All Products
Search
Document Center

ID Verification:CheckResult

Last Updated:Oct 23, 2026

This topic describes how to query authentication results using the CheckResult API.

API information

  • Operation name: CheckResult

  • Request method: HTTPS POST

  • Description: When the server-side receives a callback indicating that authentication is complete, call this API to retrieve the corresponding authentication status and information. This callback is sent when the client result code is 1001 or 1002. For more information, see Native SDK client result codes and sub-codes.

    Important

    The ID Verification service stores verification results for 30 days by default. Please retrieve them within this period, as they are automatically deleted afterward.

  • QPS limit: Each API has its own QPS limit. For more information, see QPS limits of ID Verification server-side APIs.

  • Service endpoints:

    Note
    • Benefits of internal network access: An internal network is a private communication network connecting Alibaba Cloud products within the same region. If your application server is deployed in the same region, use the internal endpoint to access the ID Verification service for enhanced security and stability.

    • Optimizing overseas access: Overseas network environments can be complex. Refer to Optimize server network latency to tune your integration and reduce network latency and request failures.

    Asia Pacific SE 1 (Singapore)

    • Public endpoint: cloudauth-intl.ap-southeast-1.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-1.aliyuncs.com

    Indonesia (Jakarta)

    • Public endpoint: cloudauth-intl.ap-southeast-5.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-5.aliyuncs.com

    China (Hong Kong)

    • Public endpoint: cloudauth-intl.cn-hongkong.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.cn-hongkong.aliyuncs.com

    Asia Pacific SE 3 (Kuala Lumpur)

    • Public endpoint: cloudauth-intl.ap-southeast-3.aliyuncs.com

    • Internal endpoint: cloudauth-intl-vpc.ap-southeast-3.aliyuncs.com

Online debugging and integration

Note

Before debugging and integration, read the Use OpenAPI document to learn how to call APIs on the OpenAPI platform and obtain the SDK.

You can debug this API directly in OpenAPI Explorer and generate an SDK code example for this API.

Usage notes

  1. TransactionId storage requirements: The TransactionId is the trusted server-side identifier for an authentication record. It must be linked to your merchant business ID and stored persistently on your server.

  2. Log retention: By default, authentication result logs are retained for 30 days and then automatically deleted. You must query the results within this retention period and store any required data in accordance with compliance requirements.

  3. Video retrieval and compliance: An evidence video is returned only if the corresponding feature is enabled and the authentication process is successful. The download URL for the evidence video is valid for 15 minutes. The original video is automatically deleted 30 minutes after the authentication is complete. If your business requires video retention, download it promptly and strictly adhere to local privacy and data compliance regulations.

  4. Image retrieval guidelines: Because Base64-encoded data is large, leave this parameter as N (default) if you do not need the image.

  5. API status vs. authentication result: A response with Code=Success indicates only that the API call succeeded. The final authentication outcome is determined by the Result.Passed and Result.SubCode fields.

Field distribution

The App SDK and Web SDK integration methods share the same request parameters and core response structure. Both include results for face liveness, face comparison (or 1:N search), and face registration. The only difference is that the Web SDK method also returns information about authentication degradation.

Category

Field

Description

Shared output

Common response parameters, authentication result, and ExtFaceInfo (includes face liveness results, face comparison/1:N search results, and face registration results)

Can be returned in both integration modes. Whether these fields are returned depends on the authentication flow and the InitializeV2 configuration.

Web SDK specific

procedurePriority

If compatibility degradation occurs, this field returns the degradation strategy used.

App SDK specific

None

None

Request parameters

Parameter

Type

Required

Description

Example

MerchantBizId

String

Yes

A unique business ID from the merchant, consisting of 32 letters and numbers. It must be consistent with the value used in the InitializeV2 request.

e0c34a77f5ac40a5aa5e6ed20c35****

TransactionId

String

Yes

The unique authentication identifier returned by a successful init API call. To prevent tampering, always retrieve this value from your server-side storage and do not trust the value sent from the client-side.

hksb7ba1b28130d24e015d6********

IsReturnImage

String

No

Specifies whether to return the face image:

  • Y: Return

  • N: Do not return (default)

Y

Response data

Parameter

Type

Description

Example

HTTP Status Code

Integer

The HTTP status code.

200

HTTP Body

RequestId

String

The request ID.

130A2C10-B9EE-4D84-88E3-5384FF03****

Code

String

The API response code. For more information, see Server-side HTTP status codes.

Success

Message

String

A description of the response code.

success

Result.Passed

String

The final authentication result:

  • Y: Passed

  • N: Failed

Y

Result.SubCode

String

A description of the authentication result. For more information, see Result.SubCode authentication result subcodes.

200

Result.ExtFaceInfo

String

Results related to face liveness verification. For more information, see Result.ExtFaceInfo.

{
  "faceAttack": "N",
  "faceImg": "/9j/4AAQSkZJRgABAQAAAQqviV6oakp8...",
  "docVideoUrl": "https://aliyun-cloudauth.oss-aliyuncs.com/******.webm" 
}

Result.ExtInfo

String

Other authentication information, which primarily includes details on actual degradation for mobile H5 integrations. For more information, see Result.ExtInfo.

{
  "procedurePriority": "keep"
}

Result.ExtFaceInfo

Parameter

Type

Description

Example

faceImg

String

The live face image in Base64 format. Returned only when IsReturnImage=Y and the face scan is successful.

Base64 format

docVideoUrl

String

The OSS download URL for the evidence video. This may be returned only when the DocVideo parameter in InitializeV2 is set to Y and the video is successfully uploaded. The URL is valid for 15 minutes. You can query it repeatedly within 30 minutes after the authentication is complete. After 30 minutes, the video is deleted and cannot be recovered.

https://aliyun-cloudauth.oss-aliyuncs.com/******.webm

faceAttack

String

Indicates whether a liveness attack was detected:

  • Y: Yes

  • N: No

N

faceAttackScore

(Deprecated)

Double

The liveness attack risk score, ranging from 0 to 100.

The risk of liveness attacks is now determined by a Large Language Model (LLM), so the concept of a risk score is no longer applicable. This field is offline.

80

guardRiskScore

Double

The device risk score, ranging from 0 to 100. A higher score indicates a higher device risk.

90

deviceToken

String

The DeviceToken for Face Guard. It is returned when the Face Guard module is fully integrated and can be used to query the Face Guard server-side API operations to get device risk details.

  • Face Guard is a paid service. For more information, see Billing overview.

  • This token is valid for 7 days and is not unique.

e0c34a77f5ac40a5aa5e6ed20c35****

faceAttributeInfo

String

Detects the facial attributes of the main face in an input image. The main face is the one that is largest, clearest, and closest to the camera. The detection results are returned as a string. You can use this string to make decisions about the content.

The returned fields are defined as follows:

  • gender: The gender of the main entity. A value of 1 indicates male, and 0 indicates female.

  • glasses: Indicates whether the main entity is wearing glasses. A value of 1 indicates that glasses are detected, and 0 indicates that they are not.

  • hat: Indicates whether the main entity is wearing a hat. This includes headscarves or veils. A value of 1 indicates that a hat is detected, and 0 indicates that it is not.

  • mask: Indicates whether the main entity is wearing a mask. A value of 1 indicates that a mask is detected, and 0 indicates that it is not.

  • tattoo: Indicates whether the main entity has a visible tattoo. A value of 1 indicates that a tattoo is detected, and 0 indicates that it is not.

  • smoking: Indicates whether the main entity is smoking. A value of 1 indicates that smoking is detected, and 0 indicates that it is not.

  • others: Indicates whether people other than the main entity are present. A value of 1 indicates that other people are detected, and 0 indicates that they are not.

  • env: The environment of the main entity, such as an office, factory, hospital, or vehicle. The system currently supports returning office, hospital, factory, vehicle, or other.

  • expression: Indicates whether the main entity has an exaggerated expression. An exaggerated expression is a strong facial expression that is distinct from a natural or calm state. A value of 1 indicates that an exaggerated expression is detected, and 0 indicates that it is not.

  • age: The age of the main entity in years.

{
        gender: 1
        glasses: 0
        hat: 1
        mask: 1
        tattoo: 0
        smoking: 0
        others: 1
        env:office
        expression:1
        age:16
}

faceComparisonScore

Double

The face comparison result is returned when VerifyModel=1/2. The comparison score ranges from 0 to 100. The default system threshold is 90. You can also customize the decision based on your business requirements.

90

duplicateFace

List

Returns the duplicate face search result when VerifyModel is 0 or 2 and a similar face is found.

The returned fields are defined as follows:

  • faceGroupCode: The code of the face group that contains the similar face.

  • faceId: The ID of the similar face.

  • merchantUserId: The unique user ID for a similar face.

  • score: The similarity score of the face.

[
  {
    "faceGroupCode": "sg7****uzt",
    "faceId": "f5a921*******9e792ec84c8f0ca592a"
    "merchantUserId":"face0005",
    "score":93.26
  }
]

faceRegistrationResult

Integer

Face registration result (returned when VerifyModel=0/2):

  • 0: Registration failed due to an issue with the face image.

  • 1: Registration successful.

  • 2: Registration failed because the auto-registration conditions were not met.

  • 3: Registration failed because the user already exists.

  • 4: Registration successful, and the face image is updated successfully (This occurs when an entry meets the conditions for automatic registration, but has a duplicate MerchantUserId and UpdateFaceIfUserExists is set to Y).

1

faceRegistrationId

String

The ID of the registered face, which is returned when VerifyModel=0/2, AutoRegistration=0, and the registration is successful.

f5a9219aefd6*******c84c8f0ca592a

Result.ExtInfo

Parameter

Type

Description

procedurePriority

String

The actual downgrade method for mobile H5 authentication:

  • keep: No downgrade

  • url: Downgrade using a URL

Result.SubCode subcodes

Subcode

Billed

Description

200

Yes

Authentication passed.

205

Yes

[Liveness Attack] A risk was detected during liveness detection.

206

Yes

[Liveness Attack] Limited by business policy. After safe mode is enabled, the device and environment are checked for security. If a potential risk is detected, the authentication fails.

You can troubleshoot and handle this as follows:

  1. Remind the user to uninstall any multi-instance, cloning, or virtual environment software or plugins from the device, and then retry after restoring the device's initial security environment.

  2. Check if the package name used is a test demo package name. If so, change it to the business package name to avoid being blocked by the project's or service's security policy.

204

Yes

[1:1 verification result] This may be because the user is not the same person or the face image quality is poor.

233

Yes

1:N Search Result: Similar faces detected. Use the information in Result.ExtFaceInfo.duplicateFace to handle the risks of duplicate registration or identity spoofing.