> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first.

# List verifications

> "GET /verifications: page through your verification history server to server."

```
GET /api/kyc/verifications
```

Your organisation's verification history, paginated and filterable — reconcile your records without keeping your own ledger of ids. Scoped to the key's environment, so a sandbox key never lists production traffic.

Records you have [deleted](/user-verification/server-api/manage-records) are not listed and are not counted in `total`.

**Authentication:** `Authorization: Bearer sk_…` (**secret key required**), like the [per-id result read](/user-verification/server-api/verification-result) beside it.

## Query parameters

| Parameter           | Description                                                                                                                                                                                                                                                  |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `status`            | One value from the [status vocabulary](/user-verification/server-api/verification-status) — the same words `/status/:id` and webhooks use, so the filter and the labels can never disagree. An unknown word is a `400 invalid_status` naming the vocabulary. |
| `channel`           | `sdk` (capture-flow verifications) or `dashboard` (spot checks).                                                                                                                                                                                             |
| `subjectType`       | `individual` or `business`.                                                                                                                                                                                                                                  |
| `country`           | ISO-2 country code.                                                                                                                                                                                                                                          |
| `idType`            | ID type (or the business product, which rides the same field).                                                                                                                                                                                               |
| `workflowId`        | The `wf_…` public id — every submission a workflow drove.                                                                                                                                                                                                    |
| `externalUserId`    | Your reference for the subject; matches sessions, entities and webhook payloads.                                                                                                                                                                             |
| `from` / `to`       | ISO dates bounding `createdAt`.                                                                                                                                                                                                                              |
| `page` / `pageSize` | Pagination; `pageSize` max 100, default 25.                                                                                                                                                                                                                  |

## Response

```json
{
  "verifications": [
    {
      "verificationId": "cmt…",
      "requestId": "order_1001",
      "externalUserId": "user_42",
      "metadata": { "loanId": "loan_20191" },
      "channel": "sdk",
      "subjectType": "individual",
      "status": "approved",
      "checkStatus": "verified",
      "reasonCode": null,
      "country": "NG",
      "idType": "bvn",
      "workflowId": "wf_AbC123dEf456",
      "workflowVersion": 3,
      "createdAt": "2026-08-20T12:00:00.000Z",
      "completedAt": "2026-08-20T12:00:04.512Z"
    }
  ],
  "total": 812,
  "page": 1,
  "pageSize": 25
}
```

Rows are deliberately light: identifiers and states, no biodata. `metadata` is your own customer metadata echoed unchanged, not something Toden derived. `status` is the outcome to act on (what the checks, your workflow or a reviewer concluded); `checkStatus` is what the automated checks themselves found, so approving a failed check (an exception) stays distinguishable from approving a passing one. See [Status and checkStatus](/user-verification/concepts/verifications#status-and-checkstatus). The full result, PII included, lives on [`GET /verifications/:id`](/user-verification/server-api/verification-result).

Business rows additionally carry `businessName`.