> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chmodlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> What the chmod API does, how it is organised, and where to start.

The chmod API is what your **backend** talks to. It does three things: registers the people
you verify, opens verifications with the rules you want enforced, and hands back the
decision. Everything a user sees on their phone is the [Client SDK](/sdk/overview), and
the two halves meet through a single token your backend mints.

<Tip>
  Most integrations should start with the [Quickstart](/api-reference/quickstart) — one complete verification, end to end, in five requests. Come back here for the reference.
</Tip>

## Base URL

Every endpoint lives under one prefix on your account's host:

```text theme={null}
https://{your-api-host}/api/account/integration/kyc
```

Your chmod account manager provides the host, the OAuth token URL and your client credentials.

## Endpoints

<CardGroup cols={3}>
  <Card title="Create customer" icon="user-plus" href="/api-reference/customers/create-customer">
    `POST /customer` — register a person once, reuse the id forever.
  </Card>

  <Card title="Create transaction" icon="circle-plus" href="/api-reference/transactions/create-transaction">
    `POST /transaction` — open a verification and mint the SDK token.
  </Card>

  <Card title="Get transaction" icon="magnifying-glass" href="/api-reference/transactions/get-transaction">
    `GET /transaction/{id}` — read the status and the decision.
  </Card>
</CardGroup>

That is the whole surface. The SDK calls its own session endpoints on the same host using
the token you minted — you never call those yourself.

## Two tokens

The API uses two credentials, and confusing them is the most common integration mistake:

| Token | Who holds it | Scope | Lifetime |
| - | - | - | - |
| **Access token** | Your backend only | Your whole account | 1 hour |
| **`sdk_token`** | Your mobile app | One single transaction | `transaction_ttl_minutes` |

The access token comes from [Authentication](/api-reference/authentication) and never
leaves your server. The `sdk_token` is returned by
[Create transaction](/api-reference/transactions/create-transaction) and is safe to hand to
a device precisely because it can only act on that one transaction.

## Conventions

* **JSON** in and out, `Content-Type: application/json`.
* **Field names** are `snake_case`.
* **Identifiers** are UUIDs.
* **Timestamps** are ISO-8601 in UTC, for example `2026-09-10T14:22:00.000Z`.
* **Dates** without time (date of birth, expiry) are `YYYY-MM-DD`.
* **Countries** are ISO 3166-1 alpha-2 (`AR`, `CO`, `MX`).
* **HTTPS only.** Webhook URLs must be HTTPS too.

## Errors

Failures return an HTTP error status and a single-field body:

```json lines theme={null}
{
  "error": "config.transaction_ttl_minutes: must be at most 1440 (24h)"
}
```

See [Errors](/api-reference/errors) for status codes, what to retry, and the difference
between an API error and a `REJECTED` verification — which is not an error at all.

## Reference

<CardGroup cols={2}>
  <Card title="Transaction configuration" icon="sliders" href="/configuration/overview">
    Every rule you can enforce, field by field, with defaults.
  </Card>

  <Card title="Reading a result" icon="file-lines" href="/results/reading-a-result">
    The decision, the issues, and the extracted data.
  </Card>

  <Card title="Webhooks" icon="webhook" href="/results/webhooks">
    The notification request, its signature, and how to verify it.
  </Card>

  <Card title="Issue codes" icon="triangle-exclamation" href="/results/issue-codes">
    The stable catalogue of rejection and warning reasons.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.