Create a release request

Create a request for a person to release Signa ID data to your business. Send request_token to your page, and call signa.requestData({ requestToken }) from a click. The request expires 30 minutes after the create. Blaaiz sends no webhook when a request expires. A release request does not count against your open session cap. This endpoint allows 30 requests each minute for each business. Every response carries Cache-Control: no-store. Signa ID release must be enabled for your business. The call must use an OAuth access token with the signa-id:release scope. API keys cannot call it. No scope bundle contains this scope, full-access included, so select it by name when you create or rotate your credentials.

POSTapi-prod.blaaiz.com/api/external/signa-id/release-requests

Authorization

oauth2ClientCredentials signa-id:release

AuthorizationBearer <token>

Use your OAuth client credentials to obtain a short-lived Bearer token from POST /oauth/token.

In: header

Scope: signa-id:release

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

idempotency_key*string

Your key for this create. A repeat with the same key and the same values returns the same release. A repeat with the same key and different values returns 422. Signa verification sessions and release requests share one set of keys.

Length1 <= length <= 191

purpose*string

Why you ask for the data. The person sees this text on the consent screen. No control characters and no formatting characters.

Length3 <= length <= 200

scopes*array<>

The data blocks that you ask for. identity: name, date of birth and nationality. id_document: the details of the identity document. address: the verified address. document_images: the images of the identity document.

Items1 <= items <= 4

origin*string

The exact origin of the page that calls signa.requestData(), as window.location.origin gives it: https, a lower-case host, and no path, query or default port. Example: https://yourapp.com. In the sandbox, http://localhost with a port is also accepted. The popup sends the result to this origin only.

Lengthlength <= 255

reference?string

Optional. Your own reference for the person. When you omit it, Blaaiz uses the idempotency_key.

Length1 <= length <= 191

Response Body

`application/json`

Create a release request

curl --request POST \  --url 'https://example.com/api/external/signa-id/release-requests' \  --header 'Content-Type: application/json' \  --data '{  "idempotency_key": "signa-release-user_10482-2026-10-05",  "purpose": "Open your trading account",  "scopes": [    "identity",    "id_document",    "document_images"  ],  "origin": "https://yourapp.com",  "reference": "user_10482"}'

{  "message": "Signa ID release request created.",  "data": {    "id": "b84c0427-231c-44c2-b397-e528a775962f",    "status": "PENDING",    "purpose": "Open your trading account",    "scopes": [      "document_images",      "id_document",      "identity"    ],    "origin": "https://yourapp.com",    "reference": "user_10482",    "expires_at": "2026-10-05T10:44:22.000Z",    "released_at": null,    "exchanged_at": null,    "access": null,    "created_at": "2026-10-05T10:14:22.000Z",    "request_token": "EHoPu_CY9bReov_nzsaGcPeex9QqDGx2AQ72MQbFPMo",    "release_url": "https://id.blaaiz.com/r/EHoPu_CY9bReov_nzsaGcPeex9QqDGx2AQ72MQbFPMo"  }}