# Identity Verification (Prefill + Onboarding)

.sc-doc-table table { table-layout: auto; width: 100%; }
table th, table td { word-break: keep-all; overflow-wrap: normal; padding: 8px 14px; vertical-align: top; }
table th:first-child, table td:first-child { white-space: nowrap; }
table td code, table th code { white-space: nowrap; }
Phone-based prefill flow with **Silent Network Authentication (SNA)** and OTP fallback. Often completes in a single tap on a mobile device. Pass `diSessionToken` from the Device Risk SDK on every Prefill and Onboarding request to enable SNA.
Learn more: [Identity Verification](/client-spec/products#identity-verification) · [Device Risk SDK](/client-spec/prefill-onboarding-sdk).
You can find test cases [here](/client-spec/test-cases#prefill-onboarding).
![Prefill + Onboarding flow](https://efx-dev.stitchcredit.com/api/Prefill_Onboarding.png)

 - [POST /direct/login](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/login.md): Authenticates a customer host using API key and secret credentials, returning a JWT access token and a refresh token. The access token must be included as a Bearer token in the `Authorization` header
 - [POST /direct/user-reg](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/register.md): Registers a new user under the authenticated host and returns the user data. **Requirements:** Email must be unique within the host. **Dormant users.** If dormant enrollment is enabled for your accoun
 - [GET /direct/preauth-token/{id}](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/preauthtoken_1.md): Generates a short-lived pre-auth token for the specified user. **Parameters:** The `{id}` path parameter is the user's unique identifier (UUID). **Flow:** The returned token is used to establish a use
 - [GET /users/preauth-token/{preauthToken}](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/exchangepreauthtoken.md): Exchanges a pre-auth `{preauthToken}` for a full user session. This is how to obtain the `userToken` used for all `/users/*` endpoints. Returns the user profile along with JWT access and refresh token
 - [POST /users/identity-prefill](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/startidentityprefill.md): Initiates identity prefill verification. Submits the user's name and phone number for phone risk assessment. If SNA (Silent Network Authentication) succeeds, OTP is skipped and the user can proceed di
 - [POST /users/identity-submit-otp](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/submitidentityotp.md): Submits the 6-digit OTP code sent to the user's phone during prefill verification. On successful verification, returns prefill data and marks the session as accepted. **Requirements:** The user must h
 - [POST /users/identity-resend-otp](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/resendidentityotp.md): Resends the OTP code to the user's phone. **Requirements:** The user must have completed the prefill step with a `REVIEW` status, meaning OTP verification is required. **Limits:** Rate limited to one
 - [POST /users/identity-onboarding](https://crsintegration.redocly.app/client-spec/identity-verification-(prefill-+-onboarding)/submitidentityonboarding.md): Submits full identity data (SSN, DOB, address) to complete the onboarding process after prefill verification. On success, the user is enrolled in Equifax. **Limits:** The user has only **1 attempt** —