> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/authentication/authentication-factors/biometric-device-selfie-id/integration-methods/selfie-id-api/api.md).

# API

The VIDA API is built on the principles of Representational State Transfer (REST) and uses standard HTTP methods and JSON responses, allowing for easy integration and flexibility.

{% hint style="info" %}

* If you are planning to use a mobile application developed using VIDA Credential Development Kit (CDK) as authenticator, use the associated REST APIs available with the **VIDA Authentication Credential** Services. 
* **WebAuthn** workflows are designed for browsers only. Since these REST APIs can be consumed by non-browser clients, we do not support FIDO2 credentials currently.
  {% endhint %}

### Authentication:

Vida API uses token-based authentication for secure communication with client applications. Each user is issued a unique JWT token that is passed in the header of each request, and the API also uses advanced security protocols such as signing the JWT token with a secret and expiration time for tokens.

### HTTP Status Codes & Error Handling

The VIDA API follows standard HTTP status codes and error codes, and the documentation includes information on how to handle and troubleshoot any errors that may occur when using the API. This includes details about the different status codes and error codes that the API may return, as well as guidance on how to diagnose and resolve any issues that may arise. 

If a request to our API is successful, it will return an HTTP status code `200 (OK)`

{% hint style="info" %}
For a complete list of error codes and their meanings, refer to the [Error Scenarios](/identity-stack/authentication/authentication-factors/biometric-device-selfie-id/integration-methods/selfie-id-api/api/error-scenarios.md) section.
{% endhint %}

### Environment

#### Sandbox

A testing environment where developers can try out new features and experiment without affecting production.

Steps to getting Sandbox API Credentials

#### Production

The live environment for end users. Changes can have a significant impact.

Steps to getting Production API Credentials

#### **URLs for production and sandbox environment**

Please refer to the following  API URLs, which can be used for production and sandbox environments.

<table><thead><tr><th width="223">Environment</th><th>URL</th></tr></thead><tbody><tr><td>Staging</td><td>https://sandbox-vsso-auth.np.vida.id</td></tr><tr><td>Production</td><td>https://vsso-auth.vida.id</td></tr></tbody></table>

{% hint style="info" %}
partner-id will be provided by VIDA
{% endhint %}

## Partner-VIDA Trust

To establish a secure communication network between the partner server, partner mobile application, and VIDA Authentication Server, a trust relationship needs to be established.&#x20;

While all the information is exchanged using TLS connections, each entity needs to authenticate with the other. A trust between the VIDA authentication server and the partner server must be established. This is done using a client secret that is provided to the partner during the onboarding procedure.

**Here's how the trust is set up:**

1. The partner server can authenticate with VIDA Authentication Server using a client ID and client secret obtained during the partner onboarding.&#x20;
2. Partner server can obtain a bearer token from VIDA Authentication server and pass on to the mobile application.&#x20;
3. The partner mobile application uses the bearer token to authenticate with the VIDA Authentication Server.