> For the complete documentation index, see [llms.txt](https://docs.facephi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.facephi.com/docs.facephi-en/rest-api/midapi-v2/flujo-comun.md).

# Common flow

The validation services that work **by reference** share the same startup: obtain the token, create an operation, and upload the assets to storage. Only then is the specific service invoked with the keys obtained.

This page brings that startup together so it doesn't have to be repeated in each service. Each step links to the page that documents its contract.

### Diagram

```mermaid
sequenceDiagram
    actor C as Consumer
    participant API as MIDAPI v2

    C->>API: POST /consumer/token
    API-->>C: consumer token (valid for 1 h)

    C->>API: POST /operation
    API-->>C: operationId + expiresAt

    loop For each asset: front, back, selfie
        C->>API: POST /storage (content + context)
        API-->>C: fileKey
    end

    C->>API: Validation service (fileKeys + operation-id)
    API-->>C: Service result
```

### The steps

1. **Obtain the consumer token.** A single token authenticates all subsequent calls and is valid for one hour. It is issued on behalf of the platform and for a specific consumer. See [Authentication](/docs.facephi-en/rest-api/midapi-v2/autenticacion.md).
2. **Create the operation.** The operation groups the session assets and sets an expiration for them. It is created with `POST /operation`, which returns the `operationId` and its `expiresAt`. **when capture starts**, not before, because the expiration clock starts at that moment. See [Create Operation](/docs.facephi-en/rest-api/midapi-v2/operations/create-operation.md).
3. **Upload each asset.** One call per capture, declaring the **context** that corresponds to it. Each upload returns the `fileKey` with which the asset is later referenced. See [Save Asset](/docs.facephi-en/rest-api/midapi-v2/storage/save-asset.md), and [Storage](/docs.facephi-en/rest-api/midapi-v2/storage.md) for the available contexts and the key format.
4. **Invoke the validation service.** The keys are sent `fileKeys` **exactly as returned by** `POST /storage`, with the `operationId` in the header `operation-id`. The key is not composed or interpreted: adding the context yourself leaves it duplicated and the asset does not resolve. If you need to recover the keys for an operation, they are in [Get File Keys](/docs.facephi-en/rest-api/midapi-v2/operations/get-file-keys.md).

### Which services follow this Flow

The validation services **identity** support the two asset modes by default, inline content and reference by key, and this Flow is the one for reference mode. The exceptions are explicit:

| Service                                                                                                                                                                                           | Supported modes                        |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
| [Form OCR](/docs.facephi-en/rest-api/midapi-v2/document-services/form-ocr.md)                                                                                                                     | Inline content only                    |
| [Voice Enrollment](/docs.facephi-en/rest-api/midapi-v2/voice-services/voice-enrollment.md) and [Voice Authentication](/docs.facephi-en/rest-api/midapi-v2/voice-services/voice-authentication.md) | Inline content only, no field `source` |
| [Document Validation](/docs.facephi-en/rest-api/midapi-v2/document-services/document-validation.md)                                                                                               | Reference only, no field `source`      |

The services that are exclusively inline do not go through steps 2 and 3: the content travels in the call itself and they do not carry a header `operation-id`.