Identity verification
Manage contact verification and conversation resume windows through REST.
Identity verification belongs to an agent's contact policy, not to a client-side guess about who a visitor is. Use the REST endpoints to inspect the current verification configuration, enable or disable it, regenerate its secret when necessary, and set the contact resume window. Keep any secret-handling request in a trusted backend and rotate downstream configuration after regeneration.
An integration should present verification as a deliberate user journey: tell the person why a contact method is needed, collect only the required information, and handle an incomplete or expired verification without silently merging identities. Configuration changes affect future conversation behavior; they do not prove that an existing browser session is owned by a particular person.
Pair this guide with the Contacts REST guide when you need to create or export contact records. Use server-side authorization and the API's response envelope for every update. If the application also embeds chat, the browser can collect intent, but the backend should apply verification policy through the documented API rather than exposing its secret to the page.