Get SelfieGET

Retrieve the selfie captured during a Human Token process.

Markdown

Returns the biometric selfie captured by the user during a Human Token process. The image is returned as a base64-encoded string.

Available for any finished process that executed a biometric capture — all five Human Token flows (api+humantoken, api+liveness+humantoken, api+liveness+humantoken+revalidation, humantoken, humantoken+revalidation). Not available when the process finished without a biometric capture, since there is no selfie to return.

warning

The selfie is available for 24 hours after the process finishes. After that, the image is permanently deleted and this endpoint returns 404.

Endpoint

Environment	URL
Production	GET https://humantoken.unico.app/client/v1/process/{processId}/selfie

Request

Headers

Header	Value
x-unico-accesskey	<your_access_key> (see Authentication)

Path parameters

Parameter	Type	Required	Description
processId	string (UUID)	yes	Process identifier returned by Create Process.

Example

cURL

curl -X GET https://humantoken.unico.app/client/v1/process/$PROCESS_ID/selfie \
  -H "x-unico-accesskey: $UNICO_ACCESS_KEY"

Node.js

import fetch from 'node-fetch';

const res = await fetch(
  `https://humantoken.unico.app/client/v1/process/${processId}/selfie`,
  { headers: { 'x-unico-accesskey': process.env.UNICO_ACCESS_KEY } }
);
const { fileContents, contentType } = await res.json();
// fileContents is a base64-encoded image string

Responses

200 OK

{
  "fileContents": "/9j/4AAQSkZJR...",
  "contentType": "image/jpeg"
}

Field	Type	Description
fileContents	string (base64)	The captured selfie, base64-encoded.
contentType	string	MIME type of the image — image/jpeg or image/png.

Error Codes

400 Bad Request

The processId path parameter is missing or malformed.

401 Unauthorized

Access key missing or invalid in the x-unico-accesskey header. See Authentication.

403 Forbidden

Insufficient permissions to access the selfie for this process.

404 Not Found

Process not found, the process finished without a biometric capture, or the 24-hour retention window has expired.

429 Too Many Requests

Rate limit reached. When your system receives an HTTP 429 error, you must implement mechanisms to prevent cascading failures and avoid worsening the restriction.

Best practices:

• Cool-down period (backoff): Immediately halt or throttle subsequent requests from your system. Do not continuously retry failed requests in a tight loop.
• Queueing & throttling: Buffer or queue outgoing requests on your end to control the traffic flow before re-sending them.
• Exponential backoff with jitter: When retrying, increase the waiting time exponentially between attempts (e.g., 1 s, 2 s, 4 s, 8 s) and add a small random delay ("jitter") to prevent a herd effect where all queued requests retry at the exact same millisecond.

warning

Continuously hitting a rate-limited endpoint without backing off can prolong the restriction period and severely impact your system's operational throughput. Properly throttling requests on your side ensures a smoother, more resilient integration.

For default limits, increase requests and additional details, see Rate Limits.

What's next

• For the full process result, see Get Process.
• Back to Create Process to send a new selfie.