---
title: "Verify"
method: POST
path: "/api/v4/verify/{rp_id}"
---

# Verify

`POST /api/v4/verify/{rp_id}`

Verifies World ID 4.0 proofs and legacy 3.0 proofs. Use `rp_id` (`rp_...`) when possible; `app_id` (`app_...`) is still accepted for backward compatibility.

## Path parameters

- `rp_id` string, required

## Request body

- union — Choose one request type.
  - object — Legacy uniqueness proof format (protocol 3.0).
    - `protocol_version` '3.0', required
    - `nonce` string, required
    - `action` string, required
    - `action_description` string
    - `environment` 'production' | 'staging'
    - `responses` VerifyV4ResponseItemV3[], required
      - `identifier` string, required — Credential type (e.g. orb).
      - `signal_hash` string
      - `merkle_root` string, required
      - `nullifier` string, required
      - `proof` string, required
      - `max_age` integer
    - `user_presence_completed` boolean — Whether World App completed the requested user-presence check. IDKit always sends it; treat a missing value as false.
  - object — Standard uniqueness proof format (protocol 4.0).
    - `protocol_version` '4.0', required
    - `nonce` string, required
    - `action` string, required
    - `action_description` string
    - `environment` 'production' | 'staging'
    - `responses` VerifyV4ResponseItemV4[], required
      - `identifier` string, required
      - `signal_hash` string
      - `issuer_schema_id` integer, required
      - `nullifier` string, required
      - `expires_at_min` integer, required
      - `proof` string[], required — Exactly 5 hex elements (4 compressed proof elements + Merkle root).
    - `user_presence_completed` boolean — Whether World App completed the requested user-presence check. IDKit always sends it; treat a missing value as false.
  - object — Session proof format (protocol 4.0).
    - `protocol_version` '4.0', required
    - `nonce` string, required
    - `session_id` string, required — Opaque session ID in the format session_<128 hex characters>.
    - `environment` 'production' | 'staging'
    - `responses` VerifyV4SessionResponseItem[], required
      - `identifier` string, required
      - `signal_hash` string
      - `issuer_schema_id` integer, required
      - `session_nullifier` string[], required — Tuple `[nullifier, action]`.
      - `expires_at_min` integer, required
      - `proof` string[], required
    - `user_presence_completed` boolean — Whether World App completed the requested user-presence check. IDKit always sends it; treat a missing value as false.

## Response `200`

At least one proof verified successfully

- VerifyV4SuccessResponse
  - `success` true, required
  - `action` string
  - `nullifier` string
  - `created_at` string, date-time
  - `environment` 'production' | 'staging'
  - `session_id` string — Opaque session ID in the format session_<128 hex characters>.
  - `results` VerifyV4Result[], required
    - `identifier` string
    - `success` boolean
    - `nullifier` string
    - `code` string
    - `detail` string
  - `message` string

## Other responses

- `400` — Validation or verification error
- `404` — App not found or no longer active

---

[API](https://skmtc.dev/world/apis/developer-portal-api.md) · [All operations](https://skmtc.dev/world/apis/developer-portal-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/world/developer-portal-api/revisions/a99055a8765b/schema)