Skip to content

Restricted pilot. The API reference is generated from the running API. Successful matches return manual_review until attack detection is validated.

Capture sessions

Every verification runs in a fresh, single-use session bound to one identity. Your backend creates it, and the app uploads into it with a short-lived token.

POST/v1/capture-sessions
response
{
  "id": "cap_01m...",
  "object": "capture_session",
  "identity_id": "idn_01m...",
  "status": "open",
  "nonce": "...",
  "expires_at": "2026-10-30T10:03:00Z",
  "capture_token": "cap_01m....secret",
  "upload_url": "https://api.warka-iq.com/v1/capture-sessions/cap_01m.../frames",
  "policy": {
    "min_frames": 1,
    "max_frames": 5,
    "max_bytes_per_frame": 8388608,
    "formats": ["image/jpeg", "image/png"],
    "challenge": null
  }
}

Uploading frames

POST/v1/capture-sessions/{session_id}/frames

Send Authorization: Capture <capture_token> with one frame as multipart. Warka validates the file, removes metadata, encrypts it and stores it. A successful upload proves nothing about the camera and records no attendance.

Sessions last about three minutes. Client details such as device model may be attached when the session is created, and Warka treats them as unverified.

Creating a session spends the attempt, even if no frame is ever uploaded. See Quotas and rate limits.

Web apps

A browser can't call upload_url, because the frames endpoint doesn't accept cross-origin requests. In a web app, post the frames to your own backend. Your backend then sends them to verify as frames, in the same multipart request as capture_session_id. Native apps upload directly with the capture token.

NextMobile capture