v1/verifications or v1/banks are permitted; any other path is rejected before an upstream call is ever made. All query parameters on the request are forwarded verbatim to the corresponding Verification API route. A best-effort, PII-free audit record (caller identity, HTTP method, downstream path, upstream status code, outcome, duration) is persisted for every attempted call, including rejected and failed ones; audit persistence failures never block the response. When the downstream call reaches the Verification API, the response HTTP status code and JSON body are relayed back verbatim — including the Verification API's own 4xx/5xx errors, which are not treated as failures of this proxy endpoint. Because the response body is whatever the Verification API returns for the requested path, its exact shape cannot be documented generically here; it varies per downstream route and is not validated or transformed by core-service.curl --location '/unified-verifs/v1/verifications/bvn/12345678901?*=country%3DNG' \
--header 'Authorization: Bearer <token>'{
"status": "success",
"data": {
"status": true,
"message": "Verification retrieved",
"data": {
"bvn": "12345678901",
"first_name": "Ada",
"last_name": "Okafor"
}
}
}