# Recognise a person

`POST /functions/v1/face-identify`

Ask whether this face already exists before a flow branches, and authorise an act against a live capture with the sink that writes the capture a mandate accepts.

Browser-safe (`pk_`). Purpose: answer “does this face already exist here” before a flow branches into signup or sign-in. Requires `x-sidaxis-timestamp` and `x-sidaxis-nonce`.

## Body

| Field | Type | Notes |
| --- | --- | --- |
| face_template | object, required | { vector: exactly 128 numbers, quality } |
| capture_nonce | string, required | 8–128 characters |

200 — matched, and not matched:

```
{ "matched": true, "subject_ref": "sr_2f91c8de44", "confidence": 0.88 }

{ "matched": false, "confidence": 0.41 }
```

The match gate is `0.75`. `subject_ref` is a per-merchant pseudonym. Errors: `400 INVALID_REQUEST`, `401 API_KEY_REQUIRED` / `INVALID_API_KEY`, `429 RATE_LIMITED`, `503 TEMPLATE_STORE_UNAVAILABLE`.

## The authorisation sink

```
POST /functions/v1/process-biovital-transaction
```

Server key, or a first-party Sieve ID JWT. `action` is one of `ACTION_LOGIN`, `ACTION_PAYMENT`, `ACTION_SIGN`, `ACTION_SIGNUP`. It requires both `sieve_hash` **and** `user_id`, and `amount` is an integer in the minor unit.

The row it writes is the `capture_id` that [mandate-issue](/mandates/issue) accepts as proof, valid five minutes.

### mandate_id is optional

Absent, the call behaves exactly as it always has. Present, the mandate stands in for the live capture and the response gains a `mandate` block with `scope_used`, `granted_to`, `agent_display_name`, `agent_descriptor`, `assurance_level`, `idempotent_replay`, `remaining` and `at_limit`.

```
curl -X POST https://api.sidaxis.com/functions/v1/process-biovital-transaction \
  -H "x-sidaxis-api-key: sk_live_..." \
  -H "x-sidaxis-timestamp: 1789564803" \
  -H "x-sidaxis-nonce: 9f2c41ab7d" \
  -H "Idempotency-Key: checkout-5512" \
  -H "content-type: application/json" \
  -d '{
    "action": "ACTION_PAYMENT",
    "merchant_id": "mrc_9f2c",
    "sieve_hash": "b41d...",
    "user_id": "0f9c2a51-7c33-4a1e-9b02-16c2b7f0d5aa",
    "amount": 4000,
    "currency": "USD",
    "face_template": { "vector": ["... 128 numbers"], "quality": 0.94 },
    "biometric_vitals": { "bpm": 71, "voice_pulse_correlation": 0.88, "liveness_confidence": 0.96 }
  }'
```

`payment` and `signature` can answer `403 DOCUMENT_REQUIRED` — see [the document rule](/document). A replay with the same `Idempotency-Key` returns the original body with the header `Idempotency-Status: replayed`.

> `assurance_level` is derived here, at the instant of the act. It is never sent by the client, and it is frozen on the receipt. See [assurance](/assurance).