A simple RICA process, mapped to Section 40.

const API_BASE = 'https://www.verifynow.co.za/api/external';

async function callVerifyNow(path, body, idempotencyKey) {
  const response = await fetch(`${API_BASE}${path}`, {
    method: 'POST',
    headers: {
      'x-api-key': process.env.VERIFYNOW_API_KEY,
      'Content-Type': 'application/json',
      'Idempotency-Key': idempotencyKey,
    },
    body: JSON.stringify(body),
  });

  const data = await response.json();
  if (!response.ok) throw new Error(data.error || 'Verification failed');
  return data;
}

export async function verifyRicaCustomer(input) {
  const identity = await callVerifyNow(
    '/verify',
    {
      reportType: 'said_verification',
      idNumber: input.idNumber,
      mode: 'production',
    },
    `${input.customerReference}:identity`
  );

  const address = await callVerifyNow(
    '/consumer-trace-lite',
    {
      idNumber: input.idNumber,
      mode: 'production',
    },
    `${input.customerReference}:address`
  );

  const face = input.stepUp === true && input.selfieBase64
    ? await callVerifyNow(
        '/facematch',
        {
          bundle: 'facematch',
          mode: 'production',
          selfie_image_base64: input.selfieBase64,
          id_number: input.idNumber,
        },
        `${input.customerReference}:face`
      )
    : null;

  return { identity, address, face };
}