WatchEye
Browse guides
View as Markdown

ID Checks

Identification (ID) checks verify identity documents and related records against the Document Verification Service (DVS) and non-DVS providers. Unlike screening checks, ID checks run synchronously - launch endpoints return 200 OK with the full completed check payload inline. There is no status field to poll.

Consent

Identification checks verify personal information against trusted sources, including the document issuer (DVS), superannuation and employment records, and other reliable sources. Australian privacy and AML/CTF obligations require that this only happens with the express, demonstrable consent of the individual being verified.

When you launch an ID check via the API, your system - not WatchEye - is the system that interacts with the end user. WatchEye therefore cannot collect or display consent on your behalf. Instead, every launch request must include "consent_obtained": true, which is your assertion that:

  1. You have presented consent wording to the individual being verified before submitting the check.
  2. The individual has accepted that wording.
  3. You have retained the exact wording shown, together with the time and identity of the individual, in your own system as evidence that consent was obtained.
  4. You can produce that record on request for audit and compliance purposes.

WatchEye records the launch with a generic consent attestation against the resulting check (visible on the portal and in the certificate PDF) noting that consent was obtained before the check was launched via the API and that the exact wording is retained by the account holder. The authoritative record of the wording shown to the individual lives in your system.

Your obligations vary by check type

consent_obtained: true is a single boolean on the wire, but the obligation it represents is substantial. The wording you must show and the records you must keep depend on which checks you run, on whom, and under which regulatory regime. You - not WatchEye - are the consent collector, the record-keeper, and the party accountable to regulators and to the data providers behind each check if the consent you obtained is ever audited.

The specific consent your integration needs depends on:

  • The check types you run. DVS checks (drivers_licence, passport, medicare, visa, asic_msic, aec, centrelink, immicard, citizenship_certificate, birth_certificate, death_certificate, marriage_certificate, name_change_certificate, registration_by_descent) are governed by the DVS Agreement your account holds with the Australian Government. That agreement prescribes specific disclosure and record-keeping requirements - your consent wording must align with it. Non-DVS checks (globaldata, asic_id_check, payroll_super) reach different data sources, each with their own provider-imposed consent requirements that you should review independently.
  • Your regulatory regime and jurisdiction. The Australian Privacy Principles, the AML/CTF Act and Rules, and any sector-specific obligations (AFSL or ACL holders, real estate agents under tranche 2 reforms, accountants, conveyancers, and so on) impose additional disclosure, record-keeping and consent-withdrawal requirements that go well beyond the API boolean.
  • Who is being verified and why. A primary customer verified for onboarding has different consent requirements from a beneficial owner verified against a customer's information, from an employee verified for payroll purposes, or from a deceased individual verified against a death certificate. Multi-purpose use of the verified data generally requires broader, more specific consent than a single-purpose check.
  • Your business case. If verification feeds into broader AML monitoring, employment decisioning, fraud-risk scoring or any other downstream use, the consent must disclose those uses up front - consent obtained for one purpose does not implicitly extend to another.

If you have any doubt about what wording or records your specific use case requires, consult your DVS Agreement, your other data-provider agreements, and your own legal counsel before going live.

Illustrative wording

The following text is provided as a starting point only. It is broadly suitable for a simple flow that runs DVS-based identity checks against an individual who is themselves the data subject, for identity verification, KYC and AML/CTF purposes. Using it verbatim does not, on its own, discharge your obligations under the DVS Agreement, the Privacy Act, the AML/CTF Act, or any other regime that applies to your business.

Review it against the check types you actually intend to run, your DVS Agreement, your other data-provider agreements, and your jurisdiction's privacy and AML obligations, and adapt or extend it accordingly before deploying it.

This identity verification check requires your consent and can only proceed with your express permission. By providing your consent, you authorise our organisation and our identity verification provider to access and verify the personal information you have supplied against trusted sources, including the document issuer (DVS), superannuation and employment records, and other reliable sources. This information will be used for identity verification, KYC, AML and CTF purposes, in compliance with relevant laws and regulations.

If you intend to run non-DVS checks, or to verify individuals who are not themselves your primary customer, extend the wording to name the additional data sources (for example Global Data identity verification, ASIC ID search, payroll and superannuation records) and any additional purposes or recipient categories your business case requires.

Whatever you settle on, store the exact text you showed, not just a flag - regulators and DVS auditors examine the wording, not the boolean.

Submitting consent_obtained

consent_obtained is a required boolean on every ID check launch and must be true. A request with consent_obtained: false (or omitted) is rejected with 400. Sending true without having obtained, recorded and retained consent that meets the obligations described above is a breach of the API terms and may also breach your DVS Agreement and other data-provider agreements.

Entity-bound vs adhoc

  • GET/POST /v1/id-checks and POST /v1/entities/{uuid}/id-checks - checks tied to a saved entity (include program and entity on list/show).
  • GET/POST /v1/adhoc-id-checks - quick checks with no entity record (include user or api_key attribution instead).

PDF certificates

Completed checks (outcome not pending) can be downloaded as verification certificate PDFs via GET /v1/id-checks/{uuid}/pdf and GET /v1/adhoc-id-checks/{uuid}/pdf.

Supported id_type values

All single-type checks are supported: DVS types (drivers_licence, passport, medicare, visa, birth_certificate, centrelink, immicard, aec, asic_msic, citizenship_certificate, death_certificate, marriage_certificate, name_change_certificate, registration_by_descent) and non-DVS types (globaldata, asic_id_check, nz_drivers_licence, nz_passport, payroll_super). MultiCheck (multiple ID types in a single launch) is not available via the API in v1.

Common fields and formats

The subsections below list the fields you submit inside the launch request's data object. The following conventions apply across all id types:

  • Names (first_name, middle_name, last_name, full_name): up to 50 characters by default (80 for Centrelink full_name, 100 for ASIC/MSIC full_name). Letters, spaces, apostrophes, hyphens and full stops only.
  • birth_date: YYYY-MM-DD.
  • state: one of ACT, NSW, NT, QLD, SA, TAS, VIC, WA. Lowercase values are accepted and uppercased automatically.
  • Other date fields (card_expiry, acquisition_date, event_date, registration_date): supply in YYYY-MM-DD format. Some fields such as Medicare and ASIC/MSIC card_expiry accept month-only values; submit those as YYYY-MM.
  • For checks that match against an entity, the birth_date you send must equal the entity's stored date of birth - otherwise the request is rejected.

For deeper background on each check (verification rules, supported document variants, sample images), follow the Portal documentation link in each subsection (portal login required).

aec

AEC (Australian Electoral Commission) enrolment verification (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes First name as recorded on the enrolment.
middle_name string No If recorded on the enrolment.
last_name string Yes
birth_date date YYYY-MM-DD Yes
street_address string Yes Up to 255 characters, single line.
suburb string Yes Up to 100 characters, single line.
postcode string Yes 4 digits.
state string Yes AU state/territory code.

Requires the AEC feature on the calling account.

asic_msic

ASIC or MSIC photo identification card (DVS). Portal documentation (login required).

Field Type Required Notes
full_name string Yes Up to 100 characters.
birth_date date YYYY-MM-DD Yes
card_number string Yes 6-20 alphanumeric characters.
card_expiry date YYYY-MM Yes Month and year only.
card_type string Yes ASIC or MSIC.

birth_certificate

Australian birth certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Conditional Provide at least a first or last name.
middle_name string No Requires first_name if supplied.
last_name string Conditional Provide at least a first or last name.
birth_date date YYYY-MM-DD Yes
certificate_number string Conditional Provide one of certificate_number, registration_number or registration_date. 4-32 characters (A-Z, digits, -).
registration_number string Conditional Same character rules as certificate_number.
registration_date date YYYY-MM-DD Conditional
state string Yes State of issue.

centrelink

Centrelink concession or healthcare card (DVS). Portal documentation (login required).

Field Type Required Notes
full_name string Yes Up to 80 characters.
birth_date date YYYY-MM-DD Yes
crn string Yes 9 digits followed by 1 letter (hyphens optional).
card_expiry date YYYY-MM-DD Yes
card_type string Yes HCC (Health Care), PCC (Pensioner Concession) or SHC (Senior Health Care).

citizenship_certificate

Australian citizenship certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string No Required if middle_name is supplied.
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
acquisition_date date YYYY-MM-DD Yes Date citizenship was acquired.
stock_number string Yes 4-32 characters. Letters, digits, / and -.

death_certificate

Australian death certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Conditional Provide at least a first or last name.
middle_name string No Requires first_name if supplied.
last_name string Conditional Provide at least a first or last name.
event_date date YYYY-MM-DD Yes Date of death.
certificate_number string Conditional Provide one of certificate_number, registration_number or registration_date. 4-32 characters (A-Z, digits, -).
registration_number string Conditional Same character rules as certificate_number.
registration_date date YYYY-MM-DD Conditional
state string Yes State of registration.

This check does not use birth_date; the deceased's date of death (event_date) is the relevant date.

drivers_licence

Australian driver's licence (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Conditional Provide at least a first or last name. Required if middle_name is supplied.
middle_name string No
last_name string Conditional Provide at least a first or last name.
birth_date date YYYY-MM-DD Yes
licence_number string Yes 6-16 characters. Letters, digits, -.
card_number string Yes 6-16 characters. Letters, digits, -.
state string Yes State of issue.

immicard

Department of Home Affairs ImmiCard (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string No Required if middle_name is supplied.
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
card_number string Yes 3 letters followed by 6 digits (for example ABC123456).

marriage_certificate

Australian marriage certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name1 string Conditional First spouse - provide at least a first or last name.
middle_name1 string No
last_name1 string Conditional First spouse - provide at least a first or last name.
first_name2 string Conditional Second spouse - provide at least a first or last name.
middle_name2 string No
last_name2 string Conditional Second spouse - provide at least a first or last name.
event_date date YYYY-MM-DD Yes Date of marriage.
certificate_number string Conditional Provide one of certificate_number, registration_number or registration_date. 4-32 characters (A-Z, digits, -).
registration_number string Conditional Same character rules as certificate_number.
registration_date date YYYY-MM-DD Conditional
state string Yes State of registration.

This check does not use birth_date. The two-party fields are suffixed 1 and 2.

medicare

Medicare card (DVS). Portal documentation (login required).

Field Type Required Notes
card_type string Yes G (Green), B (Blue) or Y (Yellow).
individual_ref_number integer Yes 1-9 (the IRN printed beside the cardholder's name).
full_name string Yes As printed on the card.
birth_date date YYYY-MM-DD Yes
medicare_number string Yes 10 digits, optional spaces.
card_expiry date YYYY-MM Yes Use YYYY-MM-DD for Blue and Yellow cards which carry a full expiry date.

name_change_certificate

Australian change-of-name certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Conditional Provide at least a first or last name.
middle_name string No Requires first_name if supplied.
last_name string Conditional Provide at least a first or last name.
birth_date date YYYY-MM-DD Yes
certificate_number string Conditional Provide one of certificate_number, registration_number or registration_date. 4-32 characters (A-Z, digits, -).
registration_number string Conditional Same character rules as certificate_number.
registration_date date YYYY-MM-DD Conditional
state string Yes State of registration.

passport

Australian passport (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string No Required if middle_name is supplied.
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
gender string No M, F or X.
passport_number string Yes 1-2 letters followed by 7 digits (for example PA1234567).

registration_by_descent

Australian Registration by Descent certificate (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string No Required if middle_name is supplied.
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
acquisition_date date YYYY-MM-DD Yes Date the citizenship by descent was acquired.
stock_number string Yes 4-32 characters. Letters, digits, / and -.

visa

Foreign passport / visa entry (DVS). Portal documentation (login required).

Field Type Required Notes
first_name string No Required if middle_name is supplied.
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
passport_number string Yes 6-9 alphanumeric characters.

asic_id_check

ASIC ID search against the ASIC database (non-DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes

globaldata

Global Data identity verification against multiple reliable data sources (non-DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
street_address string No Optional. If any address field is supplied, all four of street_address, suburb, postcode and state are required.
suburb string No See street_address.
postcode string No 4 digits. See street_address.
state string No AU state/territory code. See street_address.
phone_number string No 10-digit Australian phone number starting with 0.
email_address string No Valid email address.

nz_drivers_licence

NZ Drivers Licence verification against the New Zealand NZTA Driver Licence database (non-DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
licence_number string Yes 2 letters followed by 6 digits (e.g. DB123456). Lowercase values are accepted and uppercased automatically. The number must have a valid check digit.
licence_version string Yes The 3-digit version number from the front of the licence (e.g. 001).

nz_passport

NZ Passport verification against the New Zealand Department of Internal Affairs (DIA) Passport database (non-DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
passport_number string Yes 2 letters followed by 6 digits (e.g. LA123456); 1 letter followed by 7 digits is also accepted. Lowercase values are accepted and uppercased automatically.
expiry_date date YYYY-MM-DD Yes The passport expiry date.

payroll_super

Payroll and superannuation match (non-DVS). Portal documentation (login required).

Field Type Required Notes
first_name string Yes
middle_name string No
last_name string Yes
birth_date date YYYY-MM-DD Yes
street_address string No Optional. If any address field is supplied, all four of street_address, suburb, postcode and state are required.
suburb string No See street_address.
postcode string No 4 digits. See street_address.
state string No AU state/territory code. See street_address.
phone_number string No 10-digit Australian phone number starting with 0.
email_address string No Valid email address.
employer_abn string No 11 digits.
Previous Monitor Configuration Next IDPass