Modular API

The Modular API provides an integration that enables full programmatic control over tenant workflows, including document processing, identity verification, banking connectivity, and forensic analysis. This page focuses exclusively on API-based integration. Use the Modular API Reference section for the complete list of endpoints, request formats, and response schemas.

Quickstart

Generate an access token with your API key credentials and make your first request.

Modular API Reference

Explore Modular API endpoints, request parameters, responses, and authentication requirements.

Authentication

All Modular API interactions are scoped to API key credentials: a client_id and client_secret. An API key represents your integration and acts as the root container for tenants, webhooks, and processing workflows. To authenticate requests, exchange your API key credentials with Generate Access Token using HTTP Basic Authentication (see the Authentication guide). Then include the one-hour token in the request headers when calling protected endpoints.

Authorization: Bearer <token>

Each API key can manage multiple tenants. Webhooks are configured at the API key level and apply to all tenants created under that key.

Base URLs

Choose the base URL for your environment:

Production
Sandbox

https://api.skortorent.com/api/v1

https://dev-api.skortorent.com/api/v1

Production is the default Modular API reference environment. Switch to Sandbox when testing with sandbox credentials.

Webhooks

Webhooks allow SKOR to notify your system about important events asynchronously. Webhooks are configured per API key and deliver event notifications for all tenants associated with that key. These events help your system react when specific processes are completed. When you create a webhook, you can provide an optional signing secret for that URL. SKOR keeps this value server-side and uses the Svix signing scheme to sign the exact JSON request body. The secret itself is never sent in a webhook request.

Create webhook request

{
  "url": "https://example.com/webhooks/skor",
  "secret": "your-shared-secret"
}

You can replace the secret through Update Webhook. Send null or an empty string to remove it. List Webhooks and Get Webhook return the configured secret, so treat those API responses as sensitive. For a webhook with a configured secret, each request includes these headers:

svix-id: msg_...
svix-timestamp: 1787138793
svix-signature: v1,...

Install the official Svix library:

npm install svix

Verify the unmodified raw request body with the configured secret:

Verify a webhook signature with Svix

import { Webhook } from "svix";

function verifySkorWebhook(rawBody, headers, secret) {
  const webhook = new Webhook(secret, { format: "raw" });
  return webhook.verify(rawBody, headers);
}

The verification method checks the signature and rejects timestamps outside Svix’s allowed tolerance. It throws when verification fails. For an Express endpoint, use a raw body parser before any global JSON parser:

Express verification endpoint

import express from "express";
import { Webhook } from "svix";

app.post(
  "/webhooks/skor",
  express.raw({ type: "application/json" }),
  (req, res) => {
    try {
      const webhook = new Webhook(process.env.SKOR_WEBHOOK_SECRET, {
        format: "raw",
      });
      const event = webhook.verify(req.body, req.headers);

      // Process the verified event.
      console.log(event);
      return res.sendStatus(200);
    } catch {
      return res.status(400).json({ error: "Invalid webhook signature" });
    }
  }
);

The SKOR backend also exposes POST /webhook-test for delivery testing. Set SKOR_WEBHOOK_TEST_SECRET to the same secret configured for that test webhook before using the endpoint.

Verify the signature against the raw body before parsing or modifying the JSON. A webhook URL, including a Convex HTTP action URL, is only the delivery destination. Configure a separate random secret when creating the webhook.

Tenant lifecycle events — TENANT_CREATED, TENANT_UPDATED, TENANT_DELETED, TENANT_ONBOARDING_COMPLETED
Document analysis completion — DOCUMENT_ANALYSIS_DATA
Cl@ve processing success — CLAVE_SUCCESS
KYC verification result — KYC_VERIFICATION_DATA
Forensic analysis completion — FORENSIC_ANALYSIS_DATA
Financial analysis result — FINANCIAL_ANALYSIS_SUCCESS, FINANCIAL_ANALYSIS_FAILURE

Each webhook delivery is a POST with a JSON body of the form { "event": <EVENT_NAME>, "data": <payload> }. Register an endpoint with Create Webhook.

Tenant management

Tenants are entities that you manage through the Modular API. Each tenant is associated with a specific API key. Once a tenant is created, you can manage subsequent actions such as document uploads, identity verification, banking connections, and forensic analysis. Create a tenant with Create Tenant. You can also Get Tenant, Get All Tenants, Update Tenant, and Delete Tenant.

Document upload and download

Documents can be uploaded for a tenant at any point after creation. Examples include payslips, bank statements, tax returns, and identity documents. Uploaded documents are stored in the SKOR database and can be retrieved later when required.

Upload documents for a tenant using the Documents API.
Trigger document analysis automatically after successful upload.
Receive webhook events when document analysis is completed.
Download documents retrieved from Cl@ve.

See Upload Tenant Documents, Get Tenant Documents, and Initiate Cl@ve.

Identity verification

KYC verifies the tenant’s identity using official identity documents. See Initiate KYC.

Financial scoring

Banking data is analyzed and used in financial assessments. See Initiate Bank.

Forensic analysis

Forensic analysis evaluates all available tenant data to detect inconsistencies, fraud indicators, and financial risk signals.

You do not need to manually trigger forensic analysis in most cases.

Forensic analysis can run automatically when documents are uploaded, after KYC completion, and after successful bank connectivity. You may still trigger it manually if required. See Run Forensic Analysis. Retrieve results with Tenant Skor Analysis Details or the full Get Tenant response.

End-to-end flow

Generate an access token

Generate an access token with Generate Access Token using your API key credentials via HTTP Basic Authentication. Use this token to authenticate all subsequent API requests.

Configure webhooks

Configure webhooks to receive asynchronous notifications for document analysis, Cl@ve events, KYC completion, forensic analysis, and financial analysis. Webhooks are optional, but strongly recommended for long-running processes.

Create tenants under the API key

Create a tenant by providing their basic personal details. The endpoint documentation lists all required fields. Identification number and postcode are used to run Experian checks for defaulter and risk status.

Upload documents or retrieve them from Cl@ve

Upload tenant documents manually, retrieve them through Cl@ve, or use both methods. Document submission is mandatory and acts as a blocking dependency for forensic analysis.

Initiate KYC verification

Complete identity verification for the tenant. KYC verification is mandatory, and forensic analysis will not be triggered unless KYC has completed successfully.

Connect the tenant's bank

Connect the tenant’s bank account. This step is optional, but recommended because bank connectivity is required for Financial SKOR generation.

Consume results through APIs and webhooks

Retrieve tenant operational data through APIs and consume asynchronous events delivered through webhooks.

Guides

SDK

API's Authentication

Modular API Guide

Modular API Reference

Property Management Guide

Property Management API Reference

Quickstart

Modular API Reference

Authentication

Base URLs

Webhooks

Tenant management

Document upload and download

Identity verification

Financial scoring

Forensic analysis

End-to-end flow

Quickstart

Modular API Reference

​Authentication

​Base URLs

​Webhooks

​Tenant management

​Document upload and download

​Identity verification

​Financial scoring

​Forensic analysis

​End-to-end flow

Authentication

Base URLs

Webhooks

Tenant management

Document upload and download

Identity verification

Financial scoring

Forensic analysis

End-to-end flow