Facial Antispoofing

The Facial Antispoofing service analyzes a selfie and answers a single question: did this image come from a real person in front of the camera, or from an impersonation attempt? It detects photocopies, screenshots, another screen’s border inside the frame, watermarks, chromatic tampering, and AI-generated deepfakes. One HTTP call, no SDK required.

The decision rule

This is the most important part of the integration. Write it in the positive:

// Approval requires both conditions. Anything else is NOT an approval.
if (status === 200 && body.spoofing === false) {
  approve();
} else {
  doNotApprove();
}

Never approve by exclusion. There is no single code that means “rejected”: the spoofing verdict arrives with 200, while an image with no face arrives with 422 and also carries spoofing: true. If your condition is “reject when the code is X”, every unexpected response gets approved.

Do not branch on errorCode, values, confidence, or info. Those fields are diagnostics: use them in your logs and in support tickets. They change between service versions and are not part of the contract.

Endpoints

Method	Path	What it’s for
`GET`	`/version`	Verify connectivity and credentials. Check the status code, not the body.
`POST`	`/inference`	Analyze an image and get the verdict.

The base URL depends on the environment and is provided by VU along with your api-key. Examples below refer to it as BASE_URL.

Authentication

Every call carries the Api-Key header with your environment’s key.

curl -X GET "$BASE_URL/version" \
  -H "Api-Key: $VU_AS_FACE_API_KEY"

The api-key belongs in your backend. Never embed it in a mobile app or front-end bundle — anyone can extract it from the binary or the JavaScript.

A complete example

curl -X POST "$BASE_URL/inference" \
  -H "Api-Key: $VU_AS_FACE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "info": "onboarding-12345",
    "logAnonymity": true,
    "image": "/9j/4AAQSkZJRgABAQAAAQABAAD...v9Un0ooqDE//2Q=="
  }'

An approval looks like this, trimmed to the fields that matter:

{
  "id": "f80aaaf6-b3fe-44ab-9388-79d42b7a5f0e",
  "code": 200,
  "spoofing": false,
  "message": "Machine Learning indicates not Spoofing",
  "confidence": 99,
  "benchmark": 248
}

id is the transaction identifier. Always log it — it is the first thing support will ask for.

Environments

The UAT environment may run ahead of production. It also validates pre-release versions, so response times and per-image verdicts can differ. Use it to certify your integration — the contract, the status codes, the error handling — not as a performance reference and not to compare verdicts image by image across environments.

Integration

Prepare the image, build the call, and validate your integration before production.

Responses

What each response carries, how info behaves, and which component blocked.

Errors

Status codes, whose problem each one is, and which are safe to retry.

Start here

ID Analysis

Face Analysis

Connection Fingerprint

Facial Antispoofing

The decision rule

Endpoints

Authentication

A complete example

Environments

Next

Integration

Responses

Errors

​The decision rule

​Endpoints

​Authentication

​A complete example

​Environments

​Next

Integration

Responses

Errors

The decision rule

Endpoints

Authentication

A complete example

Environments

Next