ontiver 0.1.0__py3-none-any.whl

ontiver/__init__.py

@@ -0,0 +1,33 @@
+from .client import OntiverClient
+from .errors import (
+    AuthenticationError,
+    NetworkError,
+    NotFoundError,
+    OntiverAPIError,
+    OntiverConfigError,
+    OntiverError,
+    PermissionDeniedError,
+    RateLimitError,
+    ServerError,
+    TimeoutError,
+    ValidationError,
+    WebhookSignatureError,
+)
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "OntiverClient",
+    "OntiverError",
+    "OntiverConfigError",
+    "OntiverAPIError",
+    "AuthenticationError",
+    "PermissionDeniedError",
+    "ValidationError",
+    "RateLimitError",
+    "NotFoundError",
+    "ServerError",
+    "TimeoutError",
+    "NetworkError",
+    "WebhookSignatureError",
+]

ontiver/client.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any
+
+import httpx
+
+from .config import OntiverConfig
+from .http import OntiverHTTPClient
+from .resources.proofs import ProofsResource
+from .resources.screening import ScreeningResource
+from .resources.verifications import VerificationsResource
+from .resources.webhook_management import WebhookManagementResource
+
+
+class OntiverClient:
+    def __init__(
+        self,
+        api_key: str | None = None,
+        base_url: str | None = None,
+        environment: str | None = None,
+        timeout: float = 30,
+        max_retries: int = 2,
+        webhook_secret: str | None = None,
+        http_client: httpx.Client | None = None,
+    ) -> None:
+        self.config = OntiverConfig.from_env(
+            api_key=api_key,
+            base_url=base_url,
+            environment=environment,
+            webhook_secret=webhook_secret,
+            timeout=timeout,
+            max_retries=max_retries,
+        )
+        self._http = OntiverHTTPClient(self.config, client=http_client)
+        self.webhooks = WebhookManagementResource(self._http)
+        self.verifications = VerificationsResource(self._http)
+        self.screening = ScreeningResource(self._http)
+        self.proofs = ProofsResource(self._http)
+
+    @classmethod
+    def from_env(cls) -> "OntiverClient":
+        return cls()
+
+    def close(self) -> None:
+        self._http.close()
+
+    def __enter__(self) -> "OntiverClient":
+        return self
+
+    def __exit__(self, *_: object) -> None:
+        self.close()
+
+    def validate_api_key(self) -> dict[str, Any]:
+        return self._http.request("GET", "/api-keys/validate/current")
+
+    def raw_request(
+        self,
+        method: str,
+        path: str,
+        *,
+        json: Any | None = None,
+        params: Mapping[str, Any] | None = None,
+        headers: Mapping[str, str] | None = None,
+        idempotency_key: str | None = None,
+    ) -> Any:
+        return self._http.request(
+            method,
+            path,
+            json=json,
+            params=params,
+            headers=headers,
+            idempotency_key=idempotency_key,
+            unwrap=False,
+        )

ontiver/config.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from urllib.parse import urlparse
+
+from .errors import OntiverConfigError
+
+
+DEFAULT_BASE_URL = "https://api.ontiver.com"
+VALID_ENVIRONMENTS = {"production", "sandbox"}
+LOCAL_HOSTS = {"localhost", "127.0.0.1", "0.0.0.0", "::1"}
+
+
+@dataclass(frozen=True)
+class OntiverConfig:
+    api_key: str | None = None
+    base_url: str = DEFAULT_BASE_URL
+    environment: str = "production"
+    webhook_secret: str | None = None
+    timeout: float = 30
+    max_retries: int = 2
+
+    @classmethod
+    def from_env(
+        cls,
+        *,
+        api_key: str | None = None,
+        base_url: str | None = None,
+        environment: str | None = None,
+        webhook_secret: str | None = None,
+        timeout: float = 30,
+        max_retries: int = 2,
+    ) -> "OntiverConfig":
+        return cls(
+            api_key=api_key if api_key is not None else os.getenv("ONTIVER_API_KEY"),
+            base_url=base_url or os.getenv("ONTIVER_BASE_URL") or DEFAULT_BASE_URL,
+            environment=environment or os.getenv("ONTIVER_ENVIRONMENT") or "production",
+            webhook_secret=webhook_secret if webhook_secret is not None else os.getenv("ONTIVER_WEBHOOK_SECRET"),
+            timeout=timeout,
+            max_retries=max_retries,
+        ).validated()
+
+    def validated(self) -> "OntiverConfig":
+        environment = str(self.environment or "").strip().lower()
+        if environment not in VALID_ENVIRONMENTS:
+            raise OntiverConfigError("environment must be 'production' or 'sandbox'")
+        base_url = normalize_base_url(self.base_url)
+        return OntiverConfig(
+            api_key=str(self.api_key).strip() if self.api_key else None,
+            base_url=base_url,
+            environment=environment,
+            webhook_secret=str(self.webhook_secret).strip() if self.webhook_secret else None,
+            timeout=float(self.timeout),
+            max_retries=max(0, int(self.max_retries)),
+        )
+
+
+def normalize_base_url(value: str | None) -> str:
+    raw = str(value or DEFAULT_BASE_URL).strip().rstrip("/")
+    parsed = urlparse(raw)
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        raise OntiverConfigError("base_url must be an absolute HTTP(S) URL")
+    hostname = (parsed.hostname or "").lower()
+    if parsed.scheme != "https" and hostname not in LOCAL_HOSTS:
+        raise OntiverConfigError("HTTPS is required for non-local Ontiver API base URLs")
+    return raw

ontiver/errors.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+
+_SENSITIVE_PATTERNS = [
+    re.compile(r"Bearer\s+[A-Za-z0-9._\-]+", re.IGNORECASE),
+    re.compile(r"\b(prod|sb)_[A-Za-z0-9._\-]+"),
+    re.compile(r"\bwhsec_[A-Za-z0-9._\-]+"),
+    re.compile(r"\bsec_[A-Za-z0-9._\-]+"),
+]
+
+
+def redact(value: Any) -> str:
+    text = str(value or "")
+    for pattern in _SENSITIVE_PATTERNS:
+        text = pattern.sub("[REDACTED]", text)
+    return text
+
+
+class OntiverError(Exception):
+    """Base SDK exception."""
+
+
+class OntiverConfigError(OntiverError):
+    """Raised when SDK configuration is missing or unsafe."""
+
+
+class OntiverAPIError(OntiverError):
+    def __init__(
+        self,
+        message: str,
+        *,
+        status_code: int | None = None,
+        code: str | None = None,
+        request_id: str | None = None,
+    ) -> None:
+        self.status_code = status_code
+        self.code = code
+        self.request_id = request_id
+        super().__init__(redact(message))
+
+
+class AuthenticationError(OntiverAPIError):
+    pass
+
+
+class PermissionDeniedError(OntiverAPIError):
+    pass
+
+
+class ValidationError(OntiverAPIError):
+    pass
+
+
+class RateLimitError(OntiverAPIError):
+    pass
+
+
+class NotFoundError(OntiverAPIError):
+    pass
+
+
+class ServerError(OntiverAPIError):
+    pass
+
+
+class TimeoutError(OntiverAPIError):
+    pass
+
+
+class NetworkError(OntiverAPIError):
+    pass
+
+
+class WebhookSignatureError(OntiverError):
+    pass

ontiver/http.py

@@ -0,0 +1,161 @@
+from __future__ import annotations
+
+import time
+import uuid
+from collections.abc import Mapping
+from typing import Any
+
+import httpx
+
+from .config import OntiverConfig
+from .errors import (
+    AuthenticationError,
+    NetworkError,
+    NotFoundError,
+    OntiverAPIError,
+    OntiverConfigError,
+    PermissionDeniedError,
+    RateLimitError,
+    ServerError,
+    TimeoutError,
+    ValidationError,
+    redact,
+)
+
+
+RETRYABLE_STATUS_CODES = {408, 429, 500, 502, 503, 504}
+MUTATING_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+USER_AGENT_VERSION = "0.1.0"
+
+
+class OntiverHTTPClient:
+    def __init__(self, config: OntiverConfig, *, client: httpx.Client | None = None) -> None:
+        self.config = config
+        self._client = client or httpx.Client(timeout=config.timeout)
+
+    def close(self) -> None:
+        self._client.close()
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        json: Any | None = None,
+        params: Mapping[str, Any] | None = None,
+        headers: Mapping[str, str] | None = None,
+        idempotency_key: str | None = None,
+        unwrap: bool = True,
+        authenticated: bool = True,
+        auto_idempotency: bool = False,
+    ) -> Any:
+        method = method.upper()
+        url = self._url(path)
+        request_headers = self._headers(headers, authenticated=authenticated)
+        if method in MUTATING_METHODS and auto_idempotency and not idempotency_key:
+            idempotency_key = f"ontiver-sdk-{uuid.uuid4()}"
+        if idempotency_key:
+            request_headers["Idempotency-Key"] = idempotency_key
+
+        can_retry_mutation = method not in MUTATING_METHODS or bool(idempotency_key)
+        attempts = self.config.max_retries + 1 if can_retry_mutation else 1
+        last_exc: Exception | None = None
+        for attempt in range(attempts):
+            try:
+                response = self._client.request(method, url, json=json, params=params, headers=request_headers)
+            except httpx.TimeoutException as exc:
+                last_exc = exc
+                if attempt + 1 >= attempts:
+                    raise TimeoutError("Ontiver request timed out") from exc
+                self._sleep(attempt, None)
+                continue
+            except httpx.HTTPError as exc:
+                last_exc = exc
+                if attempt + 1 >= attempts:
+                    raise NetworkError("Ontiver network request failed") from exc
+                self._sleep(attempt, None)
+                continue
+
+            if response.status_code in RETRYABLE_STATUS_CODES and attempt + 1 < attempts:
+                self._sleep(attempt, response)
+                continue
+            return self._parse_response(response, unwrap=unwrap)
+
+        raise NetworkError(f"Ontiver request failed: {redact(last_exc)}")
+
+    def _url(self, path: str) -> str:
+        if not path.startswith("/"):
+            raise ValidationError("API path must start with '/'")
+        normalized = path if path.startswith("/api/") else f"/api/v1/banking{path}"
+        return f"{self.config.base_url}{normalized}"
+
+    def _headers(self, headers: Mapping[str, str] | None, *, authenticated: bool) -> dict[str, str]:
+        out = {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": f"ontiver-python/{USER_AGENT_VERSION}",
+        }
+        if headers:
+            for key, value in headers.items():
+                if key.lower() == "authorization":
+                    continue
+                out[key] = value
+        if authenticated:
+            if not self.config.api_key:
+                raise OntiverConfigError("ONTIVER_API_KEY is required for authenticated requests")
+            out["Authorization"] = f"Bearer {self.config.api_key}"
+        return out
+
+    def _parse_response(self, response: httpx.Response, *, unwrap: bool) -> Any:
+        request_id = response.headers.get("x-request-id") or response.headers.get("X-Request-Id")
+        try:
+            body = response.json()
+        except ValueError:
+            body = {"message": response.text}
+        if response.status_code >= 400:
+            raise self._error_for_response(response.status_code, body, request_id)
+        if unwrap and isinstance(body, dict) and "success" in body and "data" in body:
+            return body["data"]
+        return body
+
+    def _error_for_response(self, status_code: int, body: Any, request_id: str | None) -> OntiverAPIError:
+        code, message = self._extract_error(body)
+        kwargs = {"status_code": status_code, "code": code, "request_id": request_id}
+        if status_code == 401:
+            return AuthenticationError(message, **kwargs)
+        if status_code == 403:
+            return PermissionDeniedError(message, **kwargs)
+        if status_code == 404:
+            return NotFoundError(message, **kwargs)
+        if status_code in {400, 409, 422}:
+            return ValidationError(message, **kwargs)
+        if status_code == 408:
+            return TimeoutError(message, **kwargs)
+        if status_code == 429:
+            return RateLimitError(message, **kwargs)
+        if status_code >= 500:
+            return ServerError(message, **kwargs)
+        return OntiverAPIError(message, **kwargs)
+
+    def _extract_error(self, body: Any) -> tuple[str | None, str]:
+        if not isinstance(body, dict):
+            return None, "Ontiver API request failed"
+        detail = body.get("detail") or body.get("error") or body.get("message")
+        if isinstance(detail, dict):
+            code = detail.get("code")
+            message = detail.get("message") or detail.get("detail") or "Ontiver API request failed"
+            return str(code) if code else None, redact(message)
+        if isinstance(detail, str):
+            return str(body.get("code")) if body.get("code") else None, redact(detail)
+        return str(body.get("code")) if body.get("code") else None, "Ontiver API request failed"
+
+    def _sleep(self, attempt: int, response: httpx.Response | None) -> None:
+        retry_after = response.headers.get("Retry-After") if response is not None else None
+        if retry_after:
+            try:
+                delay = min(float(retry_after), 5.0)
+            except ValueError:
+                delay = 0.25
+        else:
+            delay = min(0.25 * (2**attempt), 2.0)
+        time.sleep(delay)

ontiver/py.typed

@@ -0,0 +1 @@
+

ontiver/resources/__init__.py

@@ -0,0 +1 @@
+

ontiver/resources/proofs.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ..http import OntiverHTTPClient
+
+
+class ProofsResource:
+    def __init__(self, http: OntiverHTTPClient) -> None:
+        self._http = http
+
+    def generate(
+        self,
+        proof_type: str,
+        statement: str,
+        *,
+        verification_id: str | None = None,
+        witness: dict[str, Any] | None = None,
+        public_signals: dict[str, Any] | None = None,
+        disclosure_fields: list[str] | None = None,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/zk-proof/generate",
+            json={
+                "proofType": proof_type,
+                "statement": statement,
+                "verificationId": verification_id,
+                "witness": witness,
+                "publicSignals": public_signals,
+                "disclosureFields": disclosure_fields,
+            },
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def get_for_verification(self, verification_id: str) -> dict[str, Any]:
+        return self._http.request("GET", f"/zk-proof/verification/{verification_id}")
+
+    def verify(self, proof_id: str, *, proof: dict[str, Any] | None = None, idempotency_key: str | None = None) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/zk-proof/verify",
+            json={"proofId": proof_id, "proof": proof},
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def disclose(self, proof_id: str, *, fields: list[str] | None = None, idempotency_key: str | None = None) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/zk-proof/disclose",
+            json={"proofId": proof_id, "fields": fields or []},
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )

ontiver/resources/screening.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ..http import OntiverHTTPClient
+
+
+class ScreeningResource:
+    def __init__(self, http: OntiverHTTPClient) -> None:
+        self._http = http
+
+    def pep_check(
+        self,
+        *,
+        name: str | None = None,
+        first_name: str | None = None,
+        last_name: str | None = None,
+        date_of_birth: str | None = None,
+        nationality: str | None = None,
+        fuzzy_matching: bool = True,
+        match_threshold: int = 90,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        return self._check("/screening/pep/check", name, first_name, last_name, date_of_birth, nationality, fuzzy_matching, match_threshold, idempotency_key)
+
+    def sanctions_check(
+        self,
+        *,
+        name: str | None = None,
+        first_name: str | None = None,
+        last_name: str | None = None,
+        date_of_birth: str | None = None,
+        nationality: str | None = None,
+        fuzzy_matching: bool = True,
+        match_threshold: int = 90,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        return self._check("/screening/sanctions/check", name, first_name, last_name, date_of_birth, nationality, fuzzy_matching, match_threshold, idempotency_key)
+
+    def adverse_media_check(
+        self,
+        first_name: str,
+        last_name: str,
+        *,
+        fuzzy_matching: bool = True,
+        match_threshold: int = 90,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/screening/adverse-media/check",
+            json={"firstName": first_name, "lastName": last_name, "fuzzyMatching": fuzzy_matching, "matchThreshold": match_threshold},
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def _check(
+        self,
+        path: str,
+        name: str | None,
+        first_name: str | None,
+        last_name: str | None,
+        date_of_birth: str | None,
+        nationality: str | None,
+        fuzzy_matching: bool,
+        match_threshold: int,
+        idempotency_key: str | None,
+    ) -> dict[str, Any]:
+        payload = {
+            "name": name,
+            "firstName": first_name,
+            "lastName": last_name,
+            "dateOfBirth": date_of_birth,
+            "nationality": nationality,
+            "fuzzyMatching": fuzzy_matching,
+            "matchThreshold": match_threshold,
+        }
+        return self._http.request("POST", path, json=payload, idempotency_key=idempotency_key, auto_idempotency=True)

ontiver/resources/verifications.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ..http import OntiverHTTPClient
+
+
+class VerificationsResource:
+    def __init__(self, http: OntiverHTTPClient) -> None:
+        self._http = http
+
+    def create(self, payload: dict[str, Any], *, idempotency_key: str | None = None) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/kyc/individual/verify",
+            json=payload,
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def get(self, verification_id: str) -> dict[str, Any]:
+        return self._http.request("GET", f"/kyc/individual/{verification_id}")

ontiver/resources/webhook_management.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+from typing import Any
+
+from ..http import OntiverHTTPClient
+
+
+class WebhookManagementResource:
+    def __init__(self, http: OntiverHTTPClient) -> None:
+        self._http = http
+
+    def register(
+        self,
+        url: str,
+        events: list[str],
+        *,
+        secret: str | None = None,
+        active: bool = True,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            "/webhooks/register",
+            json={"url": url, "events": events, "secret": secret, "active": active},
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def list(self, *, active: bool | None = None) -> dict[str, Any]:
+        params = {} if active is None else {"active": active}
+        return self._http.request("GET", "/webhooks", params=params)
+
+    def delete(self, webhook_id: str, *, idempotency_key: str | None = None) -> dict[str, Any]:
+        return self._http.request(
+            "DELETE",
+            f"/webhooks/{webhook_id}",
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )
+
+    def test(
+        self,
+        *,
+        webhook_id: str | None = None,
+        url: str | None = None,
+        event_type: str = "verification.completed",
+        payload: dict[str, Any] | None = None,
+        idempotency_key: str | None = None,
+    ) -> dict[str, Any]:
+        body = {"webhookId": webhook_id, "webhookUrl": url, "eventType": event_type, "payload": payload or {}}
+        path = f"/webhooks/{webhook_id}/test" if webhook_id else "/webhooks/test"
+        return self._http.request("POST", path, json=body, idempotency_key=idempotency_key, auto_idempotency=True)
+
+    def rotate_secret(self, webhook_id: str, *, idempotency_key: str | None = None) -> dict[str, Any]:
+        return self._http.request(
+            "POST",
+            f"/webhooks/{webhook_id}/rotate-secret",
+            idempotency_key=idempotency_key,
+            auto_idempotency=True,
+        )

ontiver/webhooks.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import hmac
+from hashlib import sha256
+
+from .errors import WebhookSignatureError
+
+
+def verify_webhook_signature(payload: bytes | str, signature: str | None, secret: str) -> bool:
+    if not signature or not secret:
+        return False
+    raw = payload.encode("utf-8") if isinstance(payload, str) else payload
+    provided = signature.strip()
+    if provided.startswith("sha256="):
+        provided = provided[len("sha256=") :]
+    digest = hmac.new(secret.encode("utf-8"), raw, sha256).hexdigest()
+    return hmac.compare_digest(digest, provided)
+
+
+def require_webhook_signature(payload: bytes | str, signature: str | None, secret: str) -> None:
+    if not verify_webhook_signature(payload, signature, secret):
+        raise WebhookSignatureError("Invalid Ontiver webhook signature")

ontiver-0.1.0.dist-info/METADATA

@@ -0,0 +1,238 @@
+Metadata-Version: 2.4
+Name: ontiver
+Version: 0.1.0
+Summary: Official Python SDK for the Ontiver API
+Author: Ontiver
+License-Expression: LicenseRef-Proprietary
+Project-URL: Homepage, https://ontiver.com
+Project-URL: Documentation, https://docs.ontiver.com
+Project-URL: Repository, https://github.com/joinverza/Ontiver
+Keywords: ontiver,kyc,aml,identity,proofs,webhooks
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: httpx<1,>=0.27
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
+Provides-Extra: build
+Requires-Dist: build>=1.2; extra == "build"
+Requires-Dist: twine>=5; extra == "build"
+
+# Ontiver Python SDK
+
+Official Python SDK for integrating Ontiver verification, screening, proofs, and webhooks into enterprise backends.
+
+The dashboard remains the control plane for API keys, scopes, billing, team roles, webhooks, and audit logs. The SDK is the integration layer for Django, Flask, FastAPI, workers, and internal services.
+
+## Install Locally
+
+From this repository:
+
+```bash
+cd sdks/python
+python -m pip install -e ".[test]"
+```
+
+After publication:
+
+```bash
+python -m pip install ontiver
+```
+
+## Configuration
+
+Create an API key from the Ontiver enterprise dashboard and store it in your secret manager.
+
+```bash
+ONTIVER_API_KEY=prod_xxx
+ONTIVER_BASE_URL=https://api.ontiver.com
+ONTIVER_ENVIRONMENT=production
+ONTIVER_WEBHOOK_SECRET=whsec_xxx
+```
+
+Use sandbox keys in non-production environments:
+
+```bash
+ONTIVER_API_KEY=sb_xxx
+ONTIVER_ENVIRONMENT=sandbox
+```
+
+## Quickstart
+
+```python
+from ontiver import OntiverClient
+
+client = OntiverClient.from_env()
+
+startup_check = client.validate_api_key()
+print(startup_check["valid"])
+```
+
+## Verification
+
+SDK v1 routes flexible verification payloads to:
+
+```text
+POST /api/v1/banking/kyc/individual/verify
+GET  /api/v1/banking/kyc/individual/{verificationId}
+```
+
+```python
+result = client.verifications.create(
+    {
+        "customerId": "cust_123",
+        "firstName": "Ada",
+        "lastName": "Okafor",
+        "country": "NG",
+        "idDocumentType": "passport",
+        "idDocumentNumber": "A12345678",
+    },
+    idempotency_key="verify-cust-123",
+)
+
+status = client.verifications.get(result["verificationId"])
+```
+
+## Screening
+
+```python
+screening = client.screening.sanctions_check(
+    first_name="Ada",
+    last_name="Okafor",
+    nationality="NG",
+    idempotency_key="sanctions-cust-123",
+)
+```
+
+Supported methods:
+
+- `client.screening.pep_check(...)`
+- `client.screening.sanctions_check(...)`
+- `client.screening.adverse_media_check(first_name, last_name, ...)`
+
+## Proofs
+
+```python
+proof = client.proofs.get_for_verification("ver_123")
+
+verified = client.proofs.verify(
+    proof_id=proof["proofId"],
+    proof=proof.get("proof"),
+)
+```
+
+Supported methods:
+
+- `client.proofs.generate(...)`
+- `client.proofs.get_for_verification(verification_id)`
+- `client.proofs.verify(proof_id, proof=None)`
+- `client.proofs.disclose(proof_id, fields=[...])`
+
+## Webhooks
+
+Register a webhook:
+
+```python
+webhook = client.webhooks.register(
+    "https://example.com/webhooks/ontiver",
+    ["verification.completed", "proof.issued"],
+)
+
+# Store this once. It will not be returned by list endpoints.
+secret = webhook["secret"]
+```
+
+Verify webhook signatures using the raw request body:
+
+```python
+from ontiver.webhooks import verify_webhook_signature
+
+is_valid = verify_webhook_signature(raw_body, request.headers["X-Ontiver-Signature"], secret)
+```
+
+Header format:
+
+```text
+X-Ontiver-Signature: sha256=<hex_digest>
+```
+
+## Raw Request Escape Hatch
+
+Use `raw_request()` for routes that do not have first-class wrappers yet:
+
+```python
+result = client.raw_request(
+    "POST",
+    "/aml/smile-checks",
+    json={"fullName": "Ada Okafor", "countries": ["NG"]},
+    idempotency_key="aml-cust-123",
+)
+```
+
+## Errors
+
+Catch specific exceptions:
+
+```python
+from ontiver import AuthenticationError, PermissionDeniedError, RateLimitError, ValidationError
+
+try:
+    client.validate_api_key()
+except AuthenticationError:
+    ...
+except PermissionDeniedError:
+    ...
+except RateLimitError:
+    ...
+except ValidationError:
+    ...
+```
+
+The SDK redacts API keys, bearer tokens, webhook secrets, and secret prefixes from exception messages.
+
+## Security Notes
+
+- Never commit API keys or webhook secrets.
+- Store production secrets in a secret manager.
+- Use least-privilege API key scopes.
+- Use sandbox keys outside production.
+- Verify webhook signatures over the raw body bytes before parsing JSON.
+- Do not log raw identity documents, ID numbers, biometric payloads, or full provider payloads.
+
+## Build And Publish
+
+Build locally:
+
+```bash
+cd sdks/python
+python -m pip install -e ".[test]"
+pytest
+python -m pip install ".[build]"
+python -m build
+python -m twine check dist/*
+```
+
+Publish first to TestPyPI:
+
+```bash
+python -m twine upload --repository testpypi dist/*
+```
+
+Install from TestPyPI in a clean environment:
+
+```bash
+python -m pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple ontiver
+```
+
+Publish to PyPI after TestPyPI install passes:
+
+```bash
+python -m twine upload dist/*
+```
+
+Target package name: `ontiver`.

ontiver-0.1.0.dist-info/RECORD

@@ -0,0 +1,16 @@
+ontiver/__init__.py,sha256=27ivsYmiNZDcUcEgjJ0ii4Z_iopJg73swm_jOC3_Dco,651
+ontiver/client.py,sha256=lP_39wundvdjRS5xHXHG3n7_nnuw_bxggNwnLmDQ8fo,2201
+ontiver/config.py,sha256=RcxzeBEtb4DPvKbeTSF2uWte2azoK0kX_1FsNRTfq38,2500
+ontiver/errors.py,sha256=7GuKHLwMTG2T7iFxxzmgK9vd6jPsGtCOUuNPRU2Hz40,1459
+ontiver/http.py,sha256=F9DrwXSv-4YwUiE1FeFmIHCQVHK5UBD82HWM2AIGx7U,6375
+ontiver/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+ontiver/webhooks.py,sha256=kxE7xcnqCh3gBFFlKrRKPm2Hs56OcZy8YySQW9d0w4U,823
+ontiver/resources/__init__.py,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+ontiver/resources/proofs.py,sha256=evPvliiFueeBBuO3dGpOWvDLpD0obWw2krEcrbgtrqw,1949
+ontiver/resources/screening.py,sha256=k-efMsRZh28A2sbzFiT9SN0gljFbSuLViLUyrbtOFvI,2611
+ontiver/resources/verifications.py,sha256=vHv02UTKNzGRt-wpftOnsMia8aOJuoTTJeHw3BKbLrQ,664
+ontiver/resources/webhook_management.py,sha256=fwyR8dnc6a4_Wn0-9ouvjXCsoDsY3p8nq0uSZJi3O9Y,2074
+ontiver-0.1.0.dist-info/METADATA,sha256=5j-2s9i5ZyUP-SGhFBjutcGc0dpOKI1oTa1czCnB2zM,5669
+ontiver-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+ontiver-0.1.0.dist-info/top_level.txt,sha256=umC5Q1gRMQ-rSI3UCMlFG-c-jrJ_T0J47iLkC7hEHUE,8
+ontiver-0.1.0.dist-info/RECORD,,

ontiver-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

ontiver-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+ontiver