Trust, Identity & Compliance Infrastructure for Indian Businesses

APIs for identity, documents, and fraud — built developer-first

FlowBase is a modular platform of trust and risk engines — document intelligence, matching, geo, identity, and compliance — with a sandbox you can start building against today, and transparent usage instead of black-box scores.

Create a sandbox account See what we're building

28 live engines, real endpoints todayNo credit card to startFree plan: 50 requests/mo for 3 months

curl -X POST https://api.flowbase.cc/v1/auth/otp/verify \
  -H "Content-Type: application/json" \
  -d '{
    "email": "founder@yourcompany.com",
    "code": "482913",
    "fullName": "Founder Name",
    "organizationName": "Your Company"
  }'

From sign-up to your first call in minutes

Create a sandbox account

Grab a test API key

Every account gets a sandbox project with its own scoped, rotatable credentials, instantly.

Call any engine

Versioned /v1 endpoints, structured errors, and request IDs — go live by switching to a live key.

Trust & risk engines

One modular foundation, thin API endpoints on top. 28 engines below are live — real endpoints you can call today, not a roadmap. Where a signal still runs on mock data (pending a licensed provider), that’s called out plainly in the description, never hidden.

Identity & Documents

Know who you’re dealing with.

Document Intelligence

Classify and extract fields from PAN, Aadhaar, GST, passports, and more — with checksum validation and a real tamper-risk heuristic (metadata + compression-inconsistency analysis), never an absolute authenticity claim.

OCR

Provider-agnostic OCR with structured fields, confidence scores, and real word-level bounding boxes. Swap providers via config, never rewrite your integration.

Identity Verification

Real format and checksum validation for PAN, Aadhaar, and GSTIN numbers, plus a registry-check slot ready for a licensed data provider — clearly labeled everywhere it’s still a mock.

Biometric Verification

Shareable links with in-house selfie capture, geolocation, and a classical computer-vision face-match + liveness algorithm we built and run ourselves — not a third-party biometric API.

Matching Engine

Explainable name, address, DOB, and entity matching built for Indian naming conventions, transliteration, and phonetic variation. Every score ships with its signals, never a black box.

Risk & Compliance

Turn signals into a decision you can explain.

Risk Engine

A configurable rule-based scoring layer that combines document, identity, geo, matching, and compliance signals into one explainable decision — rules live in config, not hardcoded in controllers.

Compliance (AML/PEP)

Real-time OFAC SDN and UN Consolidated sanctions screening, built in-house from public source lists — with full source provenance on every match and an architecture ready for licensed PEP/adverse-media providers.

Geo Intelligence

IP geolocation, reverse geocoding, geofencing, and VPN/proxy/datacenter risk signals for India-aware fraud checks.

IFSC Verification

Real RBI-format validation plus live bank and branch details (name, address, city, state) for any Indian IFSC code. Public data, so no vendor licensing and no mock mode.

Aadhaar Masking & Verification

Real Verhoeff-checksum validation and UIDAI-compliant masking — the raw number is never stored, only its masked form and the check result. Never a live e-KYC lookup.

Business ID Checks

PAN↔GSTIN cross-reference (a GSTIN structurally embeds the holder's PAN — a real substring check, not a lookup), plus Udyam (MSME) and Import-Export Code format validation.

Contact Intelligence

Collections/fraud contact-risk checks against your own customer records — phone, email, and photo verification, plus cross-org duplicate-contact and duplicate-photo detection. Never a lookup on someone who hasn’t already given you their details.

Email Verification

Real format, known-disposable-domain, and mail-exchange (MX) record checks, plus a best-effort domain-age lookup, scored into a risk band — then a real one-time email code to confirm the address is actually reachable.

Bank Verification

Reverse penny-drop via UPI — a real ₹1 transaction to a customer-supplied VPA resolves the registered account holder name, IFSC, and a masked account number in real time, with your own fuzzy name-match on top. No manual bank details needed.

Bank Statement Intelligence

Parses unstandardised bank statement PDFs — extracts the full transaction table and bank/account detail, then flags recurring salary credits, EMI/loan obligations, and bounce patterns from real, deterministic recurrence detection over the parsed rows.

Base64 Converter

Encode: pass a URL to an image or PDF — a cloud-drive share link, an S3/object-storage link, or any other reachable link — and get it back base64-encoded. Decode: pass a base64 payload back and get the real file, with its detected type. Real magic-byte content verification either direction, not a trust of the declared file type.

Academic Certificate Authenticator

Real Tesseract OCR reads an uploaded degree/marksheet/certificate and extracts name, institution, roll number, year, and grade wherever a genuine printed label is found, combined with the same document-forensics tamper checks used elsewhere. Not a database lookup — no free per-institution verification API exists in India — a real read of the document itself.

Mandi Price Intelligence

Real daily agricultural commodity prices from government-published mandi (APMC market) reporting — filter by state, district, market, and commodity to get minimum, maximum, and modal prices as reported that day.

Institution Registry

Cross-checks an institution name against AISHE (All India Survey on Higher Education), a real government dataset of individual colleges and universities, with a fuzzy-matched recognition verdict — a genuine second signal alongside the Academic Certificate Authenticator, not just an OCR read of one document.

FSSAI License Verification

Real 14-digit format validation on an FSSAI food-business license/registration number always runs; the registry lookup itself is best-effort and clearly flagged as unverified until confirmed against a live data.gov.in response.

Field Verification

Submit a real physical field-investigation lead — verify a shop exists, photograph a residence — and a nearby freelance field agent accepts it through their own portal, capturing a genuinely geo- and time-stamped, server-watermarked photo before an admin-configurable SLA deadline.

Engagement & Growth

Customer-facing tools on the same trust core.

QR Codes

Real, in-house QR generation — static codes are free and unlimited. Dynamic codes add editable destinations, device/time/location-based routing, scan limits, logo branding, and real retargeting pixels, all through a redirect we control.

eSign

Click-to-sign document workflows with a tamper-evident audit trail — per-signature IP, timestamp, device, and document hash — and real PDF stamping.

URL Shortener

Real short-link generation with genuine click analytics (IP, user agent, referrer). Random codes are free and unlimited; branded custom aliases are a paid-plan feature.

Location Capture

Send a one-time consent link by email, or in bulk via CSV upload — the recipient’s own action returns their GPS location (or an IP-based fallback). Never a lookup on someone without their knowledge.

RentShield

Share a link with a prospective tenant — they submit their PAN, Aadhaar, and a live selfie, and you get a real trust score built from real ID checksum validity and real liveness detection. No reference photo, no face-match.

BizMatch

Submit your own GSTIN and PAN to generate a shareable trust badge — a real GSTIN↔PAN cross-reference check, real checksum validation, and an optional real penny-drop bank-ownership deposit. Share the public badge link with counterparties instead of raw ID numbers.

FlowBase Privacy

DPDP compliance infrastructure for Indian businesses.

Consent Management

Define reusable, versioned consent purposes and capture granular, auditable consent through an API, browser SDK, or hosted widget — optional purposes are never pre-selected by default.

Consent Ledger

An append-only evidence trail for every consent decision — search by customer reference, purpose, application, or notice version, with a full timeline view and CSV/JSON export.

Preference Centre & Data Principal Requests

A hosted preference centre where a data principal can review consent, withdraw it, or submit an access, correction, erasure, or grievance request — routed into a manually-driven DSR workflow with internal SLA targets.

Privacy Notices

Draft, version, and publish privacy notices — a published version is immutable, and every consent record references the exact version shown at the time.

Don't just consume APIs — sell on them

Package a reusable trust component you've built — a scoring rule set, an integration, a workflow — and list it for other teams to install. Every version is SHA-256-verified on upload, browsable in a public catalog, and pays out through a real seller ledger when someone installs it.

Browse the marketplace

Verified packages

SHA-256 checksum on every upload

Public catalog

Cross-tenant browse and search

Real payouts

A ledger, not a promise

Admin review

Every listing screened before it goes live

Built for developers first

A dashboard, sandbox, and versioned API from day one — not bolted on after launch.

Test and live API keys

Separate sandbox and production credentials, scoped per project, rotatable on demand.

Sandbox by default

Every new account gets a sandbox project — build against realistic responses before going live.

Versioned, documented APIs

Every endpoint lives under /v1, with request IDs, structured errors, and interactive OpenAPI docs.

Interactive API Explorer

Build and fire real requests against your own sandbox data right from the dashboard — no Postman required.

Trust is the product, not just the pitch

The same discipline we ask engines to apply to your customers, we apply to your data.

Full tenant isolation

Every request is scoped to your authenticated organization — never a client-supplied ID.

Masked by default

Sensitive fields like PAN, phone, and email stay masked in the dashboard until you need to see them.

Configurable retention

Data retention is built to align with India’s DPDP framework from the schema up, not retrofitted later.

Auditable access

Sensitive reads and account actions leave a real, queryable audit trail.

Is your website ready for India's DPDP Act?

Run a free, automated scan of a handful of publicly-observable privacy signals — cookie consent markup, a linked privacy notice, security headers, and more. No account or credit card required.

This is a readiness signal for your own review, not a compliance audit or legal determination.

Start building today

Create an account and get a sandbox project instantly. No credit card required.

Create a sandbox account