This topic describes how to query authentication results using the CheckResult API.
API information
Operation name: CheckResult
Request method: HTTPS POST
Description: When the server-side receives a callback indicating that authentication is complete, call this API to retrieve the corresponding authentication status and information. This callback is sent when the client result code is 1001 or 1002. For more information, see Native SDK client result codes and sub-codes.
ImportantThe ID Verification service stores verification results for 30 days by default. Please retrieve them within this period, as they are automatically deleted afterward.
QPS limit: Each API has its own QPS limit. For more information, see QPS limits of ID Verification server-side APIs.
Service endpoints:
NoteBenefits of internal network access: An internal network is a private communication network connecting Alibaba Cloud products within the same region. If your application server is deployed in the same region, use the internal endpoint to access the ID Verification service for enhanced security and stability.
Optimizing overseas access: Overseas network environments can be complex. Refer to Optimize server network latency to tune your integration and reduce network latency and request failures.
Asia Pacific SE 1 (Singapore)
Public endpoint:
cloudauth-intl.ap-southeast-1.aliyuncs.comInternal endpoint:
cloudauth-intl-vpc.ap-southeast-1.aliyuncs.com
Indonesia (Jakarta)
Public endpoint:
cloudauth-intl.ap-southeast-5.aliyuncs.comInternal endpoint:
cloudauth-intl-vpc.ap-southeast-5.aliyuncs.com
China (Hong Kong)
Public endpoint:
cloudauth-intl.cn-hongkong.aliyuncs.comInternal endpoint:
cloudauth-intl-vpc.cn-hongkong.aliyuncs.com
Asia Pacific SE 3 (Kuala Lumpur)
Public endpoint:
cloudauth-intl.ap-southeast-3.aliyuncs.comInternal endpoint:
cloudauth-intl-vpc.ap-southeast-3.aliyuncs.com
Online debugging and integration
Before debugging and integration, read the Use OpenAPI document to learn how to call APIs on the OpenAPI platform and obtain the SDK.
You can debug this API directly in OpenAPI Explorer and generate an SDK code example for this API.
Usage notes
TransactionId storage requirements: The TransactionId is the trusted server-side identifier for an authentication record. It must be linked to your merchant business ID and stored persistently on your server.
Log retention: By default, authentication result logs are retained for 30 days and then automatically deleted. You must query the results within this retention period and store any required data in accordance with compliance requirements.
Video retrieval and compliance: An evidence video is returned only if the corresponding feature is enabled and the authentication process is successful. The download URL for the evidence video is valid for 15 minutes. The original video is automatically deleted 30 minutes after the authentication is complete. If your business requires video retention, download it promptly and strictly adhere to local privacy and data compliance regulations.
Image retrieval guidelines: Because Base64-encoded data is large, leave this parameter as N (default) if you do not need the image.
API status vs. authentication result: A response with
Code=Successindicates only that the API call succeeded. The final authentication outcome is determined by theResult.PassedandResult.SubCodefields.
Field distribution
The App SDK and Web SDK integration methods share the same request parameters and core response structure. Both include results for face liveness, face comparison (or 1:N search), and face registration. The only difference is that the Web SDK method also returns information about authentication degradation.
Category | Field | Description |
Shared output | Common response parameters, authentication result, and | Can be returned in both integration modes. Whether these fields are returned depends on the authentication flow and the |
Web SDK specific |
| If compatibility degradation occurs, this field returns the degradation strategy used. |
App SDK specific | None | None |
Request parameters
Parameter | Type | Required | Description | Example |
MerchantBizId | String | Yes | A unique business ID from the merchant, consisting of 32 letters and numbers. It must be consistent with the value used in the InitializeV2 request. | e0c34a77f5ac40a5aa5e6ed20c35**** |
TransactionId | String | Yes | The unique authentication identifier returned by a successful init API call. To prevent tampering, always retrieve this value from your server-side storage and do not trust the value sent from the client-side. | hksb7ba1b28130d24e015d6******** |
IsReturnImage | String | No | Specifies whether to return the face image:
| Y |
Response data
Parameter | Type | Description | Example | |
HTTP Status Code | Integer | The HTTP status code. | 200 | |
HTTP Body | RequestId | String | The request ID. | 130A2C10-B9EE-4D84-88E3-5384FF03**** |
Code | String | The API response code. For more information, see Server-side HTTP status codes. | Success | |
Message | String | A description of the response code. | success | |
Result.Passed | String | The final authentication result:
| Y | |
Result.SubCode | String | A description of the authentication result. For more information, see Result.SubCode authentication result subcodes. | 200 | |
Result.ExtFaceInfo | String | Results related to face liveness verification. For more information, see Result.ExtFaceInfo. | | |
Result.ExtInfo | String | Other authentication information, which primarily includes details on actual degradation for mobile H5 integrations. For more information, see Result.ExtInfo. | | |
Result.ExtFaceInfo
Parameter | Type | Description | Example |
faceImg | String | The live face image in Base64 format. Returned only when | Base64 format |
docVideoUrl | String | The OSS download URL for the evidence video. This may be returned only when the | https://aliyun-cloudauth.oss-aliyuncs.com/******.webm |
faceAttack | String | Indicates whether a liveness attack was detected:
| N |
faceAttackScore (Deprecated) | Double | The liveness attack risk score, ranging from 0 to 100. The risk of liveness attacks is now determined by a Large Language Model (LLM), so the concept of a risk score is no longer applicable. This field is offline. | 80 |
guardRiskScore | Double | The device risk score, ranging from 0 to 100. A higher score indicates a higher device risk. | 90 |
deviceToken | String | The DeviceToken for Face Guard. It is returned when the Face Guard module is fully integrated and can be used to query the Face Guard server-side API operations to get device risk details.
| e0c34a77f5ac40a5aa5e6ed20c35**** |
faceAttributeInfo | String | Detects the facial attributes of the main face in an input image. The main face is the one that is largest, clearest, and closest to the camera. The detection results are returned as a string. You can use this string to make decisions about the content. The returned fields are defined as follows:
| |
faceComparisonScore | Double | The face comparison result is returned when | 90 |
duplicateFace | List | Returns the duplicate face search result when The returned fields are defined as follows:
| |
faceRegistrationResult | Integer | Face registration result (returned when
| 1 |
faceRegistrationId | String | The ID of the registered face, which is returned when | f5a9219aefd6*******c84c8f0ca592a |
Result.ExtInfo
Parameter | Type | Description |
procedurePriority | String | The actual downgrade method for mobile H5 authentication:
|
Result.SubCode subcodes
Subcode | Billed | Description |
200 | Yes | Authentication passed. |
205 | Yes | [Liveness Attack] A risk was detected during liveness detection. |
206 | Yes | [Liveness Attack] Limited by business policy. After safe mode is enabled, the device and environment are checked for security. If a potential risk is detected, the authentication fails. You can troubleshoot and handle this as follows:
|
204 | Yes | [1:1 verification result] This may be because the user is not the same person or the face image quality is poor. |
233 | Yes | 1:N Search Result: Similar faces detected. Use the information in |