Send a verification code, or start a Government ID check

For a Government ID recipient (method government_id) this starts or resumes the signer's identity check with Persona instead of sending a code. It creates a Persona inquiry (once — a repeated call reuses it and never buys another), parks the calling browser's session secret in an HttpOnly cookie, and returns only what Persona's embedded flow needs: inquiryId, environmentId and, when resuming an in-progress inquiry, a short-lived sessionToken (never stored by Easerix). The response says nothing about whether the signer is verified: Persona's completion callback in the browser is not evidence. The verdict reaches Easerix only on POST /webhooks/persona, where it is verified by its signature and stored in Easerix, and the signer is verified only once Persona has APPROVED the inquiry (a merely completed or in-review inquiry is not). Poll the session GET until security.verificationStatus is verified. Calling this again after a failed or expired inquiry begins a new one, subject to the per-recipient cooldown and hourly cap and the organization's hourly allowance of new inquiries (PERSONA_ORG_HOURLY_CAP). The rest of this description is about the phone methods. Sends a one-time code to the phone number the SIGNER supplies — by text message (method sms) or a spoken voice call (method voice), whichever the sender configured for this recipient. Only ever called by an explicit signer action: loading the session never sends anything. Requires the access code (X-Access-Code) first when one is set. The code is generated, delivered and checked by the verification provider; Easerix neither generates nor stores it, and the number is passed to the provider without being persisted (only its last four digits are kept, for display and the audit trail). A resend — to the same or a corrected number — is refused server-side for 30 seconds after the previous send and after 5 sends an hour for this recipient (429 with Retry-After). A caller already holding a valid verified session gets {status: "verified"} back and nothing is sent. A caller WITHOUT it (another browser) may start its own verification at any time: that never ends the existing session, which stays valid until it lapses or a verification succeeds. The full number is never returned.

curl -X POST "https://example.com/public/signing/string/verification/start" \  -H "Content-Type: application/json" \  -d '{    "method": "sms"  }'

{  "status": "challenged",  "method": "sms",  "provider": "persona",  "inquiryId": "string",  "environmentId": "string",  "sessionToken": "string",  "awaitingDecision": true,  "channel": "sms",  "destination": "string",  "expiresAt": "2019-08-24T14:15:22Z",  "resendAvailableAt": "2019-08-24T14:15:22Z"}