One email = one identity

Every app that uses Authpermit links its accounts to one person per email. Two accounts in the same app with one email are refused; the same person in two of your apps is recognised; and a name that does not agree with the person's reference is reported, by API response, event and webhook.

At sign-up and on email change

curl -X POST https://authpermit.com/api/v1/people/resolve \
  -H "Authorization: Bearer ap_live_..." -H "Idempotency-Key: 7f1c..." \
  -H "Content-Type: application/json" \
  -d '{"email":"a.rahman@example.com","email_verified":true,"name":"Ahmed Rahman",
       "external_ref":"tt_user_8812","project_id":"...","link":true}'

The response carries a pairwise person_id (per_…, stable for your organization only), status (new/existing), duplicate, a name_check and a recommended_action:

name_check.result	Meaning
`match`	Same name once case, accents, punctuation, honorifics and word order are set aside.
`variant`	Plausibly the same person written differently (initial, middle name, nickname, typo, transliteration). Never blocks.
`mismatch`	A different name. Against a verified document: `verify`. Against other accounts' claims: `review`.
`unverifiable_script`	The scripts cannot be compared honestly (e.g. Cyrillic against Latin). Not a mismatch.
`no_reference`	Nothing to compare against yet.

A second account for the same email in the same app returns 409 with code: "duplicate_in_tenant" and existing_external_ref.

Other calls

GET /people/{person_id} — your accounts, assurance, latest name check (legal name only with identity:read:sensitive).
POST /people/{person_id}/name-checks — when a user edits their name.
DELETE /people/{person_id}/links/{external_ref} — account deletion; the person is erased 30 days after the last link anywhere.
POST /verification-sessions with person_id — a pass raises the person's assurance and makes the document name the reference.

Scopes

identity:resolve, identity:link and identity:read. None of them is in the default key scopes; ask for them when you create the key.

Webhooks

person.linked, person.unlinked, person.name_mismatch, person.duplicate_suspected (email_in_tenant, same_document_other_email, email_alias) and person.verified. Every event carries person_id, external_ref and project_id. Create one endpoint per app with project_id and it only receives that app's events.

Who sees what

Outside the network an organization only sees its own accounts. Organizations a platform admin enrolled in the Authpermit Identity Network also learn whether an email is known to another member app, the name-check category and duplicate flags — never a name, which app, or an assurance level unless the person consented to verification_reuse. Emails are stored as keyed hashes and ciphertext, names encrypted, document numbers only as keyed fingerprints.