Qualified eSignature (QES) Beta

Some countries (such as Germany) enforce stricter standards on user verification. One way to follow such standards is by using a Qualified Electronic Signature (QES). For Germany, this option requires a SEPA transfer into the user's Wallet as an extra validation step.

Treezor relies on a user verification provider for QES services. In this process, you redirect end users to a URL where they follow the verification steps. The identity document uploaded during these steps is digitally signed according to QES standards.

Configuration – Environment configuration by Treezor

Contact Treezor to use the qualified eSignature feature.

Process

1. You initiate QES verification for the User:
   /v1/users/{userId}/qes
2. Treezor answers with the QES URL (identificationURL).
3. You redirect the User to the identificationURL
4. The User follows the step-by-step QES verification process, hence uploading the document.
5. Treezor informs you of the documents processing with the QES webhooks.
6. Once the qes.finalized webhook returns a success Result, you may request a KYC review:
   /v1/users/{userId}/Kycreview
7. Treezor sends you the user.kycreview webhook upon validation or refusal.

Key attributes (webhooks)

QES verification relies on webhooks to provide you with information regarding the process:

• qes.created – Received when the user completes the QES verification process.
• qes.processing – Received when the QES verification process is under review on the verification provider side.
• qes.aborted – Received when the user abandons the QES process (see Aborted reasons list for more details).
• qes.finalized – Received when the verification process is done on the verification provider side, either successful or canceled (see Canceled reasons list for more details).

Below some of the key attributes you may find in these webhooks.

Attribute	Type	Description
result	string	Indicates whether the user was successfully verified on the provider side. Can be: START – The verification process has started. CHECK_PENDING – The user is currently being verified. FRAUD_SUSPICION_PENDING – Further verifications are made due to fraud suspicions. ABORTED – The end user abandoned the QES verification process. SUCCESS – The end user's identity is verified. SUCCESS_DATA_CHANGE – The end user's identity is verified with data adjustments from provider. FRAUD_SUSPICION_CONFIRMED – The user identity is verified and is suspected of committing fraud. CANCELED – The verification couldn't be carried out by the provider.
reason	object	Details about the result when necessary. See Reasons list below.

Reasons

The reason object of the webhook contains a reasonCode and a reasonMessage for you to better understand the result of the QES verification.

Aborted reasons

Here are the reasons you may find for aborted QES.

Code	Message	Description
3001	USER_CANCELLATION_DOCUMENT_NOT_ACCEPTED	User's ID document is not accepted for the verification process
3002	USER_CANCELLATION_DOCUMENT_EXPIRED	User cannot continue the verification process due to an expired ID document
3003	USER_CANCELLATION_UNDERAGE	User is underage and is not allowed to continue the verification process
3004	USER_CANCELLATION_CAMERA_ACCESS_DENIED	User does not allow camera permission in the app
3005	USER_CANCELLATION_TERMS_DENIED	User does not accept the terms and conditions
3006	USER_CANCELLATION_SELFIE_NOT_READY	User is not ready for a selfie
3007	USER_CANCELLATION_APP_NOT_SCANNING	User aborts as the app is not scanning the document
3008	USER_CANCELLATION_ESIGNING_REJECTED	User does not accept the esigning request
3009	USER_CANCELLATION_ESIGNING_NAME_CONFIRMATION_REJECTED	User's name is specified incorrectly (This applies only to the QES/Signing flow)
3010	USER_CANCELLATION_INCORRECT_PHONE_NUMBER	User cancels as the phone number is specified incorrectly
3011	USER_CANCELLATION_IDENTIFY_LATER	User wants to identify later
3012	USER_CANCELLATION_USER_NOT_INTERESTED	User is not interested in performing the identity verification
3013	USER_CANCELLATION_APP_NOT_RESPONDING	User aborts because the app is not responding
3014	USER_CANCELLATION_PRIVACY_CONCERNS	User aborts due to privacy concerns
3015	USER_CANCELLATION_DOCUMENT_NOT_AVAILABLE	User does not have the ID document available and aborts
3016	USER_CANCELLATION_OTHER	User aborts the identification process in app for any other unspecified reason
3017	APP_CANCELLATION_APPROVAL_PHRASE_RETRY_LIMIT_REACHED	This is used in the QES/esign flow when the app is unable to retrieve the approval phrases from the backend after multiple retries
3018	APP_CANCELLATION_APPROVAL_PHRASE_NO_CONTRACT	App encounters a technical error in the Approval Phrases step in QES/esign
3019	APP_CANCELLATION_APPROVAL_PHRASE_INSUFFICIENT_DOCUMENT_COUNT	In the Approval Phrases step for QES/esign, the required number of documents to be signed are not received from backend
3020	APP_CANCELLATION_OTP_MATCH_LIMIT_REACHED	In the OTP Authentication step, the user has reached the allowed limit for number of OTP entries and cannot try again
3021	APP_CANCELLATION_TSP_TECHNICAL_EXCEPTION	App encounters a technical error from the TSP side. If this error state does not resolve after multiple automatic retries, the user cannot proceed further and the ident is aborted with this reason

Canceled reasons

Here are the reasons you may find for canceled QES.

Code	Message	Description
3101	ID_BLURRY	Document is blurry and mandatory data cannot be read due to the blur.
3102	ID_GLARE	Document has glare and mandatory data cannot be read due to the glare.
3103	ID_DARKNESS	Pictures of the document are dark and it is not possible to read the mandatory data or verify the authenticity of the document.
3104	ID_DATA_COVERED	Mandatory data is covered by the user while taking the picture
3105	ID_PERSPECTIVE	Document is positioned at such an angle that mandatory data cannot be read or document cannot be verified
3106	ID_DATA	Mandatory data cannot be read on the document
3107	ID_DATA_OTHER	Any other reason due to which mandatory data cannot be read
3108	ID_NOT_SUPPORTED	Document used during the identification is not supported for the customer's use case
3109	ID_EXPIRED	Document used during the identification is expired.
3110	ID_WRONG_SIDE	Wrong side of the document is scanned during the process.
3111	ID_OUTWORN	Document is worn out. Either data cannot be read out or the document cannot be verified.
3112	ID_HAS_STICKER	Document has such stickers which are not acceptable and the document used is considered as damaged document.
3113	ID_WRITTEN_ON	Document has text written over it which makes the document not readable or not verifiable. If the sticker is legit one and added by the authorities while issuing the document then the document will be acceptable and not cancelled due to this reason.
3114	ID_BROKEN	Document used during the identification is broken.
3115	ID_DAMAGED	Document used during identification is a damaged document.
3116	ID_DAMAGED_OTHER	Any other reason for a damaged document.
3117	ID_SECURITY_FEATURE_NOT_VISIBLE_NOT_FRAUD	Security features of the document are not visible because user did not move the document correctly.
3118	ID_SECURITY_FEATURE_VIDEO_SHORT	Security feature video is too short to detect if there are holograms in the document.
3119	ID_SECURITY_FEATURE_VIDEO_CANNOT_BE_PLAYED	Security feature video cannot be played for the agent to review holograms.
3120	ID_SECURITY_FEATURE_OTHER	Any other issues with the security feature video.
3121	ID_SECOND_DOCUMENT	If two documents are required for the identification process, the user needs to photograph two different documents (i.e. ID + Driver's license) - If the second required ID document is not available, the ident will be cancelled.
3122	ID_SECOND_DOCUMENT_BAD_PHOTO_QUALITY	Photo quality of the additional document in the process is not acceptable.
3123	ID_SECOND_DOCUMENT_DAMAGED	Additional document used in the identification process is severely outworn, written or drawn on, ripped or broken.
3124	ID_SECOND_DOCUMENT_EXPIRED	Additional document used in the identification process is an expired document.
3125	ID_SECOND_DOCUMENT_OTHER	Any other issues with the additional document used in the identification process.
3126	ID_NEED_ADDITIONAL_DOCUMENT	Additional document like Driver's License is missing in the identification process but it was required.
3127	ID_OTHER	Any other issues with the document used in the identification process.
3128	USER_INVOICE_MISSING	Customer needs proof of address from the user as the additional document but user did not provide it in the identification process.
3129	USER_OBSCURED	User has covered the face during the face comparison process unintentionally like wearing the face mask.
3130	SELFIE_BLURRY	Selfie taken by the user is blurry and cannot be used to compare the face with the identification document.
3131	SELFIE_GLARE	Photo of the user on the ID document has glares and selfie cannot be compared with it.
3132	SELFIE_DARKNESS	Selfie taken by the user is too dark to compare the face of the person with the photo on the identification document.
3133	SELFIE_PERSPECTIVE	Selfie taken by the user is on such an angle that it is not possible to compare it with the photo on the identification document.
3134	SELFIE_OTHER	Any other issues with the selfie which restrict ident specialist to compare the selfie of the user with the photo on the identification document.
3135	IDENT_CANNOT_BE_COMPLETED	Due to a technical reason, ident specialist cannot finish the identity verification process.
3136	IDENT_DISPLAY_ERROR	Due to a technical reason, ident specialist cannot see the data submitted by the user in the identification process.
3137	IDENT_OTHER	Any other reason due to which the identification process cannot be completed by the ident specialist.
3138	TSP_WRONG_CONFIRMATION_TOKEN	A wrong signing code was entered by the user during the signing step.
3139	TSP_SIGNING_FAILED	The signing process failed due to any technical error.
3140	TSP_CERTIFICATE_EXPIRED	Signing certificates are valid for an hour. The final signing step took more than an hour from the time of certificate generation.
3141	ID_SECURITY_FEATURE_VIDEO_FILE_MISSING	If enabled, the system automatically cancels an ident when the 'Security Features' (Hologram) video is not saved due to any technical error, and is hence missing from the final result (zip) file.

Fraud suspicion reasons

Important – Don't communicate fraud suspicion to end users

For legal reasons, you mustn't indicate to end users that they are suspected of fraud.

Here are the reasons you may find for fraud suspicions.

Code	Message	Description
3201	WARNING_SELFIE_REAL_PERSON	User that performed the identification is a real person but the selfie does not match with the face on the document.
3202	WARNING_SELFIE_NO_REAL_PERSON	Selfie taken in the identification person is not of a real person. For example, the selfie taken is a photo of a picture.
3203	WARNING_SELFIE_DISGUISED	User intentionally disguised the face by wearing a mask or in some other way.
3204	WARNING_MANIPULATED_DATA	Data is manipulated on the Identification document.
3205	WARNING_MANIPULATED_PHOTO	Photo of the person is manipulated on the Identification document.
3206	WARNING_FAKED_SECURITY_FEATURES	Security features like holograms on the Identification document are not real.
3207	WARNING_PAPER_PRINT	The Identification document is not real but a printout taken on a paper.
3208	WARNING_DIGITAL_DOCUMENT	Identification document image is taken from a digital screen (from laptop, from mobile or from any other screen).
3209	WARNING_FAKED_SPECIMEN	Identification document is a specimen document and not real document.
3210	WARNING_USER_UNDERAGE	User is below the age required to access the customer's service.
3211	WARNING_DIGITAL_SELFIE	Selfie is taken from a digital screen (from laptop, from mobile or from any other screen).
3212	WARNING_MONEY_MULE	User is duped by fraudster to perform identification on fraudster's behalf.
3213	WARNING_NAME_COMPARISON	Considerable inconsistency between user's name and document.
3214	WARNING_SCAN	Identification document is a facsimile.
3215	WARNING_FRAUD_OTHER	Any other type of fraud identified during the verification process by Ident specialist.

Initiate QES verification

Before initiating the QES verification process, the User must be created with the relevant attributes (as required by Treezor Compliance).

At least the firstname, lastname, email, country, and phone fields of the user must be populated, otherwise, the API call returns an HTTP 428 error.

Parameters

You can optionally override the default URL to which the user will be redirected after the QES verification.

Attribute	Type	Description
redirectUrl	string	The URL to which the User will be redirected after the QES verification.

Request

You can use the following request to initiate the QES verification process.

CURL

curl -X POST {baseUrl}/v1/users/{userId}/qes \
	--header 'Authorization: Bearer {accessToken}' \
	--header 'Content-Type: application/json' \
	-d '{"redirectUrl": "https://www.my-domain.tld"}'

Answers with a 201 HTTP Status Code and returns the identifier of the verification process and the identificationURL. The latter is where the end user is to be redirected to go through the qualified electronic signature process.

JSON

{
   "identification": {
       "identificationId": {{identification-id}},
       "identificationURL": "https://go.idnow.de/app/treezoramlauto/identifications/{{identification-id}}/identification/routing/start",
   }
}

Once redirected, end users are guided through the QES verification steps, in which they present a verification document.

End user QES verification

Once redirected, end users are guided through the QES steps.

Click to see the Qualified eSignature steps for your end users (mobile)

After the last step:

• The user is redirected to the redirectUrl or the URL configured with Treezor.
• Treezor sends you a qes.created webhook.
• The verification documents are automatically created once the qes.finalized webhook is received.

Download the QES documents

If you're eligible, you may be able to collect some of the uploaded documents whose documentTypeId allows for it.

Configuration – Download is not enabled by default

Please contact Treezor to request access to this feature.

Downloading a document is a 2-step process, in which you:

1. Request the download URL
2. Download the document within 30 seconds

Request the download URL

To request the download URL, you need the corresponding documentId (available in the document.create webhook for instance).

CURL

curl -X GET {baseUrl}/v1/documents/{documentId}/download \
	--header 'Authorization: Bearer {accessToken}' \

Returns the URL to download the document, with all the necessary query parameters for the next step.

JSON

{
    "url": "{documentDownloadUrl}"
}

Download the document

You have 30 seconds to download the document from the moment the presigned URL has been generated in the previous step.

CURL

curl -X GET {documentDownloadUrl}

The document is returned in its initial format.

Request a KYC Review for the User

Before requesting a KYC review from Treezor, please make sure all the information and documents are properly updated for the user.

You can use the dedicated endpoint:

• /v1/users/{userId}/Kycreview

Alert – Documents must be uploaded for children users too

When there are parent-children hierarchical relationship, in most cases, the KYC Review must only be requested for the parent user. But you may need to upload Documents for the children before that. Please abide by the Treezor Compliance team recommendation for a smooth experience.

Learn more in the KYC Request article.

Endpoints

Endpoint	Scope
/v1/users/{userId}/Kycreview Initiate the user KYC review process	read_write
/v1/users/{userId}/qes Initiate the user QES verification process	read_write
/v1/documents/{documentId}/download Retrieve a document download URL	read_only