## Overview

The Hosted Flow lifecycle allows your platform to initiate a verification session, redirect the user to a Socure-hosted experience, and receive a final decision via webhook.

Your application doesn't collect identity data directly. RiskOS™ manages the full verification experience and returns control to your `redirect_uri` after the user completes the flow.

During the hosted experience, RiskOS™ orchestrates KYC, Fraud, Watchlist, and conditional step-up Document Verification when additional verification is required.

## Key behaviors

| Behavior           | Detail                                                                                                                                                    |
|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Decision delivery** | Final decisions are delivered asynchronously via `evaluation_completed` webhook. The initial `POST` response contains a `REVIEW` decision and `redirect_uri`. |
| **DocV step-up**    | If additional verification is required, users are prompted to capture a government-issued ID and selfie within the [Capture App](https://help.socure.com/riskos/docs/capture-app) hosted experience. |
| **Redirect**        | After the hosted flow completes, the user is redirected to your `redirect_uri`. The redirect indicates UX completion, not the final decision.                |

## End-to-end flow

1. Create Hosted Flow session ( [`POST /api/evaluation`](https://help.socure.com/riskos/reference/postevaluation)).
2. Receive response with redirect URL and initial evaluation state.
3. Redirect user to Hosted Flow.
4. RiskOS™ collects identity data, including phone number and date of birth.
5. RiskOS™ runs KYC, Fraud, and Watchlist screening.
6. If no additional verification is required, the evaluation resumes and completes after the hosted flow.
7. If additional verification is required, RiskOS™ triggers [Predictive Document Verification (DocV)](https://help.socure.com/riskos/docs/predictive-document-verification), pauses the evaluation, and delivers the final decision asynchronously via [webhook](https://help.socure.com/riskos/docs/webhook-events) (`evaluation_completed`, `data.decision`).
8. (Optional) User redirected to `redirect_uri`.

```
SocureYour PlatformEnd UserSocureYour PlatformEnd Useralt[DocV Step-Up required]Start onboarding
1POST /api/evaluation with workflow + redirect_uri
2REVIEW decision + hosted redirect_uri
3Redirect to Socure hosted experience
4Complete hosted flow (PII, KYC, Watchlist)
5Prompt for document capture + selfie
6Submit document images and selfie
7Process evaluation
8Redirect back to redirect_uri
9Webhook: evaluation_completed (ACCEPT / REJECT)
10Show onboarding result
```

## Evaluation processing

During the Hosted Flow, RiskOS™ orchestrates multiple products and verification steps:

- **KYC**: Verifies identity against trusted data providers.
- **Fraud detection**: Evaluates behavioral and device risk signals.
- **Watchlist screening**: Screens against global sanctions, PEP, and adverse media lists.
- **DocV step-up**: Triggers document verification when risk thresholds are met.

## How document verification works

If additional verification is required during the hosted flow, RiskOS™ triggers Predictive Document Verification (DocV).

Users may need to:
- Capture a government-issued ID
- Take a biometric selfie
- Complete liveness verification

Final decisions are delivered asynchronously via webhook. You must configure a webhook endpoint to receive `evaluation_completed` events.

## Next steps

[Start a new evaluation\n\nCreate a Hosted Flow session and launch the onboarding experience.](https://help.socure.com/riskos/docs/kyc-watchlist-screening-hosted-flow-start-an-evaluation)

[Handle results\n\nProcess webhook events and route users based on the final decision.](https://help.socure.com/riskos/docs/kyc-watchlist-screening-hosted-flow-handle-results)