Get started with API

This guide walks you through making your first API call to AdvanGuard — from generating an access token to creating a verification application.

Before You Start

Sign up for an AdvanGuard account on the AdvanGuard platform.
Get your credentials — navigate to Account → Account Management to obtain your accessKey and secretKey.
Configure webhooks (optional) — set up a webhook endpoint in the AdvanGuard platform to receive status change notifications. See the Webhooks Guide for details.

Base URL

All API requests are made to:

https://openapi.advance.ai/v1/

Available environments:

Environment	Base URL
Production (SG)	`https://openapi.advance.ai`

Testing account — Use a testing account during development to avoid affecting production data. Contact your account manager to request one.

Step 1: Generate an Access Token

Before calling any API, you need to generate a JWT access token.

Compute the Signature

Concatenate accessKey + secretKey + timestamp and compute the SHA-256 hash:

import java.security.MessageDigest;

public class SignatureUtil {

    public static String computeSignature(String accessKey, String secretKey, String timestamp) {
        try {
            String combined = accessKey + secretKey + timestamp;
            MessageDigest digest = MessageDigest.getInstance("SHA-256");
            byte[] hash = digest.digest(combined.getBytes("UTF-8"));
            StringBuilder hex = new StringBuilder();
            for (byte b : hash) {
                String h = Integer.toHexString(0xff & b);
                if (h.length() == 1) hex.append('0');
                hex.append(h);
            }
            return hex.toString();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

Request the Token

curl -X POST https://openapi.advance.ai/v1/auth/tokens \
  -H "Content-Type: application/json" \
  -d '{
    "accessKey": "your_access_key",
    "timestamp": 1718524800000,
    "signature": "computed_sha256_signature"
  }'

Response:

{
  "accessToken": "eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJhZHZhbmd1YXJkIn0.abc123",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "expiresAt": "2026-06-16T10:00:00Z"
}

Use the accessToken value in the Authorization header for all subsequent requests.

See the Authentication Guide for the full signature computation reference and multi-language code examples.

Step 2: Create a Verification Application

Create a verification application for a user. The API automatically creates or associates a profile for the given externalUserId.

Note: The levelId defines the verification flow (which checks to perform). You can find your available Level IDs in the AdvanGuard platform under Level Management.

curl -X POST https://openapi.advance.ai/v1/individual/applications \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..." \
  -H "Content-Type: application/json" \
  -d '{
    "levelId": "level-kyc-standard",
    "externalUserId": "user-001",
    "lang": "en-US"
  }'

Response:

{
  "id": "app-7392581047263518721",
  "status": "init",
  "levelId": "level-kyc-standard",
  "externalUserId": "user-001",
  ...
}

Step 3: Check Application Status

Poll the application status to track verification progress:

curl https://openapi.advance.ai/v1/individual/applications/app-7392581047263518721 \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiJ9..."

Response:

{
  "id": "app-7392581047263518721",
  "status": "completed",
  "levelId": "level-kyc-standard",
  "externalUserId": "user-001",
  "review": {
    "reviewAnswer": "GREEN"
  },
  ...
}

Status	Meaning
`init`	Application created, awaiting user data submission
`pending`	Data submitted, verification in progress
`onHold`	Waiting for manual review or external processing
`completed`	Verification complete — check `review.reviewAnswer` for result (`GREEN` = passed, `RED` = rejected)
`terminated`	Application was cancelled or timed out

Tip: Instead of polling, configure a webhook to receive real-time notifications when the application status changes.

API Groups

AdvanGuard APIs are organized into groups:

Group	Path Prefix	Description
Auth	`/v1/auth/`	Access token generation
Individual	`/v1/individual/`	Profiles and verification applications
AML	`/v1/aml/`	AML screening cases, alerts, matches

Next Steps

Authentication — Signature computation, token lifecycle, and security best practices
Errors — Error handling patterns
Webhooks — Real-time event notifications