One integration to validate passports, licences and VEVO work-rights.
Integrate IDV Pacific document validation and Australian visa checks into your own systems, in real time or as an offline batch. Every check returns structured JSON data and an audit-ready PDF.
Real-time API or offline batch
Use the mode that fits the job: one document at the point of onboarding, or thousands processed off-peak.
Real-time API
Synchronous or asynchronousCall the API from your own app, website or backend and get validated data back.
- Synchronous: submit and get the result in the same response.
- Asynchronous: get a job id, we POST to your signed callback URL when done.
- A single mode flag switches between them, no polling required.
- TLS 1.2+, API key or OAuth, optional IP allow-listing.
Batch Processor
Files or CSV, at volumeSend a folder of images or a spreadsheet of data and collect the results, plus audit PDFs.
- Upload passport or licence images, or CSV / Excel rows.
- Run VEVO from a passport image or directly from your data.
- SFTP (SSH File Transfer Protocol) with key-based authentication.
- Automatic notification when every row in the upload is processed.
Two questions, one workflow
Is the document genuine, and does the person have the right to work? Every check returns structured data and an audit PDF.
Passport & licence validation
OCR and MRZ extraction from an image, across passports, driving licences and national ID cards.
Tamper & forgery checks
Cross-check chip and MRZ data against the printed page to flag altered or fabricated documents.
DVS document match
Confirm a document’s biographic details match the issuing agency’s records through the Document Verification Service.
Liveness & face-match
Active or passive liveness on a selfie, then biometric face-match of the person to the document portrait.
VEVO from a passport image
Read the passport, then run a Visa Entitlement Verification Online check to confirm the visa and its work conditions.
VEVO from CRM or CSV data
Run work-rights checks in bulk straight from data you already hold: name, date of birth, document number and country. Ideal for re-verifying an existing workforce.
From submission to signed result
One request runs the whole pipeline against authoritative government sources, then returns data and an audit PDF.
Submit
Send a document or a data row via the API, or drop a batch file over SFTP.
Validate
OCR, tamper, liveness and face-match, plus a DVS document match and a VEVO entitlement check.
Receive
Get the result inline (sync) or on a signed webhook (async), with polling as a fallback.
Retrieve
Pull structured JSON and an audit-ready PDF from the report URL for your records.
The asynchronous path, in detail
For batches and slower checks like VEVO, submit asynchronously. You get an immediate acknowledgement with a job id, and we deliver each result to your signed callback URL when it is ready.
- Every callback carries an HMAC-SHA256 signature header so you can verify it is genuinely from us.
- Verify the signature, return 200 quickly, then process out of band.
- Delivery is retried with backoff on any non-2xx, so handlers should be idempotent.
- VEVO requires the visa holder’s written consent, modelled as a consent object in the request.
Thousands of checks, off-peak
Send images or data in bulk and collect results the same day. Figures below are indicative only, not guarantees.
| Input | Volume (indicative) | Cut-off | Turnaround | Output |
|---|---|---|---|---|
| Passport validation & VEVO | Up to 2,500 images | Before midday | Same day | Data + audit PDF |
| VEVO from CSV data | Up to 5,000 rows | Anytime | ~3 hours | Data |
| Driving-licence validation | Up to 5,000 images | Before midday | Same day | Data + audit PDF |
Indicative only, subject to Department of Home Affairs and VEVO availability. Firm volumes and timing are set in your service agreement. Available pay-as-you-go or by subscription. A VEVO CSV upload uses columns such as given_names, family_name, dob, document_number, country.
Work-rights checks are now a board-level risk
Australian employers carry a legal duty to verify work rights, and the penalties for getting it wrong rose sharply in 2024.
Four states now license labour hire
Victoria, Queensland, South Australia and the ACT operate labour-hire licensing schemes. South Australia broadened its scheme to cover all labour-hire providers from 29 January 2026. NSW, WA, Tasmania and the NT have no state scheme, and licences are not transferable between states.
The duty is the employer’s
Under the Migration Act 1958 you must verify work rights before employing, and a documented VEVO check is the primary evidence for the “reasonable steps” defence. You cannot rely on a labour-hire provider or agency having checked. The obligation sits with every party in the arrangement.
Prohibited-employer register
Since 1 July 2024 (Migration Amendment (Strengthening Employer Compliance) Act 2024) new criminal offences apply, and serious or repeat offenders can be declared “prohibited employers” and named publicly, business name and ABN, on the Australian Border Force website.
Five layers of security, named
Defence in depth across transport, storage, residency, access and retention, handled under Australian privacy law.
TLS 1.2 / 1.3 for the API and SFTP (SSH File Transfer Protocol) for batch, with optional mutual-TLS.
AES-256 on stored files, results and the audit PDF.
Designed to keep processing and storage onshore in Australia, not sent offshore.
Multi-factor, least-privilege access with immutable logs of who accessed what and when, the same trail that produces the audit PDF.
Source images and liveness selfies are removed after processing; only the structured result and audit record are retained, with configurable retention.
Predictable to integrate, safe to retry
The auth, webhook, error and sandbox behaviour a technical evaluator checks for before they commit.
Authentication
Server-side bearer token, rotatable and revocable with last-used visibility. Never exposed in frontend code, TLS only.
Sync or async
One mode flag. Async returns a job id immediately and POSTs the result to your callback URL.
Signed webhooks
HMAC-SHA256 signature header. Verify, return 200 fast, process out of band. Retried on any non-2xx.
Idempotency
An Idempotency-Key means a retried submission returns the same result, never a double check or double charge.
Clear error model
Machine-readable code plus a human-readable reason, correct HTTP status, and a retryable vs non-retryable guide.
Sandbox
Deterministic results for named scenarios: pass, refer, expired, tamper, VEVO in-effect or ceased, including the full webhook flow.
One response, both outputs
Every response carries structured JSON for your systems and a report_url for the audit PDF your compliance team keeps on file: parsed fields, a per-check result map, an overall confidence score and a single pass, refer or fail decision.
- Named objects and endpoints, for example documents/verify and vevo/checks.
- OpenAPI specification, SDKs and a quickstart, available on request.
Frequently asked questions
The technical and compliance questions we hear most.
They answer two different questions. A DVS (Document Verification Service) check confirms an identity document is genuine and that its details match the issuing agency's records, returning only match or no-match, with nothing about visa status. A VEVO (Visa Entitlement Verification Online) check confirms whether a person holds a valid visa and what work conditions apply. Right-to-work compliance generally needs both, and this service performs both in one workflow, and also validates the physical document image for authenticity and tampering.
Both. For a single document you can call the real-time API synchronously and receive the extracted data and decision in the same response. For batches, or slower checks such as VEVO, use asynchronous mode: you get a job id immediately and we POST each result to your signed webhook when it is ready, with polling as a fallback. A single mode flag switches between them.
Both. IDV Pacific can extract and validate a passport or licence from an image and run the VEVO check from it, or run VEVO in bulk directly from CRM or CSV data you already hold: name, date of birth, document number and country. That makes it practical to re-verify an existing workforce at scale. Exact row caps and turnaround are confirmed in your service agreement.
Four jurisdictions operate labour-hire licensing schemes: Victoria, Queensland, South Australia and the ACT. South Australia broadened its scheme to cover all labour-hire providers from 29 January 2026, with a transition period to 29 July 2026. NSW, WA, Tasmania and the NT have no state scheme, and licences are not transferable between states.
No single check makes you compliant, and the legal obligation cannot be delegated. It sits with every party in the work arrangement. What the service does is give you the evidence to meet your VEVO work-rights, VOI, KYC and AML obligations: a documented VEVO check performed before employment is the primary evidence for the Migration Act “reasonable steps” defence, and every check returns a timestamped audit PDF recording the date, outcome and details confirmed.
It is the employer’s legal duty to verify work rights before employing. Since the Migration Amendment (Strengthening Employer Compliance) Act 2024 (in force 1 July 2024), significant civil penalties apply per worker and criminal penalties can include imprisonment; serious or repeat offenders can be declared “prohibited employers” and publicly named, business name and ABN, on the Australian Border Force website. See the Department of Home Affairs guidance on work-related contraventions.
Data is designed to be processed and stored onshore in Australia and not sent offshore. Traffic to the API uses TLS 1.2 or 1.3 with optional mutual-TLS; batch files move over SFTP (SSH File Transfer Protocol) with key-based authentication; stored files, results and audit PDFs are encrypted at rest with AES-256. Source document images and liveness selfies are removed after processing, with only the structured result and audit record retained. Handled under the Privacy Act 1988 and the Australian Privacy Principles.
Yes to the sandbox: it returns deterministic results for named test scenarios (pass, refer, expired, tamper, VEVO in-effect or ceased) regardless of the file uploaded, including the full asynchronous webhook flow. The JSON shown here is illustrative, to teach the request and response shape. The complete endpoint reference, field definitions, error catalogue and batch specification are in the API Programmer’s Guide and Batch User Guide, which you can request below.
Integrate and run your first batch this week
Tell us what you need to validate and we will send the guides, set up sandbox access, and connect you with an engineer, not a bot.
- API Programmer’s Guide and Batch User Guide
- Sandbox access for testing before go-live
- Reseller and white-label options for platforms
- Money-back guarantee on compromised transactions (terms apply)