curl --request GET \
--url https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId} \
--header 'x-blaaiz-api-key: <api-key>'import requests
url = "https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}"
headers = {"x-blaaiz-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-blaaiz-api-key': '<api-key>'}};
fetch('https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));require 'uri'
require 'net/http'
url = URI("https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-blaaiz-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-blaaiz-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"message": "Session document retrieved successfully.",
"data": {
"url": "https://blaaiz-compliance-prod-storage.s3.eu-west-1.amazonaws.com/merchant-kyc/9d4c4ec5/9f2c7b41/passport-front.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Signature=EXAMPLE",
"content_type": "image/jpeg",
"expires_at": "2026-09-23T10:15:00.000Z"
}
}{
"message": "Invalid or missing access token"
}{
"message": "The MERCHANT_KYC feature is not enabled for this business."
}{
"message": "Verification session not found."
}{
"message": "This session has not been approved or rejected yet."
}{
"message": "This document is no longer available; it was removed under the storage lifecycle policy."
}{
"message": "Too many requests. Try again later."
}{
"message": "Something went wrong. Quote the request_id in a support ticket."
}Get a session document
Get a presigned download URL for one document from the documents list endpoint. The url is valid for 15 minutes; Blaaiz never returns the raw file bytes on this endpoint. Fetch a fresh url instead of retrying an expired one. The session must be APPROVED or REJECTED; call this only after the session reaches one of those statuses.
This endpoint needs both the MERCHANT_KYC business entitlement and the compliance-kyc:pii:read scope; a legacy API key carries no scopes, so only the entitlement applies to key-based requests. Every response carries Cache-Control: no-store, and the response body is excluded from your API request logs.
This endpoint has its own rate limit, tighter than the standard external API limit: 30 requests per minute and 600 requests per hour, per business. See Rate and usage limits.
curl --request GET \
--url https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId} \
--header 'x-blaaiz-api-key: <api-key>'import requests
url = "https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}"
headers = {"x-blaaiz-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-blaaiz-api-key': '<api-key>'}};
fetch('https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));require 'uri'
require 'net/http'
url = URI("https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-blaaiz-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-prod.blaaiz.com/api/external/compliance/kyc/sessions/{sessionId}/documents/{documentId}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-blaaiz-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"message": "Session document retrieved successfully.",
"data": {
"url": "https://blaaiz-compliance-prod-storage.s3.eu-west-1.amazonaws.com/merchant-kyc/9d4c4ec5/9f2c7b41/passport-front.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Signature=EXAMPLE",
"content_type": "image/jpeg",
"expires_at": "2026-09-23T10:15:00.000Z"
}
}{
"message": "Invalid or missing access token"
}{
"message": "The MERCHANT_KYC feature is not enabled for this business."
}{
"message": "Verification session not found."
}{
"message": "This session has not been approved or rejected yet."
}{
"message": "This document is no longer available; it was removed under the storage lifecycle policy."
}{
"message": "Too many requests. Try again later."
}{
"message": "Something went wrong. Quote the request_id in a support ticket."
}Authorizations
A legacy API key has no scopes, so only the MERCHANT_KYC entitlement gates this endpoint for key-based requests.
Path Parameters
The verification session id returned by the create endpoint.
The id value from the documents list endpoint.
Was this page helpful?