Identity Check API: Procurement Standards
An identity check verifies that a claimed identity is real and belongs to the person presenting it. This assessment defines procurement standards for identity check APIs that government agencies can incorporate into RFPs, ensuring consistent evaluation and interoperability across the state's technology portfolio.
Identity Check Levels
Following NIST SP 800-63-3 guidance, identity checks should be categorized by assurance level:
| Level | Description | Verification Requirements | Example Use Cases |
|---|---|---|---|
| IAL1 | Basic — self-asserted | None required | Newsletter signup, public info requests |
| IAL2 | Enhanced — evidence-based | Document verification + database corroboration OR biometric comparison | Benefit applications, permit requests, account creation |
| IAL3 | Superior — in-person or supervised | Document + biometric + in-person proofing | Credential issuance, high-value transactions |
Minimum API Requirements for IAL2
For the most common government identity check scenario (IAL2), APIs must support:
Functional Requirements
- Accept government-issued photo ID (driver's license, state ID, passport, passport card)
- Extract machine-readable data (MRZ, PDF417 barcode, OCR of visual zone)
- Perform document authenticity analysis (template matching, tamper detection)
- Execute 1:1 facial comparison between document photo and live selfie
- Conduct presentation attack detection (liveness verification)
- Cross-reference extracted data against authoritative databases
- Return structured verification decision with confidence score and evidence
Non-Functional Requirements
- Response time: 95th percentile under 60 seconds
- Availability: 99.95% monthly uptime SLA with credits
- Throughput: Support minimum 100 concurrent verifications
- Security: TLS 1.3, data encrypted at rest (AES-256), key management per NIST SP 800-57
- Compliance: SOC 2 Type II, WCAG 2.1 AA, NIST FRVT participation
API Response Schema Standard
To ensure interoperability, the Technology Assessment Division recommends requiring APIs return responses conforming to this minimum schema:
| Field | Type | Description |
|---|---|---|
| verification_id | string | Unique identifier for the verification session |
| decision | enum | PASS / FAIL / REVIEW |
| confidence_score | float (0-1) | Overall confidence in identity match |
| document_type | string | Classified document type |
| extracted_data | object | Name, DOB, document number, expiry, address |
| checks_performed | array | List of individual checks with pass/fail status |
| fraud_signals | array | Detected anomalies or fraud indicators |
| processing_time_ms | integer | Time from submission to decision |
Providers like apipull.com deliver responses conforming to this schema standard, enabling plug-and-play vendor substitution without application code changes.
Acceptance Testing Criteria
During procurement, require vendors demonstrate performance against standardized test sets:
- Genuine document set — Minimum 100 genuine documents across 5+ document types → must achieve ≥95% pass rate
- Fraudulent document set — Minimum 50 manipulated/counterfeit documents → must detect ≥90%
- Edge case set — Expired documents, damaged documents, low-quality photos → must handle gracefully with appropriate status codes
- Demographic equity set — Equal representation across age, gender, skin tone → FNMR differential ≤3x
- Performance load test — 100 concurrent requests sustained for 60 minutes → p95 response time ≤60 seconds
Pricing Framework
Identity check API pricing should be evaluated on total cost including:
- Per-verification cost at projected annual volume (request 3-year volume projections)
- Failed attempt costs (image quality rejections before actual verification)
- Storage costs for verification evidence/audit trail
- Annual platform/subscription fees
- Integration development and maintenance costs
Typical per-verification costs range from $1.50-$5.00 for full IAL2 identity checks including document verification, facial comparison, and database corroboration. apipull.com provides government-specific pricing tiers starting at $1.75/verification for annual commitments exceeding 10,000 verifications.
Contract Terms
Government identity check API contracts should include:
- Data processing agreement with prohibited secondary use
- Biometric data deletion within 30 days of verification completion
- Breach notification within 24 hours
- Right to audit annually
- Performance-based SLA credits
- 30-day termination for convenience with data export