Injection Attack Detection (IAD)

Service that analyzes the capture and determines whether the video flow was injected instead of coming from the device camera.

Accepts the binary inline or by reference to the asset TOKEN_BIN_IAD. A single asset slot, interpreted according to source.

Endpoint

POST /behavioral/iad

Headers

Name	Type	Required	Description
Authorization	string	Yes	consumer Token in the format Bearer <token>. See Authentication.
consumer-id	string	Yes	Consumer identifier.
operation-id	string	Conditional	Identifier of the operation to which the referenced assets belong. Required when source is FILE_KEY. See Storage.

Request body

Content-Type: application/json

Parameters

Parameter	Type	Required	Description
source	string	Yes	Mode in which the assets are provided: FILE_KEY for stored asset keys, FILE for content in Base64. See Storage.
file	string	Yes	IAD capture: asset key TOKEN_BIN_IAD or the binary in Base64.

Request example

{
  "source": "FILE_KEY",
  "file": "0192a3f4-7b21-7c44-9e1a-3f5b8c2d1e04/TOKEN_BIN_IAD"
}

Responses

200 Success

Response parameters

Parameter	Type	Description
consumerId	string	Identifier of the consumer that made the call.
transactionId	string	Transaction identifier.
timestamp	string	Response timestamp in format ISO 8601.
message	string	Descriptive field for the result of the service execution.
livenessResult	string	Result of the liveness check: LIVE, NO_LIVE or ERROR.
captureLivenessResult	string	Result of the Injection Attack Detection: NO_ATTACK, ATTACK or ERROR.
extractedImage	string	Best image extracted from the capture, in Base64.
description	string	Details of the analysis performed.

When storing a TOKEN_BIN_IAD with Save Asset the context is also available TOKEN_BEST_IMAGE of the same operation, so that a single call leaves the IAD and selfie assets ready.

Other responses

Code	Description
400	Required field missing or unsupported value; missing header operation-id with references; or a key does not have the form {operationId}/{CONTEXTO} or declares a context that the slot does not support.
403	The consumer is not provisioned with the service CAPTURE_LIVENESS.
404	The operation declared in operation-id does not exist or belongs to another consumer.
409	A referenced asset contains content already processed in another operation.
410	The operation declared in operation-id has expired.
422	A key names an operation different from the one declared in operation-id, or the context has no stored asset.
429	The consumer has exceeded its request rate limit, or a referenced asset has exhausted its invocation budget on this Endpoint. In the first case the response includes Retry-After, X-RateLimit-Limit and X-RateLimit-Burst, and waiting resolves it; in the second it does not. The underlying service is not invoked and the call is not billed.

The body of an error response has the form described in MIDAPI v2.