Kenalyx
Sign in Request API access
ProductsPricingDocsSign in Request API access Talk to sales
Changelog

What's new

Customer-visible changes. Changes are additive — existing fields are not renamed.

New

Fraud signals, policies and governance controls

  • riskSignals on identity, account, NIK decoder, KTP OCR, KYC Verify and hosted checks: identity reuse across your users, velocity and blocklist hits.
  • Blocklist in the dashboard and at /v1/blocklist; POST /v1/risk/forget erases an identifier from the index.
  • Verification policies for KYC Verify and hosted links (options.policyId): minimum age, blocklist, reuse, velocity, document and capture rules. Policies only make decisions stricter.
  • Per-key IP allowlist and monthly spend limit with a usage.threshold webhook.
  • Workspace data retention (30 days to 5 years) and DELETE /v1/analyses/:id for erasure requests.
  • Hosted verification page in Bahasa Indonesia or English, with your display name, accent colour and support email.
New

New checks and platform features

  • NIK Decoder (POST /v1/identity/nik/decode) with an optional minAge age gate, and Name Match (POST /v1/name/match).
  • Document Check (POST /v1/ktp/authenticity) and Selfie with KTP (POST /v1/kyc/selfie-with-ktp).
  • Batch verification (POST /v1/batches) with JSON or CSV input and CSV results.
  • Signed webhooks with retries, configured per API key.
  • Hosted verification link (POST /v1/verification-sessions).
  • Reviews queue in the dashboard with notes, assignment and resolution.
  • Signed verification certificates (GET /v1/analyses/:id/certificate).
New

Document checks in KYC Verify

  • KYC Verify now includes document integrity and data-consistency checks.
  • Responses state which document checks were performed.
Security

Encrypted idempotency and dashboard session hardening

  • Stored retry results are encrypted and bound to the request body. Reusing a key with a different body returns 422 idempotency_key_reused.
  • A parallel retry with the same key returns 409 idempotency_request_in_progress, so it is never billed twice.
  • All API responses send Cache-Control: no-store.
Beta

Passive Liveness (beta)

  • POST /v1/liveness/passive adds presentation-attack detection from a single selfie.
New

KTP OCR and API key scopes

  • POST /v1/ktp/ocr extracts e-KTP fields with confidence and NIK consistency checks.
  • API keys now carry per-capability scopes; KTP data requires document:ocr.