Check instead of a BAV Check. The IBAN must begin with the two-letter code of the country in the request, have the exact length defined for that country, use upper-case letters and digits only, and contain no spaces. For example, send DE89370400440532013000, not de89 3704 0044 0532 0130 00. The check digits are validated.
account.account_holder_type	Required: Depends on country Type: string Accepted Values: PERSONAL, BUSINESS Whether the account belongs to an individual or a business. Required for Saudi Arabia.

caution

Send only the fields the country requires for the check you want to run. Any other key inside bank_account_verification is rejected with a validation error, for example: bank_name is not accepted for MX: this country supports bank account ownership verification only.

info

On a trial account, Bank Account Verification runs against Shufti's test data instead of the bank, and only the test values for the selected country are accepted.

Sample Request

Http

//POST / HTTP/1.1
//Host: api.shuftipro.com
//Content-Type: application/json
//Authorization: Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw==
{
    "reference"    : "1234567",
    "callback_url" : "http://www.example.com/",
    "email"        : "johndoe@example.com",
    "country"      : "MX",
    "bank_account_verification" : {
        "account_holder_name" : "John Doe",
        "account" : {
            "account_number" : "646180157000000004"
        }
    }
}

Javascript

let payload = {
    reference: `SP_REQUEST_${Math.random()}`,
    callback_url: "https://yourdomain.com/profile/sp-notify-callback",
    email: "johndoe@example.com",
    country: "MX",
};
payload['bank_account_verification'] = {
    account_holder_name: "John Doe",
    account: {
        account_number: "646180157000000004"
    }
};
var token = btoa("YOUR_CLIENT_ID:YOUR_SECRET_KEY");
fetch('https://api.shuftipro.com/', {
    method: 'post',
    headers: {
        'Accept': 'application/json',
        'Content-Type': 'application/json',
        'Authorization': 'Basic ' + token
    },
    body: JSON.stringify(payload)
}).then(function(response) {
    return response.json();
}).then(function(data) {
    return data;
});

PHP

<?php
$url = 'https://api.shuftipro.com/';
$client_id  = 'YOUR-CLIENT-ID';
$secret_key = 'YOUR-SECRET-KEY';
$verification_request = [
    "reference"    => "ref-" . rand(4, 444) . rand(4, 444),
    "callback_url" => "https://yourdomain.com/profile/notifyCallback",
    "email"        => "johndoe@example.com",
    "country"      => "MX",
];

$verification_request['bank_account_verification'] = [
    "account_holder_name" => "John Doe",
    "account" => [
        "account_number" => "646180157000000004"
    ]
];

$auth = $client_id . ":" . $secret_key;
$headers = ['Content-Type: application/json'];
$post_data = json_encode($verification_request);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, $auth);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo $response;

Python

import base64, json, requests, random

url = 'https://api.shuftipro.com/'
client_id = 'YOUR-CLIENT-ID'
secret_key = 'YOUR-SECRET-KEY'

verification_request = {
    "reference": "ref-{}{}".format(random.randint(1000, 9999), random.randint(1000, 9999)),
    "callback_url": "https://yourdomain.com/profile/notifyCallback",
    "email": "johndoe@example.com",
    "country": "MX",
    "bank_account_verification": {
        "account_holder_name": "John Doe",
        "account": {
            "account_number": "646180157000000004"
        }
    }
}

auth = '{}:{}'.format(client_id, secret_key)
b64Val = base64.b64encode(auth.encode()).decode()
response = requests.post(url,
    headers={"Authorization": "Basic %s" % b64Val, "Content-Type": "application/json"},
    data=json.dumps(verification_request))
print(response.json())

Sample IBAN Check Request

The request above runs a BAV Check: it carries an account holder name, so the account holder is verified. To run an IBAN Check instead, send the IBAN on its own.

//POST / HTTP/1.1
//Host: api.shuftipro.com
//Content-Type: application/json
//Authorization: Basic NmI4NmIyNzNmZjM0ZmNlMTlkNmI4WJRTUxINTJHUw==
{
    "reference"    : "1234567",
    "callback_url" : "http://www.example.com/",
    "email"        : "johndoe@example.com",
    "country"      : "DE",
    "bank_account_verification" : {
        "account" : {
            "iban" : "DE89370400440532013000"
        }
    }
}

The response reports verification_mode as iban, returns iban_valid in place of the name match fields, and includes the bank behind the IBAN where the data source identifies it.

{
    "reference" : "1234567",
    "event"     : "verification.accepted",
    "country"   : "DE",
    "verification_data" : {
        "bank_account_verification" : {
            "verification_mode" : "iban",
            "iban_valid"        : 1,
            "currency"          : "EUR",
            "bank_name"         : "Commerzbank",
            "bic"               : "COBADEFFXXX",
            "account"           : {
                "iban" : "DE89370400440532013000"
            }
        }
    },
    "verification_result" : {
        "bank_account_verification" : {
            "account_verified" : 1
        }
    }
}

caution

account_verified is 1 here because the IBAN is correctly formed. It does not mean the account exists or that your customer holds it. Only an ownership check answers that.

Request Payloads by Country

Select a country to see the request payload with the fields it requires. A country that supports both checks shows a tab for each; a country that supports only one shows only that one.

AlbaniaAndorraArgentinaAustraliaAustriaAzerbaijanBahrainBangladeshBelarusBelgiumBosnia and HerzegovinaBrazilBulgariaBurundiChileChinaColombiaCosta RicaCroatiaCyprusCzech RepublicDenmarkDjiboutiDominican RepublicEast TimorEcuadorEgyptEl SalvadorEstoniaEthiopiaFaroe IslandsFinlandFranceGeorgiaGermanyGhanaGibraltarGreeceGreenlandGuatemalaHungaryIcelandIndiaIndonesiaIraqIrelandIsraelItalyJordanKazakhstanKuwaitLatviaLebanonLibyaLiechtensteinLithuaniaLuxembourgMacedoniaMalaysiaMaltaMauritaniaMauritiusMexicoMoldovaMonacoMontenegroNepalNetherlandsNigeriaNorwayPakistanPalestinian TerritoriesPeruPhilippinesPolandPortugalQatarRepublic of KosovoRomaniaRussian FederationSaint LuciaSan MarinoSao Tome and PrincipeSaudi ArabiaSerbiaSeychellesSlovakiaSloveniaSomaliaSouth AfricaSouth KoreaSpainSudanSwedenSwitzerlandTanzaniaThailandTunisiaTurkeyUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesUruguayVatican City StateVietnamVirgin Islands (British)Zambia

IBAN Check