API Reference
Complete reference for the MID REST API. All endpoints require authentication via the X-Mobid-Key header.
Consent Sessions
Create and manage user consent flows for identity verification and data sharing.
/v1/service/consents/searchCreate a new consent session
/v1/service/consents/:idRetrieve consent session details
/v1/service/consents/:idUpdate an existing consent
/v1/service/consents/:idRevoke a consent session
curl -X POST 'https://api.mobid.io/v1/service/consents/search' \
-H 'Content-Type: application/json' \
-H 'X-Mobid-Key: qk_your_api_key' \
-d '{
"recipient": "+1234567890",
"purpose": "identity_verification",
"scope": ["name", "email", "phone"],
"callbackUrl": "https://yourapp.com/callback"
}'{
"code": 200,
"message": "Consent session created",
"data": {
"id": "cs_abc123",
"status": "pending",
"recipient": "+1234567890",
"purpose": "identity_verification",
"scope": ["name", "email", "phone"],
"expiresAt": "2025-01-15T12:00:00Z",
"qrCode": "https://api.mobid.io/qr/cs_abc123"
}
}FIDO / WebAuthn
Passwordless authentication using FIDO2 and WebAuthn standards.
/v1/auth/fido/register/beginBegin FIDO2 registration
/v1/auth/fido/register/completeComplete FIDO2 registration
/v1/auth/fido/authenticate/beginBegin FIDO2 authentication
/v1/auth/fido/authenticate/completeComplete FIDO2 authentication
FIDO2 Flow
Device Management
Manage registered devices and their authentication capabilities.
/v1/devicesList all registered devices
/v1/devices/:idGet device details
/v1/devices/:idDeregister a device
/v1/devices/:id/blockBlock a device
Client Management
Manage API clients, credentials, and access permissions.
/v1/clientsList all clients
/v1/clientsCreate a new client
/v1/clients/:idGet client details
/v1/clients/:idUpdate client configuration
/v1/clients/:idDelete a client
/v1/clients/:id/regenerate-keyRegenerate client API key
Enrollments
User enrollment and identity provisioning endpoints.
/v1/enrollmentsCreate a new enrollment
/v1/enrollments/:idGet enrollment status
/v1/enrollments/:id/verifyVerify enrollment with biometrics
QR Code Operations
Generate and manage QR codes for authentication and consent flows.
/v1/qr/generateGenerate a new QR code
/v1/qr/:idGet QR code status
/v1/qr/:id/imageGet QR code image (PNG/SVG)
Rate Limits
| Plan | Requests/min | Daily Limit | Concurrent |
|---|---|---|---|
| Free | 60 | 1,000 | 5 |
| Basic ($79/mo) | 300 | 50,000 | 25 |
| Growth ($149/mo) | 1,000 | 500,000 | 50 |
| Enterprise ($499/mo) | Custom | Unlimited | Custom |
Error Responses
| Code | Type | Description |
|---|---|---|
| 400 | bad_request | The request was malformed or missing required fields |
| 401 | unauthorized | Invalid or missing API key |
| 403 | forbidden | API key lacks required permissions |
| 404 | not_found | The requested resource does not exist |
| 409 | conflict | The request conflicts with an existing resource |
| 422 | validation_error | Request body failed validation |
| 429 | rate_limited | Too many requests — retry after cooldown |
| 500 | server_error | Internal server error (rare) |
Webhooks
Configure webhook endpoints to receive real-time event notifications.
| Event | Trigger |
|---|---|
| consent.created | New consent session initiated |
| consent.approved | Recipient approved the consent |
| consent.rejected | Recipient rejected the consent |
| consent.expired | Consent session timed out |
| auth.success | Successful authentication event |
| auth.failed | Failed authentication attempt |
| device.registered | New device registered |
| device.deregistered | Device was removed |
| enrollment.completed | User enrollment finished |
| mandate.signed | Digital mandate was signed |
Webhook Security