Detect ID Card Tampering

Inspects an ID card image for signs of forgery, alteration or replay — a swapped portrait, altered fonts, a card photographed off a screen, or information that contradicts itself across OCR, MRZ and QR.

Endpoint

POST /v1/detect_id_card_tampering_sync
Content-Type: application/json

{
  "card_type": "vn.national_id",
  "image": {
    "id": "2dc863d6-1f68-4c82-8380-dd34e4ed7da0",
    "base64": "",
    "label": "id_card.vn.national_id.front",
    "metadata": "{}"
  }
}

Parameters:

Param	Type	Required	Default	Description
card_type	string	Yes	—	The card type. See Usage Recommendations.
image	ImageData	Yes	—	Image of the identity card's front side or back side.

ImageData

Param	Type	Required	Default	Description
id	string	No	—	ID of the image returned by Upload Image.
base64	string	No	—	Base64-encoded text of the image data.
label	string	No	—	Label of the image, as described in Usage Recommendations.
metadata	string_json	No	—	Key/value JSON string. Example: {"id":"<ID>","type":1}

Sample Request

curl --location '<BASE_URL>/v1/detect_id_card_tampering_sync' \
  --header 'Authorization: ATV <ACCESS_ID>:<SIGNATURE>' \
  --header 'X-TV-Timestamp: <TIMESTAMP>' \
  --header 'Content-Type: application/json' \
  --data '{
    "card_type": "vn.national_id",
    "image": {
      "id": "e94288e6-7ab5-4aeb-9608-8382f4ceb92f",
      "base64": "",
      "label": "id_card.vn.national_id.back",
      "metadata": "{}"
    }
  }'

Response

{
  "data": {
    "status": "success",
    "card_tampering": {
      "score": 1,
      "verdict": "alert",
      "details": [
        {
          "verdict": "photo_tampered",
          "score": 0.9394838,
          "info": "photo tampering detected"
        }
      ]
    },
    "image_id": "2dc863d6-1f68-4c82-8380-dd34e4ed7da0",
    "image2_id": "",
    "request_id": "d24883b6-f9ad-4d8b-a0fa-e8c6c81df87e"
  },
  "errors": []
}

Field	Type	Description
data.status	string	success or failure.
data.card_tampering.verdict	string	Overall verdict — good when no tampering was found, otherwise alert.
data.card_tampering.score	float	Confidence in the overall verdict, range 0–1.
data.card_tampering.details	TamperingDetail[]	Each specific tampering signal that fired.
data.image_id	string	ID of the analysed image.
data.image2_id	string	ID of the second image, empty when only one was supplied.
data.request_id	string	Request ID; quote it to CAKE Support when checking logs.

TamperingDetail

Field	Type	Description
verdict	string	The specific tampering signal, e.g. photo_tampered, non_liveness, qr_info_not_match. See Verdict Definitions.
score	float	Confidence in this signal, range 0–1.
info	string	Human-readable explanation of the signal.

WARNING

A good verdict is evidence, not a guarantee. Tampering detection is probabilistic — combine it with ID sanity, face matching and your own rule set before approving an onboarding, and log the full details array for audit.

Errors

Code	Message
2001010	Access ID not found.
401100	You are not authorized to perform the action.
4001000	Input parameter violates a constraint.
4001001	The X-TV-Timestamp header is expired, need a newer one.
5001000	Some unexpected error occurs while processing the request.

Code	Description
access_denied_exception	You are not authorized to perform the action.
invalid_parameter_exception	Input parameter violates a constraint.
request_time_too_skewed	The X-TV-Timestamp header is expired, need a newer one.
image_not_found_exception	The image ID is not found in DB.
rate_limit_exception	The number of requests exceeded your throughput limit.
internal_server_error	Some unexpected error occurs while processing the request.

Next Steps

• Verdict Definitions — the meaning and detection logic behind every tampering verdict
• Verify Face Liveness — the equivalent replay check on the selfie side