Back to Copply

API documentation

Age Verification API Documentation

Integrate Copply for age decisions, parental consent workflows, ID upload preparation, deletion evidence, and store-ready API discovery.

Production base URL

https://copply.basemapped.com/api/copply

Authenticate with a Copply dashboard API key: Authorization: Bearer cp_live_...

Generate a key

Important authentication note

You need a Copply API key from the dashboard.

Postman and RapidAPI are discovery surfaces. To call the live API, sign in to Copply, generate a key at copply.basemapped.com/keys, and send it on every request as Authorization: Bearer cp_live_....

RapidAPI marketplace credentials, including X-RapidAPI-Key, do not authenticate Copply requests yet.

Create API key

Sign in and generate the Copply bearer key required for every API request.

OpenAPI spec

Import this YAML into API gateways, catalogs, SDK tools, and OpenAPI directories.

Postman collection

Importable collection with safe placeholder keys and production endpoint variables.

Public Postman docs

Hosted reference for developers who want to fork and test requests quickly.

BaseMapped product page

Buyer-facing overview, pricing, workflow, and launch-status copy.

Quick start

Make your first verified request.

curl -X POST https://copply.basemapped.com/api/copply/verify-age \
  -H "Authorization: Bearer cp_test_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"userId":"app-user-123","declaredAge":17,"stateHint":"TX","devicePlatform":"web"}'

Integration path

Four calls cover the launch workflow.

Most apps start with /verify-age, branch into parental consent only when required, and keep deletion evidence available for privacy requests.

POST/verify-age

Age decision

Returns whether the user is allowed, blocked, or needs parental consent for the supplied state and age.

Request

userId, declaredAge, stateHint, devicePlatform

Response

allowed, blocked, requiresConsent, consentMethod, reason, state

POST/parental-consent

Consent workflow

Creates or checks parental consent through email, credit-card verification, or ID upload.

Request

userId, method, parentEmail, stateHint

Response

consentRequired, consentVerified, verificationUrl, clientSecret, expiresAt

POST/get-upload-url

ID evidence upload

Creates a short-lived signed upload URL for ID evidence when ID verification is required.

Request

userId, fileName, contentType

Response

uploadUrl, path, expiresIn

POST/delete-verification-data

Privacy deletion

Deletes one user verification record set and writes an audit hash for evidence of deletion.

Request

userId, reason

Response

deleted, auditHash, deletedAt

GET/verify-consent?token=...

Email consent link

Browser-facing confirmation route opened from a parent consent email.

Request

token

Response

HTML confirmation page

Minor requires consent

{
  "allowed": false,
  "blocked": false,
  "requiresConsent": true,
  "consentMethod": "email",
  "state": "TX",
  "reason": "User is below the Texas minimum age and needs parental consent"
}

Allowed decision

{
  "allowed": true,
  "blocked": false,
  "requiresConsent": false,
  "state": "FEDERAL",
  "reason": "User meets the configured age threshold"
}

Deletion evidence

{
  "deleted": true,
  "auditHash": "sha256:9f2d...",
  "deletedAt": "2026-06-27T12:00:00.000Z"
}

Error handling

Return clear messages to your app.

INVALID_API_KEYThe bearer key is missing, revoked, or malformed.
INVALID_BODYRequired request fields are missing or use the wrong type.
CONSENT_EXPIREDA previous consent record is no longer valid.
RATE_LIMITEDThe account reached its current monthly request limit.
PROVIDER_UNAVAILABLEEmail, payment, or ID verification provider failed.
INTERNAL_ERRORUnexpected server error. Retry safely or contact support.

Compliance notes

Use Copply as the implementation layer.

  • Call Copply from your server or trusted backend, not directly from public client code with a live key.
  • Authenticate with a Copply dashboard key in the Authorization header; RapidAPI marketplace keys do not authenticate Copply requests yet.
  • Store your own application user ID; Copply only needs a stable userId for decisions, consent status, and deletion.
  • Handle all three decision branches: allowed, blocked, and requiresConsent.
  • Send a state hint when you have one; otherwise Copply falls back to federal baseline behavior.
  • Use /delete-verification-data when a user requests deletion or your retention window expires.
  • Treat Copply as implementation infrastructure, not a substitute for legal advice.

API stores

Store-ready discovery package.

Use the public docs, OpenAPI spec, and Postman collection when submitting Copply to API catalogs. RapidAPI-style listings should explain that Copply uses Copply dashboard bearer keys, not marketplace-only API headers.

Postman Public API Network

Use the public docs URL and collection above for developer discovery.

RapidAPI / Nokia API Hub

Listing copy must direct users to create a Copply dashboard API key; X-RapidAPI-Key is not accepted by the API yet.

OpenAPI directories

Submit the public OpenAPI URL for search and SDK-generation discovery.

AWS Marketplace SaaS

Hold for enterprise procurement after security and privacy docs are expanded.