> ## Documentation Index > Fetch the complete documentation index at: https://docs.spoofsense.ai/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve a session's result > Called from your backend with the secret key. The only trustworthy read of the decision — treat the user as verified only when `status` is `complete` AND `decision` is `real`. When a capture was blocked for suspected injection, `checks` is null and `risk` carries only `{injection_blocked: true, reason: "suspected_injection"}` — scores are withheld so flagged sessions can't probe the detectors. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/verification_sessions/{id} openapi: 3.1.0 info: title: SpoofSense API version: '1.0' description: >- Face liveness and deepfake detection. All errors use the envelope `{"error": {"code", "message"}}`. Input errors (4xx) are never charged. servers: - url: https://api.spoofsense.ai security: - secretKey: [] tags: - name: Detection description: >- Stateless checks on an image you already have. Authenticate with your secret key. - name: Verification sessions description: >- The secure capture flow used by the SDKs and hosted page. Server-side calls use the secret key; client-side calls use the session's sst_ token. - name: Service paths: /v1/verification_sessions/{id}: get: tags: - Verification sessions summary: Retrieve a session's result description: >- Called from your backend with the secret key. The only trustworthy read of the decision — treat the user as verified only when `status` is `complete` AND `decision` is `real`. When a capture was blocked for suspected injection, `checks` is null and `risk` carries only `{injection_blocked: true, reason: "suspected_injection"}` — scores are withheld so flagged sessions can't probe the detectors. operationId: getVerificationSession parameters: - name: id in: path required: true schema: type: string description: The vs_… session id. example: vs_1f2e3d4c5b6a79880917263544332211 responses: '200': description: The session content: application/json: schema: $ref: '#/components/schemas/VerificationSession' example: object: verification_session id: vs_1f2e3d4c5b6a79880917263544332211 status: complete decision: real checks: face_liveness: decision: real genuine_score: 0.94 threshold: 0.5 deepfake: decision: real genuine_score: 0.88 threshold: 0.5 risk: attestation: not_evaluated injection_blocked: false signals: duplicate_image: false media: available: true sha256: c0ffee… content_type: image/jpeg expires_at: '2026-02-01T12:00:00+00:00' products: - face_liveness - deepfake reference_id: user_123 metadata: null attempts: 1 failure_code: null sdk: platform: web version: 0.2.0 created_at: '2026-01-01T12:00:00+00:00' expires_at: '2026-01-01T12:15:00+00:00' captured_at: '2026-01-01T12:01:10+00:00' completed_at: '2026-01-01T12:01:10+00:00' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/SessionNotFound' components: schemas: VerificationSession: type: object properties: object: type: string enum: - verification_session id: type: string status: type: string enum: - created - complete - failed - expired decision: type: - string - 'null' enum: - real - spoof - null description: Verified = status "complete" AND decision "real". checks: type: - object - 'null' description: >- Per-product outcome. Null until complete, and null on injection-blocked sessions. additionalProperties: $ref: '#/components/schemas/Check' risk: type: object properties: attestation: type: string description: Device attestation status, e.g. not_evaluated. injection_blocked: type: boolean description: >- True when the capture was rejected for suspected injection (decision forced to spoof, checks withheld). reason: type: string description: 'Present only when injection_blocked: "suspected_injection".' signals: type: object description: >- Soft risk signals, e.g. duplicate_image: this exact capture appeared in another of your sessions. additionalProperties: true media: type: object description: >- Whether the captured selfie is retrievable via the /media sub-resource. properties: available: type: boolean sha256: type: string description: Present when available. content_type: type: string description: Present when available. expires_at: type: - string - 'null' format: date-time description: Retention expiry. Present when available. reason: type: string enum: - not_captured - storage_disabled - expired - unavailable description: Present when not available. products: type: array items: type: string reference_id: type: - string - 'null' metadata: type: - object - 'null' attempts: type: integer description: Capture attempts used (max 3). failure_code: type: - string - 'null' description: e.g. ATTEMPTS_EXHAUSTED on failed sessions. sdk: type: object properties: platform: type: - string - 'null' version: type: - string - 'null' created_at: type: string format: date-time expires_at: type: string format: date-time captured_at: type: - string - 'null' format: date-time completed_at: type: - string - 'null' format: date-time Check: type: object properties: decision: type: string enum: - real - spoof genuine_score: type: number description: >- Calibrated score in [0,1]; the decision boundary sits at 0.5 across model updates. threshold: type: number description: The threshold actually applied. Error: type: object properties: error: type: object properties: code: type: string message: type: string responses: Unauthorized: description: UNAUTHORIZED — missing, invalid, or revoked API key content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Missing, invalid, or revoked API key SessionNotFound: description: SESSION_NOT_FOUND — no such session for your organization content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: SESSION_NOT_FOUND message: No such verification session securitySchemes: secretKey: type: http scheme: bearer description: >- Your secret key (sk_live_…), server-side only. Also accepted as an `x-api-key` header. ````