Didit

Return ALL organizations you can access with their applications nested, plus the default org/app when unambiguous — in ONE call (replaces didit_org_list + per-org didit_org_list_applications). Call this first to discover ids.

didit_context_get

Get application details (client_id etc.). The api_key is REDACTED — a masked preview + api_key_set flag are returned, never the raw secret.

didit_org_get_application

Get current credit balance and auto-refill settings. A `0.00` balance does NOT by itself block verifications, so never answer a "not enough credits" report with "top up" from this result alone: a workflow whose features are all free-tier (ID verification, passive liveness, face match 1:1, device/IP analysis — 500 free each per month) runs fine on a zero balance. Read the failing workflow with didit_workflow_list first — `is_white_label_enabled: true` adds $0.20/session AND drops the workflow out of the free tier entirely, which is the single most common cause. This result also carries `allow_free_usage` (false = the free tier is off for this organization) and `usage_summary.white_label_sessions`. Only a NEGATIVE balance stops free-tier work; zero does not.

didit_org_get_balance

List the organizations you belong to (each has an id to pass as organization_id to other tools). In hosted OAuth mode no arguments are needed.

didit_org_list

List API key metadata with raw key values redacted (pass application_id for an app's keys).

didit_org_list_api_keys

List the applications in an organization (each has an id to pass as application_id). In hosted OAuth mode pass only organization_id.

didit_org_list_applications

Create a custom questionnaire from an ordered list of questions. Send `title` + `form_elements` (an array of form-element objects, each with an UPPERCASE element_type) — NOT `questions`. The MCP assembles them into the questionnaire graph the backend stores (node ids and their ordering are derived here), so send the questions in the order the user should answer them and never build a graph yourself. Pass status:'draft' to keep it unpublished. A choice list longer than ~100 options does NOT fit in one call (the call is emitted token by token and gets cut off mid-JSON): create with status:'draft' carrying only the first ~100 choices, then add the rest with didit_questionnaire_append_choices in batches (its publish flag publishes with the final batch — a published questionnaire cannot be edited further).

didit_questionnaire_create

Get questionnaire questions and options. Translations are summarized to one locale by default to keep the response consumable; pass include_translations:true for every locale.

didit_questionnaire_get

List all custom questionnaires for your application.

didit_questionnaire_list

Overwrite a questionnaire's supplied settings. Sending form_elements REPLACES the entire question list, removing omitted questions; pass every question to keep, in order, with UPPERCASE element_type. Before calling, show the questionnaire and proposed changes and obtain explicit user confirmation, including the full replacement when form_elements is supplied.

didit_questionnaire_update

List export report references, processing statuses and dates; report contents and download links are not returned. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_report_list

Create a hosted verification link. The customer completes identity checks on Didit's hosted page. Returns only the link, session reference and status. Do not supply identity documents, biometric images, government identifiers or authentication secrets.

didit_session_create

Get a session's verification status and individual check statuses. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_session_get_decision

List verification session references and statuses for the selected application. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_session_list

List a session's review status changes and dates; reviewer notes are not returned. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_session_list_reviews

Search verification session references and statuses across authorized applications. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_session_search

Overwrite a session's decision by approving, declining or requesting resubmission; optionally send a notification email that cannot be recalled. Before calling, obtain explicit user confirmation of the session, new decision and any notification recipient. Returns the updated status. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_session_update_status

Search business record references, verification statuses and session counts. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_vendor_business_search

Search user record references, verification statuses and session counts. Personal-record results contain only record references, statuses, counts and dates needed to locate and review the requested records. Open the Didit console for detailed identity evidence, images, notes or report contents. Do not supply government identifiers or authentication secrets.

didit_vendor_user_search

Create a webhook destination. The signing secret is redacted in the response.

didit_webhook_create

Delete a webhook destination so it stops receiving events.

didit_webhook_delete

Get a single webhook destination with redacted signing-secret metadata.

didit_webhook_get

List configured webhook destinations. Each destination has its own URL, version, enabled flag, subscribed events, and redacted signing-secret metadata.

didit_webhook_list

Overwrite the supplied settings of an existing webhook destination. Changing its URL redirects future deliveries; disabling it stops deliveries, and subscribed_events replaces its event subscriptions. Before calling, show the destination UUID and each proposed field change and obtain explicit user confirmation.

didit_webhook_update

Create a SIMPLE (linear) verification workflow from an ordered list of features. Send `features` in execution order (uppercase values; put dependency features first, e.g. OCR before FACE_MATCH/NFC/DATABASE_VALIDATION). The MCP assembles them into a real workflow graph and publishes it; pass status:'draft' to keep it unpublished. A bad feature order fails validation and leaves a fixable draft. A workflow verifies EITHER a person (KYC) or a business (KYB), never both, and the type follows WHO is verified: KYB workflows use the KYB_* features (company paperwork belongs in KYB_DOCUMENTS or DOCUMENT_AI) and must not mix in person-only features (OCR/LIVENESS/FACE_MATCH/NFC/PROOF_OF_ADDRESS/DATABASE_VALIDATION/AGE_ESTIMATION); to verify the people behind a company, create a separate KYC workflow and link it from the KYB_KEY_PEOPLE node. For BRANCHING or conditional logic, use the graph tools instead: didit_workflow_get_field_definitions, then didit_workflow_validate_graph, then didit_workflow_set_graph.

didit_workflow_create

Create an editable DRAFT version from a published workflow (graph/config edits require a DRAFT). Returns the new draft's uuid.

didit_workflow_create_draft

MODIFY an existing workflow's graph with small OPERATIONS - the right tool for editing a live workflow. You send only the deltas; the MCP fetches the full current graph SERVER-SIDE, applies your ops in order, validates, auto-creates a DRAFT (the live version is never touched), and saves. This means huge feature configs (documents_allowed, poa_documents_allowed, phone countries) are preserved exactly and you NEVER resend them. Validation failures return `applied:false` with the errors (nothing saved). The six op shapes are documented on the `operations` parameter; a typical edit upserts new nodes with set_node and rewires their neighbors with set_next. To branch after a feature node, point its `next` at a new branch node whose `branches` carry the rules (from didit_workflow_get_field_definitions) and whose goto targets are new status or feature nodes.

didit_workflow_edit_graph

Get the full configuration of a specific workflow, including `response_attributes` (returned data / data minimization): which data points the client receives per feature.

didit_workflow_get

The exact `config` object each workflow feature accepts - every key, its type, bounds, default, accepted values and meaning. Generated from the backend serializers that validate a save (contract sha256:573441941664c9082d026b29949dbecc8006e6c47f7a7627c9eee848ec383caf), so it is never out of date with the API. Call it before configuring a feature you have not configured before, and whenever a config key you set came back missing: a key outside this contract is dropped silently. Pass `feature` for one feature (AGE_ESTIMATION, AML, BANK_VERIFICATION, DATABASE_VALIDATION, DOCUMENT_AI, EMAIL_VERIFICATION, FACE_MATCH, GEOLOCATION, IP_ANALYSIS, KYB_DOCUMENTS, KYB_KEY_PEOPLE, KYB_REGISTRY, LIVENESS, NFC, OCR, PHONE_VERIFICATION, PROOF_OF_ADDRESS, QUESTIONNAIRE), or omit it for all of them.

didit_workflow_get_feature_config_schema

List every field you can branch on plus the operators valid for each (e.g. kyc.status, kyc.extra_fields.profession with `fuzzy_match`, document_ai.<key>, aml.risk_score). Call this before building branch rules so the field/operator pairs are valid.

didit_workflow_get_field_definitions

Get the node/graph for a workflow (the structure: nodes, branches, conditions, Document-AI steps) + `status`/`version`/`is_editable`. Large feature configs (documents_allowed, poa_documents_allowed, phone countries) are SUMMARIZED by default so the response never overflows — set `include_config:true` for the raw config. Includes `returned_data` (response_attributes): the ONLY source of truth for what data the client/relying party receives in the API response and webhooks — never infer that from which features run. Also includes `age_assurance`: whether the workflow checks age, and by which method (document age restrictions and/or AGE_ESTIMATION) — decide that from this block, never from the workflow's name. Pass just `workflow_id`; the owning org/app is resolved automatically. To MODIFY the graph, prefer didit_workflow_edit_graph (small ops, no need to resend big configs).

didit_workflow_get_graph

List verification workflows. With multiple apps (or no scope) it auto-spans every app, each row tagged with its org/app. To find one workflow by id/label across all apps, prefer didit_workflow_search. The `features` on a row do NOT tell you whether a workflow checks age: age assurance done from the DOCUMENT (age restrictions on the OCR step) shows no feature of its own. For any question about which workflows do age assurance, pass `include_age_assurance:true` — it annotates each row with `does_age_assurance`/`methods` server-side, which is the only reliable way to find them.

didit_workflow_list

Publish the workflow version that holds the pending changes — makes it live for NEW sessions. Existing sessions are unaffected. Pass the `version_uuid` that set_graph/edit_graph returned: a published version can never hold an edit, so a stable workflow_id resolves to the version that is ALREADY live. Publishing a live version with no draft is refused instead of reported as done.

didit_workflow_publish

Find verification workflows ACROSS ALL your apps/orgs in one call. Pass `workflow_id` to locate a specific workflow by its version uuid OR stable workflow_id (returns which org/app it lives in), or `search` to match by label. Use this instead of guessing the application when you only have a workflow id. `search` matches the LABEL ONLY: a CAPABILITY (age assurance, AML screening, …) is not searchable by name — for age assurance use didit_workflow_list with `include_age_assurance:true`, which reports what each workflow actually does.

didit_workflow_search

Update a workflow's top-level SETTINGS only (workflow_label, is_default, retry/expiration, white-label, etc.). Omitted status preserves the current draft/published state; publication changes only when status is explicitly passed. It does NOT change which features run: to add/remove/reorder features, add a conditional branch, or add a Document-AI step, edit the graph with didit_workflow_edit_graph (small ops, preserves the big allow-lists) or didit_workflow_set_graph (full replace) — those are the only ways feature changes actually persist.

didit_workflow_update

Dry-run validate a graph WITHOUT saving. Returns per-node errors (bad field/operator, missing dependency, branching on a field before its feature runs, etc.). Always validate before didit_workflow_set_graph.

didit_workflow_validate_graph