# List verifications

```
GET /api/kyc/verifications
```

Your organisation's verification history, paginated and filterable — reconcile your records without keeping your own ledger of ids. Scoped to the key's environment, so a sandbox key never lists production traffic.

Records you have [deleted](https://trust.myaza.co/documentation/api-manage-records/markdown) are not listed and are not counted in `total`.

**Authentication:** `Authorization: Bearer sk_…` (**secret key required**), like the [per-id result read](https://trust.myaza.co/documentation/api-verification-result/markdown) beside it.

## Query parameters

| Parameter | Description |
|---|---|
| `status` | One value from the [status vocabulary](https://trust.myaza.co/documentation/api-verification-status/markdown) — the same words `/status/:id` and webhooks use, so the filter and the labels can never disagree. An unknown word is a `400 invalid_status` naming the vocabulary. |
| `channel` | `sdk` (capture-flow verifications) or `dashboard` (spot checks). |
| `subjectType` | `individual` or `business`. |
| `country` | ISO-2 country code. |
| `idType` | ID type (or the business product, which rides the same field). |
| `workflowId` | The `wf_…` public id — every submission a workflow drove. |
| `externalUserId` | Your reference for the subject; matches sessions, entities and webhook payloads. |
| `from` / `to` | ISO dates bounding `createdAt`. |
| `page` / `pageSize` | Pagination; `pageSize` max 100, default 25. |

## Response

```json
{
  "verifications": [
    {
      "verificationId": "cmt…",
      "requestId": "order_1001",
      "externalUserId": "user_42",
      "metadata": { "loanId": "loan_20191" },
      "channel": "sdk",
      "subjectType": "individual",
      "status": "approved",
      "checkStatus": "verified",
      "reasonCode": null,
      "country": "NG",
      "idType": "bvn",
      "workflowId": "wf_AbC123dEf456",
      "workflowVersion": 3,
      "createdAt": "2026-08-20T12:00:00.000Z",
      "completedAt": "2026-08-20T12:00:04.512Z"
    }
  ],
  "total": 812,
  "page": 1,
  "pageSize": 25
}
```

Rows are deliberately light: identifiers and states, no biodata. `metadata` is your own customer metadata echoed unchanged, not something Myaza derived. `status` is the merged top-line (what a decision graph or reviewer concluded); `checkStatus` is what the checks themselves found — approving a failed check (a policy override) stays distinguishable from approving a passing one. The full result, PII included, lives on [`GET /verifications/:id`](https://trust.myaza.co/documentation/api-verification-result/markdown).

Business rows additionally carry `businessName`.