How verification works
What a result actually means, how much weight to give it, and the limits of what this platform can tell you.
Assurance levels
A green tick on its own is close to meaningless — it matters enormously whether a record was typed in by an administrator or confirmed against the awarding body's own register. Every result on OneVerify states which.
Submitted by the holder. Not confirmed by the issuing body.
Entered or uploaded by an authorised officer of the issuing body.
Reviewed and signed off by a registrar at the issuing body.
Confirmed live against the authoritative register at time of lookup.
What each result means
A code always resolves to exactly one of these.
| Result | What it tells you |
|---|---|
| Verified | The issuing organisation registered this credential and has not withdrawn it. Rely on it to the extent the assurance level supports. |
| Pending | A record exists but the issuing organisation has not confirmed it. Do not treat this as verification. |
| Revoked | The issuer registered this credential and has since withdrawn it. This is a stronger signal than "not found" — someone deliberately took it back. |
| Expired | It was genuine and is now out of date. Common for passports, permits and tax clearances. |
| Not found | Nothing is registered against that code. That is not proof of forgery — the issuer may simply not publish here — but this platform cannot confirm it. |
Why a record cannot be quietly edited
Every record is signed with an HMAC over its own contents at the moment it is saved. The signing key lives in the server's environment, never in the database.
That has a specific consequence worth stating plainly: if someone with database access changed a class of degree or moved a graduation year directly in the tables, the signature would stop reproducing. The platform recomputes it on every lookup, and a record that fails the check is never shown as verified — it is flagged and logged as a critical event instead.
The same signature is applied to every receipt, over the values printed on it, so a receipt filed two years ago can still be checked against what it claims.
What this platform does not do
OneVerify confirms what an issuing organisation has recorded. It does not inspect physical documents, and it cannot detect a credential that was fraudulently issued by an organisation with the authority to issue it.
A not found result means this platform has no record — not that the document is fake. Many legitimate issuers do not publish here.
Where a decision carries real weight, treat a OneVerify result as strong supporting evidence, not as the whole of your due diligence.
What a lookup reveals
Only the fields the issuing organisation marked as shareable for that credential type — typically the holder's name, what was awarded, by whom and when. Nothing else in the record is reachable through a public lookup.
Dates of birth, identity numbers, account numbers and internal references are held for matching only. A national identity lookup confirms that a number is registered and current; it never returns the identity file behind it.
Every lookup is logged with its time and originating address, and credential holders can see who has checked their records.
Integrating directly
Registered organisations can issue and verify over a JSON API with a key scoped to their organisation.
Keys are issued by a platform administrator and shown once. Requests are rate limited per key.
Credential types currently supported
Universities, polytechnics and professional bodies register the qualifications they award. Employers, embassies and scholarship boards confirm them in seconds instead of waiting weeks for a letter.
A confirmation service, not a lookup directory. It returns whether the number is valid, current and matches the name presented — never the underlying identity record.
Issuing authorities register travel documents so that airlines, embassies and employers can confirm validity and expiry without handling the physical booklet.
Banks register the reference letters and certificates they issue, so a landlord, visa officer or counterparty can confirm the document is genuine — without the bank fielding a phone call and without disclosing account details.
Employers register the service letters and certificates they issue to departing and current staff. A prospective employer confirms dates and title instantly, and the reference cannot be altered after issue.
Registrars and regulators publish the registration and licensing status of businesses, so a counterparty can confirm a company exists, is in good standing and holds the licence it claims — before signing anything.