didit-sdk 1.0.0

data/lib/didit/resources/email.rb

@@ -0,0 +1,254 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +email+ resource.
+    class Email < Didit::Resource
+      # Risk-score an email address
+      #
+      # Return deliverability, disposable-address, breach, cross-session match, and normalized risk-intelligence
+      # signals without sending an OTP. The endpoint creates an API session and returns its id as `request_id`.
+      #
+      # **Decision.** The top-level `status` mirrors `email.status`. It is normally `Approved`; the risk evaluation
+      # can produce `In Review` or `Declined`.
+      #
+      # **Compatibility aliases.** Live responses expose the normalized intelligence object as both
+      # `email.email_intelligence` and `email.enrichment`. The values are identical. New integrations can read
+      # `email.enrichment`. Both keys are absent when no usable intelligence data was returned.
+      #
+      # **Billing.** Live calls use Email Risk API pricing. The request is billable once the lookup starts, even when
+      # some best-effort fields are unavailable.
+      #
+      # **Sandbox.** Sandbox keys validate the request and return deterministic approved data without sending an
+      # email, consuming credits, creating a session, or contributing to Networks.
+      #
+      # **Authentication.** Send your application's API key in `x-api-key`. Missing or invalid credentials return
+      # `403` - this API never returns `401`.
+      #
+      # **Rate limit.** Shared write budget of 300 requests per minute per API key across all POST/PATCH/DELETE
+      # endpoints.
+      #
+      # **Social footprint.** Set `enable_social` to `true` to add a `email_social` block: the online platforms this
+      # address is registered on, with per-category counts and any profile details available. `profiles_registered: 0`
+      # means the platforms were checked and the address was found on none of them - a valid, billable answer. The
+      # block is absent when the add-on was not requested or the check could not be completed, and it is not billed in
+      # that case. Billing adds one `email_social` unit per request on top of this endpoint's own price.
+      #
+      # +POST /v3/email/risk/+
+      #
+      # @param email [String] Email address to score.
+      # @param country_code [String] Optional ISO 3166-1 alpha-2 or alpha-3 country hint for intelligence coverage.
+      # @param signals [Hash] Optional device and network context observed by your application. All fields are
+      #   optional. Passing them feeds cross-session match detection in Networks.
+      # @param vendor_data [String] Your stable reference for this request. Stored on the API session and echoed in
+      #   the response.
+      # @param metadata [Hash, nil] Your non-sensitive JSON metadata. Stored on the API session and echoed in the
+      #   response.
+      # @param enable_social [Boolean] When true, also look up the social footprint of the address - the email,
+      #   social, professional, e-commerce and entertainment platforms it is registered on. Billed as one `email_social`
+      #   unit per request in addition to this endpoint's own price.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::EmailRiskResponse]
+      def assess_risk(
+        email:,
+        country_code: OMIT,
+        signals: OMIT,
+        vendor_data: OMIT,
+        metadata: OMIT,
+        enable_social: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/email/risk/",
+          body: {
+            "email" => email,
+            "country_code" => country_code,
+            "signals" => signals,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata,
+            "enable_social" => enable_social
+          },
+          response: Types::EmailRiskResponse,
+          request_options: request_options
+        )
+      end
+
+      # Check Email Code
+      #
+      # Verify the OTP delivered by [`POST /v3/email/send/`](/standalone-apis/email-send) and get the final
+      # verification result plus email intelligence: deliverability, breach exposure (`is_breached` and the `breaches`
+      # list from a breach-intelligence database), disposable-provider detection, and duplicate usage of the address
+      # across your sessions.
+      #
+      # **How the check finds the verification.** Matching is by your application plus the `email` address -
+      # `request_id` is not an input. The most recent pending verification created within the last **5 minutes** is
+      # checked. If there is none (never sent, already finalized, undeliverable at send time, or older than 5 minutes)
+      # the endpoint returns `200` with `status: "Expired or Not Found"`.
+      #
+      # **Attempt budget.** Each verification allows **3 code attempts**. The first two wrong codes return `status:
+      # "Failed"` with the attempts remaining and `email: null`; the third wrong code finalizes the verification as
+      # `Declined` with an `EMAIL_CODE_ATTEMPTS_EXCEEDED` warning and returns the full email report. Codes are
+      # compared case-insensitively (relevant for `alphanumeric_code` sends); only the most recently sent code is
+      # valid.
+      #
+      # **Outcomes.** `Approved` - correct code and no declining risk. `Declined` - terminal: the code was correct but
+      # a declining risk matched (a `DECLINE` action below, a blocklisted address, or the address found undeliverable
+      # at finalization), or the attempt budget was exhausted. `Failed` - wrong code, attempts remaining. `Expired or
+      # Not Found` - nothing to check. On `Approved`/`Declined` the `request_id` equals the send's `request_id` (the
+      # session id) and `email` carries the full report (`is_breached`, `breaches`, `is_disposable`,
+      # `is_undeliverable`, `warnings`, `lifecycle`, `matches`); on `Failed` and `Expired or Not Found` the
+      # `request_id` is a one-off random UUID.
+      #
+      # **Risk actions.** `duplicated_email_action`, `breached_email_action`, and `disposable_email_action` decide
+      # what happens when the corresponding risk is detected on a correct code: `DECLINE` flips the final status to
+      # `Declined`; `NO_ACTION` (default) records the risk in `email.warnings` without affecting the status.
+      #
+      # **Billing.** Checks are free - the credit is consumed by the successful send.
+      #
+      # **Session persistence.** A finalized check updates the session created by the send (visible in the Business
+      # Console, queryable via `GET /v3/session/{sessionId}/decision/`) and fires a `status.updated` webhook.
+      #
+      # **Sandbox.** Sandbox API keys skip all processing: any well-formed code (`123456` included) returns a static
+      # `Approved` payload with a simplified `email` object (`status`, `email`, `is_breached`, `is_disposable`,
+      # `is_undeliverable`); malformed input still returns `400`. Nothing is persisted.
+      #
+      # **Authentication.** Send your application's API key in the `x-api-key` header. Missing or invalid credentials
+      # return `403` (`{"detail": "You do not have permission to perform this action."}`) - this API never returns
+      # `401`.
+      #
+      # **Rate limit.** Shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # **Social footprint.** Set `enable_social` to `true` to add a `email_social` block: the online platforms this
+      # address is registered on, with per-category counts and any profile details available. `profiles_registered: 0`
+      # means the platforms were checked and the address was found on none of them - a valid, billable answer. The
+      # block is absent when the add-on was not requested or the check could not be completed, and it is not billed in
+      # that case. Billing adds one `email_social` unit per request on top of this endpoint's own price.
+      #
+      # +POST /v3/email/check/+
+      #
+      # @param email [String] The same email address used in the matching [`POST
+      #   /v3/email/send/`](/standalone-apis/email-send) call. This is what links the check to the send.
+      # @param code [String] The OTP the end user received: 4-8 digits, or 4-8 letters/digits when `alphanumeric_code:
+      #   true` was used at send time. Comparison is case-insensitive.
+      # @param duplicated_email_action [String] What to do when the same address was already used and approved by a
+      #   different user (only previously Approved verifications count) (different `vendor_data`) of your application.
+      #   `DECLINE` flips the final `status` to `Declined`; `NO_ACTION` records the risk in `email.warnings` and fills
+      #   `email.matches`.
+      # @param breached_email_action [String] What to do when the address appears in known data breaches
+      #   (`email.is_breached`). `DECLINE` flips the final `status` to `Declined`; `NO_ACTION` records the risk in
+      #   `email.warnings`.
+      # @param disposable_email_action [String] What to do when the domain belongs to a disposable/temporary-mail
+      #   provider (`email.is_disposable`). `DECLINE` flips the final `status` to `Declined`; `NO_ACTION` records the
+      #   risk in `email.warnings`.
+      # @param enable_social [Boolean] When true, also look up the social footprint of the address - the email,
+      #   social, professional, e-commerce and entertainment platforms it is registered on. Billed as one `email_social`
+      #   unit per request in addition to this endpoint's own price.
+      # @param email_no_social_presence_action [String] Action when the social footprint check finds the address
+      #   registered on none of the platforms it covers. Only NO_ACTION and DECLINE are accepted on this endpoint;
+      #   REVIEW is available on the workflow configuration key of the same name.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::EmailVerificationCheckResponse]
+      def check_code(
+        email:,
+        code:,
+        duplicated_email_action: OMIT,
+        breached_email_action: OMIT,
+        disposable_email_action: OMIT,
+        enable_social: OMIT,
+        email_no_social_presence_action: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/email/check/",
+          body: {
+            "email" => email,
+            "code" => code,
+            "duplicated_email_action" => duplicated_email_action,
+            "breached_email_action" => breached_email_action,
+            "disposable_email_action" => disposable_email_action,
+            "enable_social" => enable_social,
+            "email_no_social_presence_action" => email_no_social_presence_action
+          },
+          response: Types::EmailVerificationCheckResponse,
+          request_options: request_options
+        )
+      end
+
+      # Send Email Code
+      #
+      # Send a one-time passcode (OTP) to an email address, then verify it with [`POST
+      # /v3/email/check/`](/standalone-apis/email-check).
+      #
+      # **How send and check pair up.** Verification state is keyed by your application plus the `email` address - the
+      # check call does not take `request_id`. Each new send creates a pending verification that lives for **5
+      # minutes**: call the check with the same address and the code the user received before the window closes.
+      # Calling send again for the same address while a verification is pending generates a fresh code for that same
+      # verification (`status: "Retry"`, same `request_id`); the previous code stops working. At most one retry is
+      # attached this way (two sends total); a further send starts a fresh verification with a new `request_id`. The
+      # 5-minute window is measured from the first send and is not extended by retries.
+      #
+      # **Deliverability pre-check.** Before anything is sent, the address goes through syntax and DNS/MX validation.
+      # Addresses that cannot receive mail return `200` with `status: "Undeliverable"` and `reason:
+      # "email_can_not_be_delivered"` - no email is sent, nothing is billed, and the verification is immediately
+      # finalized as `Declined` (a follow-up check returns `Expired or Not Found`). A downstream send failure reports
+      # the same way.
+      #
+      # **Code format and branding.** Codes are 4-8 characters (`options.code_size`, default 6), numeric by default;
+      # set `options.alphanumeric_code: true` for uppercase letters and digits (the check comparison is
+      # case-insensitive). The email template is localized via `options.locale` (54 supported languages) and can use
+      # your application's white-label branding via `options.use_white_label_customization`.
+      #
+      # **Billing.** One Email Verification API credit per successful send (`status: "Success"`), charged at send
+      # time. `Retry` and `Undeliverable` sends are free, and checks are free.
+      #
+      # **Session persistence.** Every new verification is persisted as an API-type session: `request_id` is a real
+      # session id you can pass to `GET /v3/session/{sessionId}/decision/`, the verification appears in the Business
+      # Console, and `status.updated` webhooks fire as it progresses.
+      #
+      # **Sandbox.** Sandbox API keys skip delivery and billing: after request validation (malformed input still
+      # returns `400`), the endpoint returns a static `Success` payload with a random `request_id`; no email is sent
+      # and nothing is persisted. Use code `123456` on the sandbox check.
+      #
+      # **Authentication.** Send your application's API key in the `x-api-key` header. Missing or invalid credentials
+      # return `403` (`{"detail": "You do not have permission to perform this action."}`) - this API never returns
+      # `401`.
+      #
+      # **Rate limit.** Shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # +POST /v3/email/send/+
+      #
+      # @param email [String] Recipient email address. Malformed addresses return `400`; syntactically valid addresses
+      #   that cannot receive mail (failed DNS/MX validation) return `200` with `status: "Undeliverable"`.
+      # @param options [Hash] OTP format, localization, and branding options. All fields are optional.
+      # @param signals [Hash] Optional device and network signals about the end user, forwarded to the anti-fraud
+      #   layer to improve detection of abusive or automated traffic. All fields are optional.
+      # @param vendor_data [String] Optional caller-controlled identifier (your internal user id, an email, a UUID,
+      #   etc.) persisted on the session and echoed back in the send response, the matching check response, webhooks,
+      #   and the Business Console. Use it to correlate Didit's `request_id` with your user record.
+      # @param metadata [Hash, nil] Optional free-form JSON object persisted on the session and echoed back in the
+      #   send response, the matching check response, webhooks, and the Business Console.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::EmailVerificationSendResponse]
+      def send_code(email:, options: OMIT, signals: OMIT, vendor_data: OMIT, metadata: OMIT, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/email/send/",
+          body: {
+            "email" => email,
+            "options" => options,
+            "signals" => signals,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata
+          },
+          response: Types::EmailVerificationSendResponse,
+          request_options: request_options
+        )
+      end
+    end
+  end
+end

data/lib/didit/resources/face_match.rb

@@ -0,0 +1,103 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +face_match+ resource.
+    class FaceMatch < Didit::Resource
+      # Face Match
+      #
+      # Compare two face images (1:1) and get back a similarity `score` (0-100) plus an `Approved`/`Declined`
+      # `status`.
+      #
+      # **How it works.** Both images are decoded and analyzed by a biometric model (set `rotate_image=true` if
+      # captures may be sideways or upside down), then a similarity score between the two faces is computed. A score
+      # **strictly above** `face_match_score_decline_threshold` (default `30`) returns `status: "Approved"`; a score
+      # at or below it returns `Declined` with a `LOW_FACE_MATCH_SIMILARITY` warning. If no face pair can be scored at
+      # all, the call still returns `200` with `status: "Declined"` and a `NO_REFERENCE_IMAGE` warning - `score` is
+      # `null` on the default save path, or `0` with `save_api_request=false`. Submit one clear, front-facing face per
+      # image for best results.
+      #
+      # **Billing.** Each `200` response consumes one Face Match API credit (paid from your plan credit or top-up
+      # balance). When the organization's balance cannot cover the call, the endpoint returns `403` with the
+      # not-enough-credits error before any image processing.
+      #
+      # **Session persistence (`save_api_request`, default `true`).** When `true`, the call is persisted as an
+      # API-type session: it appears in the Business Console, the returned `request_id` is a real session id you can
+      # pass to `GET /v3/session/{sessionId}/decision/`, both images are stored as the session's face-match
+      # source/target images, and a `status.updated` webhook is emitted to your configured webhook endpoints. When
+      # `false`, nothing is stored and `request_id` is a one-off correlation UUID that cannot be looked up later.
+      #
+      # **Face search index.** This endpoint never enrolls faces into your face search index and never runs blocklist
+      # or duplicate screening - use `POST /v3/passive-liveness/` or `POST /v3/face-search/` for those.
+      #
+      # **Sandbox.** Sandbox API keys skip all processing and billing: after request validation (malformed input still
+      # returns `400`), the endpoint returns a static `Approved` mock payload, no session is persisted, and no credits
+      # are consumed.
+      #
+      # **Authentication.** Send your application's API key in the `x-api-key` header. Missing or invalid credentials
+      # return `403` (`{"detail": "You do not have permission to perform this action."}`) - this API never returns
+      # `401`.
+      #
+      # **Rate limit.** Shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # +POST /v3/face-match/+
+      #
+      # @param user_image [Pathname, IO, String, Didit::FilePart] Live or candidate face image to verify (e.g. a
+      #   selfie). Submit a single front-facing photo with the subject's face clearly visible and well lit. Allowed
+      #   extensions: `tiff`, `jpg`, `jpeg`, `png`, `webp`. Maximum upload size: **5 MB** (larger files are rejected
+      #   with `400`). Images are automatically compressed to ~0.5 MB before processing, so very high resolutions do not
+      #   improve accuracy.
+      # @param ref_image [Pathname, IO, String, Didit::FilePart] Reference face image to compare against (e.g. an ID
+      #   document portrait or a previously enrolled photo). Same format and size limits as `user_image`.
+      # @param face_match_score_decline_threshold [Numeric] Similarity threshold (0-100) that drives the response
+      #   `status`. A computed score **at or below** this value sets `status` to `Declined` and adds a
+      #   `LOW_FACE_MATCH_SIMILARITY` warning; a score strictly above it returns `Approved`. Default `30` is permissive
+      #   - raise it (e.g. `50`-`60`) for stricter verification. Values outside 0-100 return `400`.
+      # @param rotate_image [Boolean] When `true`, the service tries the input images in 90-degree increments (0, 90,
+      #   180, 270) and uses the orientation that yields the best face detection - useful for mobile captures with
+      #   missing EXIF orientation. Adds latency, so only enable it if you cannot guarantee upright images.
+      # @param save_api_request [Boolean] When `true` (default), persists the call as an API-type session - visible in
+      #   the Business Console, retrievable via `GET /v3/session/{sessionId}/decision/` using the returned `request_id`,
+      #   and announced through a `status.updated` webhook. When `false`, nothing is stored and `request_id` is a
+      #   transient UUID for response correlation only.
+      # @param vendor_data [String] Optional opaque string (your internal user id, email, UUID…) stored on the
+      #   persisted session and echoed back in the response. Use it to correlate API calls with your own records and to
+      #   filter sessions later.
+      # @param metadata [Hash] Optional JSON object stored with the session (when `save_api_request=true`) and echoed
+      #   back in the response. In multipart requests, send it as a JSON-encoded string field (e.g.
+      #   `metadata={"flow":"login"}`) - it is parsed into an object.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FaceMatchCompareResponse]
+      def compare(
+        user_image:,
+        ref_image:,
+        face_match_score_decline_threshold: OMIT,
+        rotate_image: OMIT,
+        save_api_request: OMIT,
+        vendor_data: OMIT,
+        metadata: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/face-match/",
+          body: {
+            "user_image" => user_image,
+            "ref_image" => ref_image,
+            "face_match_score_decline_threshold" => face_match_score_decline_threshold,
+            "rotate_image" => rotate_image,
+            "save_api_request" => save_api_request,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata
+          },
+          encoding: :multipart,
+          file_fields: %w[ref_image user_image],
+          response: Types::FaceMatchCompareResponse,
+          request_options: request_options
+        )
+      end
+    end
+  end
+end

data/lib/didit/resources/face_search.rb

@@ -0,0 +1,103 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +face_search+ resource.
+    class FaceSearch < Didit::Resource
+      # Face Search
+      #
+      # Search a face image (1:N) against your application's face search index - faces enrolled from verification
+      # sessions, saved standalone API calls, direct user-profile face uploads, and your block/allow lists - and get
+      # back ranked similarity matches plus blocklist and duplicate warnings.
+      #
+      # **How it works.** The largest detected face in `user_image` is embedded and searched against the index, scoped
+      # to your application. Up to **5 matches** above the similarity floor are returned in `matches`, each with
+      # `similarity_percentage`, the originating session (`session_id`, `session_number`, `status`, `vendor_data`),
+      # `user_details` extracted during that session's document verification, `is_blocklisted` / `is_allowlisted`
+      # flags, and a `source` discriminator (`session`, `imported`, or `list_entry`).
+      #
+      # - `search_type=most_similar` (default) ranks every enrolled face by similarity - use it for deduplication and
+      #   fraud-ring investigation.
+      # - `search_type=blocklisted_or_approved` restricts candidates to blocklisted faces, allowlisted faces, faces
+      #   from approved sessions, and imported user-profile faces, ranking blocklisted entries first - use it when the
+      #   primary goal is blocklist screening.
+      #
+      # `status` is `Declined` only when a `FACE_IN_BLOCKLIST` or `POSSIBLE_FACE_IN_BLOCKLIST` warning fires;
+      # `DUPLICATED_FACE` / `POSSIBLE_DUPLICATED_FACE` (`information`) and `MULTIPLE_FACES_DETECTED` (`warning`) never
+      # decline. Unlike Passive Liveness, this endpoint does **not** exclude prior sessions with the same
+      # `vendor_data` from matching. A passive-liveness analysis also runs internally and is stored with the persisted
+      # session, but its result is not part of this response.
+      #
+      # **Billing.** Each `200` response consumes one Face Search API credit (paid from your plan credit or top-up
+      # balance). Insufficient balance returns `403` before any image processing.
+      #
+      # **Session persistence and face enrollment (`save_api_request`, default `true`).** When `true`, the call is
+      # persisted as an API-type session (Business Console, `GET /v3/session/{sessionId}/decision/` via the returned
+      # `request_id`, `status.updated` webhook) and the searched face is enrolled into your face search index. Faces
+      # enrolled by Face Search calls are excluded from future Face Search results, so repeated searches never match
+      # each other. When `false`, the call is one-shot: nothing is stored, the face is not enrolled, and
+      # `match_image_url` values are internal storage paths rather than downloadable URLs.
+      #
+      # **Sandbox.** Sandbox API keys skip all processing and billing: after request validation (malformed input still
+      # returns `400`), the endpoint returns a static `Approved` mock payload, no session is persisted, and no credits
+      # are consumed.
+      #
+      # **Authentication.** Send your application's API key in the `x-api-key` header. Missing or invalid credentials
+      # return `403` (`{"detail": "You do not have permission to perform this action."}`) - this API never returns
+      # `401`.
+      #
+      # **Rate limit.** Shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # +POST /v3/face-search/+
+      #
+      # @param user_image [Pathname, IO, String, Didit::FilePart] Front-facing face image to search with. Allowed
+      #   extensions: `tiff`, `jpg`, `jpeg`, `png`, `webp`. Maximum upload size: **5 MB** (larger files are rejected
+      #   with `400`). Images are automatically compressed to ~0.5 MB before processing, so very high resolutions do not
+      #   improve accuracy. The image must contain at least one detectable face - otherwise the endpoint returns `400`.
+      #   When several faces are...
+      # @param search_type [String] Search policy. `most_similar` (default) ranks every enrolled face in your
+      #   application by similarity. `blocklisted_or_approved` restricts candidates to blocklisted faces, allowlisted
+      #   faces, faces from approved sessions, and imported user-profile faces - with blocklisted entries ranked first.
+      # @param rotate_image [Boolean] When `true`, the service tries 90-degree rotations of the input and uses the
+      #   orientation that yields the best face detection. Useful when EXIF orientation is missing. Adds latency.
+      # @param save_api_request [Boolean] When `true` (default), persists the call as an API-type session, emits a
+      #   `status.updated` webhook, presigns `match_image_url` values, and enrolls the searched face into your face
+      #   search index (Face Search enrollments are excluded from future searches). When `false`, the search is one-shot
+      #   - no session is stored and the face is not enrolled.
+      # @param vendor_data [String] Optional opaque identifier (your user id, email, UUID…) stored on the persisted
+      #   session and echoed back. It does not exclude same-user faces from the search results.
+      # @param metadata [Hash] Optional JSON object stored with the session (when `save_api_request=true`) and echoed
+      #   back. In multipart requests, send it as a JSON-encoded string field - it is parsed into an object.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FaceSearchSearchResponse]
+      def search(
+        user_image:,
+        search_type: OMIT,
+        rotate_image: OMIT,
+        save_api_request: OMIT,
+        vendor_data: OMIT,
+        metadata: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/face-search/",
+          body: {
+            "user_image" => user_image,
+            "search_type" => search_type,
+            "rotate_image" => rotate_image,
+            "save_api_request" => save_api_request,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata
+          },
+          encoding: :multipart,
+          file_fields: %w[user_image],
+          response: Types::FaceSearchSearchResponse,
+          request_options: request_options
+        )
+      end
+    end
+  end
+end

data/lib/didit/resources/fraud_checks.rb

@@ -0,0 +1,130 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +fraud_checks+ resource.
+    class FraudChecks < Didit::Resource
+      # Run a Fraud Check
+      #
+      # Submit one or more typed identifiers and receive normalization, fresh enrichment, authoritative validation
+      # where the country and identifier type are covered, independent risk dimensions and a recommendation in one
+      # response.
+      #
+      # These profiles support identifier checks. Selfie-based identity binding (`biometric_identity`) requires
+      # profile version `2026-09-14.2` and a Brazilian CPF; it runs only with the user's consent and when your
+      # organization is entitled to it. Earlier versions report it as `not_available_in_profile_version`. Modules that
+      # cannot run are reported as skipped with a deterministic reason; a source that could not answer is never
+      # reported as an identity mismatch.
+      #
+      # +POST /v3/fraud/checks/+
+      #
+      # @param subject [Hash]
+      # @param client_reference [String] Your own reference for this check. Doubles as the idempotency key: reusing it
+      #   with the same body returns the original check without running or billing the modules again; reusing it with a
+      #   different body returns 409.
+      # @param profile [String] Orchestration profile id. Defaults to the Didit `standard` profile.
+      # @param profile_version [String] Pin a frozen profile version. Defaults to the current version of the profile.
+      # @param context [Hash]
+      # @param checks [Hash]
+      # @param vendor_data [String]
+      # @param metadata [Object]
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FraudCheckResponse]
+      def create(
+        subject:,
+        client_reference: OMIT,
+        profile: OMIT,
+        profile_version: OMIT,
+        context: OMIT,
+        checks: OMIT,
+        vendor_data: OMIT,
+        metadata: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/fraud/checks/",
+          body: {
+            "subject" => subject,
+            "client_reference" => client_reference,
+            "profile" => profile,
+            "profile_version" => profile_version,
+            "context" => context,
+            "checks" => checks,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata
+          },
+          response: Types::FraudCheckResponse,
+          request_options: request_options
+        )
+      end
+
+      # Plan a Fraud Check
+      #
+      # Validate selected checks and estimate their price without executing, creating a session or billing.
+      #
+      # +POST /v3/fraud/checks/plan/+
+      #
+      # @param subject [Hash]
+      # @param client_reference [String] Your own reference for this check. Doubles as the idempotency key: reusing it
+      #   with the same body returns the original check without running or billing the modules again; reusing it with a
+      #   different body returns 409.
+      # @param profile [String] Orchestration profile id. Defaults to the Didit `standard` profile.
+      # @param profile_version [String] Pin a frozen profile version. Defaults to the current version of the profile.
+      # @param context [Hash]
+      # @param checks [Hash]
+      # @param vendor_data [String]
+      # @param metadata [Object]
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FraudCheckPlan]
+      def plan(
+        subject:,
+        client_reference: OMIT,
+        profile: OMIT,
+        profile_version: OMIT,
+        context: OMIT,
+        checks: OMIT,
+        vendor_data: OMIT,
+        metadata: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/fraud/checks/plan/",
+          body: {
+            "subject" => subject,
+            "client_reference" => client_reference,
+            "profile" => profile,
+            "profile_version" => profile_version,
+            "context" => context,
+            "checks" => checks,
+            "vendor_data" => vendor_data,
+            "metadata" => metadata
+          },
+          response: Types::FraudCheckPlan,
+          request_options: request_options
+        )
+      end
+
+      # Retrieve a Fraud Check
+      #
+      # Fetch a previously created check by its `check_id`.
+      #
+      # +GET /v3/fraud/checks/{check_id}/+
+      #
+      # @param check_id [String]
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FraudCheckResponse]
+      def retrieve(check_id, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/fraud/checks/{check_id}/",
+          path_params: { "check_id" => check_id },
+          response: Types::FraudCheckResponse,
+          request_options: request_options
+        )
+      end
+    end
+  end
+end