Identity data

Claims and UserInfo

UserInfo returns an application-specific subject and only the verified information approved in the current authorization.

Request

GET/v1/userinfo

Authenticate with the OAuth access token. Do not use a portal session token or client secret.

curl https://api.dev.unifyid.io/v1/userinfo \
  -H "Authorization: Bearer {oauth_access_token}"

Disclosure rules

1The application enabled the scope
2The authorization request included it
3The person approved it
4Verified data exists and remains shareable
5UnifyID policy permits the disclosure

If any condition fails, the property is omitted. Do not interpret a missing property as a negative verification result.

Subject identifier

sub is stable for the person within one application and different across unrelated applications. Use it as your external identity key. Email, phone, handle, and legal name can change and must not be account keys.

Storage guidance

Consented claims are returned only inside the approved authorization boundary. Store only the approved data your product requires, encrypt it at rest, document retention, and remove it when consent or legal purpose ends. Do not cache access tokens in analytics, logs, or browser storage.

Documents

When identity_documents is approved, enumerate document references through /v1/userinfo/identity-documents and retrieve permitted details individually.