Oz API

Oz API is the most important component of the system – it connects all the other components together, and it is the unified REST interface you call to run Liveness and Biometry analyses. Oz API:

• provides the unified REST API interface to run the Liveness and Biometry analyses,

• processes authorization and user-permission management,

• tracks and records requested orders and analyses to the database (for example, in 6.0 the database size for 100 000 orders with analyses is ~4 GB),

• archives the inbound media files,

• collects telemetry from connected mobile apps,

• provides settings for specific device models,

• generates reports with analyses' results.

For the latest API methods collection, please refer to our API reference.

Persistent and non-persistent (Instant) modes

Oz API runs the same analyses in two modes that differ mostly in what is stored:

	Persistent (/api/folders/)	Non-persistent – Instant API (/api/instant/folders/)
What is stored	Creates a folder; media, analyses, results, and reports are stored and can be retrieved later	Nothing is stored – the result exists only in the HTTP response. However, you can set up S3 storage to save the Instant API artifacts.
Best for	Case history, the Web Console, reports, webhooks, re-analysis	Sensitive data, GDPR compliance, a minimal storage footprint

Instant API is part of Oz API, not a separate product: it exposes the same analyses through a non-persistent endpoint, and it supports both submission modes described below.

Single request and multi-request

You can submit your media and analyses in two ways, available in both the persistent and Instant modes:

• Single request – send all the media together with the analysis request in one call and receive the results in the same response. This removes the need for multiple API calls – one is sufficient. Introduced in API 6.0.

• Multi-request – create the folder, upload the media, assign the analyses, and then poll for the result or receive it via a webhook. Use this for larger media, deferred analysis, or operator review.

OzCapsula secure capture

For maximum protection of the captured media, the Oz SDKs can pack a capture into OzCapsula – a proprietary, encrypted, integrity-protected data container tied to a single capture session by a short-lived session_token. The container is an opaque blob: it is forwarded to the API as-is (with Content-Type: application/octet-stream) and validated server-side, which defends against injection, tampering, and replay of the captured data.

OzCapsula containers are currently submitted only via single request – on either POST /api/folders/ (persistent) or POST /api/instant/folders/ (Instant).

Authentication

Oz API calls are authorized with a token passed in the X-Forensic-Access-Token header. You obtain it by logging in with credentials or by using a long-lived service token for server-to-server integrations. Instant API can optionally be run without authorization.