Versioning
One version in the path, additive changes within it, and what the availability badges on these pages actually promise.
The version is in the path
Every endpoint is under /v1. Within a version the API adds and does not remove: new members can appear in responses, new optional parameters on requests, and new error codes. Parse defensively — ignore members you do not recognise rather than rejecting the response — and a new field will never break you.
A change that would break a correct integration means a new version path, never a silent change to this one.
What the badges mean
Every page here carries one of three badges. They describe the accuracy of the page, not the ambition of the feature.
| Badge | What it promises |
|---|---|
| Available | Everything on the page is true of the running API today. This is the default and is not shown. |
| Sandbox only | True today, against sandbox applications and test identities. Not a production capability. |
| Not yet available | Built and described honestly, and not deployed. Nothing on the page can be exercised against the live service. |
What is safe to depend on
| Depend on | Do not depend on |
|---|---|
| Error codes | Error message wording |
The { data } envelope on developer routes, and bare payloads on OAuth routes | Member ordering within an object |
| Scope codes in the catalogue | Identifier formats or lengths |
| Documented header names | Undocumented headers |
| Discovery document contents | Endpoint URLs you constructed yourself |
Pin what you load
@vn.unifyid/connect is loaded by URL with an SRI hash, and every release is immutable per version: the snippet on The drop-in component is generated from the release bytes. Take the hash from there, and move versions deliberately.
@vn.unifyid/integrity-verifier is installed from npm once published, from the public VerifyNova/integrity-verifier repository, with npm provenance; pin an exact version (the first release is 1.0.0). See Verify a checkpoint yourself.
How a deprecation reaches you
What this does not do
- There is no `/v2`. Nothing on this site describes one.
- Scope codes that were retired are refused, not aliased.
emails,phones,profile_photo_verifiedandidentity_verification_statusanswerinvalid_scope.
Verified against API commit 234dba22 on 2026-10-18. The routes, scopes, checklist, events and limits on these pages are read from that export, not typed.