Skip to main content
With API access, your website or practice software can send a new client their ClearAML onboarding link the moment they sign up. Your system sends the client’s email address to ClearAML; ClearAML creates the client and emails them their link. Everything after that happens in ClearAML as usual: the client verifies their identity and answers the onboarding questions, and you review the result in your dashboard. API access is off by default. It lives under Settings → Controls → API access.
Each invitation sent through the API is charged exactly like one sent from your Clients page. Nothing else about your plan changes.

​
Getting access

1

Request access

An Owner or Admin opens Settings → Controls → API access, optionally adds a note (your website, and what you will use it for) and clicks Request access. Compliance Officers see the card but are asked to request it through an Owner or Admin.
2

We review the request

The card shows the date you asked. We review every request and may get in touch to understand how you will use it.
3

You are emailed when it is on

Once access is approved, every Owner and Admin is emailed, and the card turns into your API key list.

​
Creating an API key

Owners and Admins create keys from the same card with Create API key.
  • Name: something that tells you where the key is used, such as “Website signup form”.
  • Invitations per day: the most this key may send in one day (Sydney time). The default is 20 and the maximum 500. Requests over the limit are refused until midnight, and you are emailed.
  • Allowed IP addresses (optional): one address or range per line (for example 203.0.113.5 or 198.51.100.0/24), up to 20. If you set any, the key only works from those addresses. Leave it empty to accept the key from any server.
  • Two-factor code: creating a key asks for a fresh code from your authenticator app (or a recovery code). If you have not set up two-factor authentication yet, set it up under Settings → Security first. After five codes in 15 minutes, wait a few minutes before trying again.
The key is shown once, and the window stays open until you click Done. Copy it straight into your server’s configuration (for example an environment variable) and give your developer the API guide. Use the key only from a server, never in a web page or mobile app: anyone holding it can send invitations charged to your wallet.
A firm can have up to five active keys.

​
Managing your keys

The key list shows each key’s name, the first characters of the key, who created it and when, when it was last used, and how many invitations it has sent today against its daily limit. Compliance Officers can see the list but cannot change it.
  • Edit a key to rename it, change its daily limit or change its allowed IP addresses. Raising the limit, or widening or removing the IP allowlist, asks for your two-factor code. Lowering the limit or narrowing the allowlist does not.
  • Revoke a key to stop it at once. Anything still using it is refused from the next request. A revoked key can’t be restored: create a new one.
  • If the person who created a key leaves your team or is suspended, the list marks the key so you can rotate it: create a new key, put it on your server, then revoke the old one. Keys belong to your firm, so they keep working until you do.
Every Owner and Admin is emailed whenever a key is created, changed or revoked, and when the person who created a key leaves or is suspended.

​
What happens with each invitation

When your system sends a client’s email address:
  • A new person: ClearAML adds them to your register as a client awaiting their onboarding, charges your wallet and emails them their link. They appear under Added manually in the Clients source filter, like anyone added one at a time.
  • Someone with an open invitation: nothing new is sent or charged. Your system is told the invitation already exists, so it is safe for your website to send the same person twice.
  • Someone you have already verified, or whose check is under way: nothing is sent or charged, and you get a bell notification so you can decide whether they need a new check.
  • Someone already on your register who has never been verified: the link goes to that existing profile instead of creating a duplicate. If the profile already has a name, your system must send the same first and last name, so that two people sharing one email address never overwrite each other’s record. If the names don’t match, nothing is sent and you get a bell notification instead.
  • More than one profile on that email: nothing is sent or charged, and you get a bell notification so you can choose.
The client’s link, reminders and the notifications when they finish all work exactly as for an invitation you send yourself. Replies to the invitation email go to the person who created the API key. Notices about finished checks go to your firm’s Owners and Admins.

​
When invitations pause

You get a bell notification and an email (at most once a day for each reason) when your system’s invitations are being refused:
  • Your wallet balance is too low: top up your wallet or turn on auto-recharge under Settings → Billing.
  • A key reached its daily limit: invitations resume at midnight (Sydney time), or raise the key’s limit.
  • Your firm reached its overall daily limit of 500 API invitations across all keys: contact us if you need more.
  • A key was used from an address outside its allowlist: if that was your own server, add its address to the key. If it wasn’t, revoke the key now.