## Overview

The Hosted Flow lifecycle allows your platform to initiate a verification session, redirect the user to a Socure-hosted experience, and receive a final decision via webhook.

Your application does not collect identity data directly. RiskOS™ manages the full verification experience and returns control to your `redirect_uri` after the user completes the flow.

During the hosted experience, RiskOS™ orchestrates Prefill, KYC, Fraud, Watchlist, and conditional step-up verification when additional verification is required.

## Key behaviors

| Behavior | Detail |
| --- | --- |
| **Session handling** | Hosted Flow URLs are session-specific and should not be reused. |
| **Redirect behavior** | The `redirect_uri` indicates hosted experience completion, not final decision delivery. |
| **OTP (conditional)** | OTP may occur conditionally before Prefill completes. |
| **Document Verification** | DocV may occur conditionally after Prefill, KYC, Fraud, and Watchlist processing. Extract the `docvTransactionToken` from the response to launch the [Capture App.](https://help.socure.com/riskos/docs/capture-app) |
| **Initial response** | The initial API response represents a paused evaluation and does not contain the final decision. |
| **Final decision delivery** | The final decision is delivered asynchronously via the `evaluation_completed` webhook. |

## End-to-end flow

01. Create Hosted Flow session (`[POST /api/evaluation](https://help.socure.com/riskos/reference/postevaluation)`).

02. Receive response with redirect URL and initial evaluation state.

03. Redirect user to Hosted Flow.

04. RiskOS™ collects initial consumer data, including phone number and date of birth.

05. If required for that consumer, RiskOS™ triggers a [One-Time Password (OTP)](https://help.socure.com/riskos/docs/one-time-passcode-otp) challenge before Prefill completes.

06. RiskOS™ runs Prefill.

07. RiskOS™ collects any remaining identity data needed for the hosted onboarding flow.

08. RiskOS™ runs KYC, Fraud, and Watchlist screening.

09. If no additional verification is required, the evaluation resumes and completes after the hosted flow.

10. If additional verification is required, RiskOS™ triggers [Predictive Document Verification (DocV)](https://help.socure.com/riskos/docs/predictive-document-verification), pauses the evaluation, and delivers the final decision asynchronously via [webhook](https://help.socure.com/riskos/docs/webhook-events) (`evaluation_completed`, `data.decision`).

11. (Optional) User redirected to `redirect_uri`.

```
Your WebhookRiskOS™Your PlatformEnd UserYour WebhookRiskOS™Your PlatformEnd Useralt[OTP required]Run PrefillCollect remaining identity dataRun KYC, Fraud, WatchlistComplete evaluationVerify document and resume evaluationalt[No DocV required][DocV required]Start onboarding1POST /api/evaluation2201 Created + redirect URL + initial decision/state3Redirect to Hosted Flow4Enter phone number + date of birth5Prompt for OTP6Submit OTP7Send evaluation_completed8Prompt document + selfie capture9Submit document + selfie10Send evaluation_completed11Redirect to redirect_uri (optional)12data.decision13Route based on final decision14
```

## Evaluation processing

During the Hosted Flow, RiskOS™ orchestrates multiple products and verification steps:

- **Prefill**: Enriches and autofills identity data using authoritative sources.
- **OTP**: An optional verification step that may run before Prefill completes.
- **KYC**: Verifies identity against trusted data providers.
- **Fraud**: Evaluates device, behavioral, and risk signals.
- **Watchlist**: Screens against sanctions, PEP, and adverse media.
- **Document Verification (DocV)**: Step-up verification used only when additional verification is required.

### Conditional One-Time Passcode

After the user provides phone number and date of birth, RiskOS™ may trigger an OTP challenge if it needs additional verification before Prefill can continue.

OTP is conditional. It doesn't occur for every consumer.

If OTP is required, the user must complete it before Prefill can continue.

### Conditional Document Verification

If additional verification is required after Prefill and downstream screening, RiskOS™ triggers DocV as a step-up mechanism.

DocV is conditional. It doesn't occur for every consumer.

## Decision delivery

RiskOS™ delivers the final decision after the hosted flow completes.

- **Final decision**
  - The initial API response represents a paused evaluation state and does not contain the final outcome.
  - The evaluation resumes after the user completes the hosted flow.
  - The final decision is delivered through the `evaluation_completed` [webhook](https://help.socure.com/riskos/docs/webhook-events).
  - The final outcome is in `data.decision`.

## Document Verification

If triggered, the system may ask the user to:

- Capture a government-issued ID.
- Take a biometric selfie.
- Complete liveness verification.

DocV is automatically orchestrated within the hosted experience. No additional integration is required.

When DocV is triggered, the evaluation completes asynchronously and the final decision is delivered by webhook.

## Next steps

[Start a new evaluation\
\
Create a Hosted Flow session and launch the onboarding experience.](https://help.socure.com/riskos/docs/prefill-kyc-fraud-watchlist-hosted-flow-start-an-evaluation)

[Handle results\
\
Process webhook events and route users based on the final decision.](https://help.socure.com/riskos/docs/prefill-kyc-fraud-watchlist-hosted-flow-handle-results)