Add a document-tampering signal to your KYC and KYB checks
Atomara is a REST API that checks whether a PDF proof of address, utility bill or bank statement was edited after it was issued — one signal you can combine with your identity checks.
Your flow already verifies the person. Send the supporting PDFs to one endpoint and add whether the paperwork itself was edited. It does not verify passports, ID cards or faces.
Get an API key Talk to us about volume
Register with a work email and your first key adds 100 trial checks.
What your customers' users send
Proof of address
The document that ties a verified person to a place.
- A name or an address replaced on a genuine document
- Dates moved forward to look recent
- A file assembled in a design tool
Utility bills
The most common proof of address, and among the easiest to edit.
- An account holder changed in a PDF editor
- A bill rebuilt from a downloaded template
- A file saved again by an editor after it was downloaded
Bank statements
Used for account ownership in KYB and for source of funds.
- An account holder or company name replaced
- Balances edited so the totals no longer reconcile
- A statement regenerated by a tool that is not the bank's
How to add it to your verification flow
- Create a key. Register, open Developers and issue an API key. A work email gets trial checks on its first key.
- Send each PDF. POST the file with your case id as external_id. Most answers come back in the same response; a slow one returns 202 processing and you fetch it with GET /documents/{id}.
- Combine the signal. Feed the verdict and score into your own risk decision alongside your identity and sanctions checks.
curl -X POST https://atomara.io/api/v1/documents \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Idempotency-Key: kyb-case-3381-address" \
-F "file=@statement.pdf" \
-F "external_id=kyb-case-3381"{
"id": "doc_3f9a1c8e6d2b4f7a9c311e5b0a77d4c2",
"object": "document",
"status": "completed",
"external_id": "kyb-case-3381",
"verdict": "tampered",
"score": 3,
"tamper_score": 0.87,
"integrity_score": 0.05,
"confidence": 0.82,
"summary": "The file was re-saved by an editor after issue.",
"signals": [
{
"id": "editor_producer_blacklist",
"module": "M4",
"kind": "tamper",
"severity": "high",
"evidence": "Producer: Adobe Acrobat Pro DC",
"scored": true
},
{
"id": "invariant_balance",
"module": "M8",
"kind": "tamper",
"severity": "medium",
"page": 2,
"evidence": "Closing balance: expected 4310.50, found 6310.50",
"scored": true
}
],
"engine": {
"version": "1.0.0",
"rules_revision": "2026-07-07"
},
"report_url": "https://atomara.io/account/uploads/3f9a1c8e6d2b4f7a9c311e5b0a77d4c2"
}What you add to a case
A verdict
tampered, suspicious, inconclusive, authentic (a digitally signed file, or one matching a reference template of its issuer) or unsupported — one field your rules can branch on.
A 0–100 score
A number you can weight in your own risk model. A scan or a photo usually carries no score.
Named signals
Each finding has a stable id, a severity and its evidence, so you can map individual signals into your own reason codes.
What it does not do
- It reads the PDF itself: its structure, metadata, fonts and arithmetic. It does not contact the bank or employer that issued it.
- Send documents as PDF — a JPEG or PNG is refused. A scan or a photo saved as a PDF is checked as an image and usually comes back without a score, because a picture of a page cannot show which file it was taken from. Route it to a person, or ask for the original PDF.
- An unsigned file is called authentic only when its structure matches, in every detail, a reference template learned from genuine documents of its issuer, and nothing points to editing; the response then says whether the amounts were verified too. Otherwise the best answer for an unsigned file is inconclusive with no signs of editing found.
- There are no bank-specific templates. The same checks run on a statement from any bank.
Pricing
From $0.10 per document at volume, with no minimum and no setup fee. One document is one check, whatever its page count. Paid plans start at $5 a month. See all plans →
Your users' documents
- Files and reports are deleted 30 days after upload, automatically; only the verdict and the score are kept.
- DELETE /documents/{id} removes the file and its report immediately.
- Documents are not shared with third parties and are not used to train models.
- No person is in the loop: the verdict comes from the engine, not from a reviewer.
Questions platform teams ask
Does it verify passports or ID cards?
No. It checks supporting documents in PDF form — proof of address, bills, statements — for signs of editing. Identity documents and liveness stay with your identity provider.
How do we combine it with our risk score?
Use the score and the verdict as one input. Signals are returned with stable ids, so you can weight or map them individually.
What about photos and scans of a utility bill?
Send them as PDF — a JPEG or PNG is refused. A scan or photo saved as a PDF is checked as an image and usually comes back without a score, because a picture of a page cannot show which file it was taken from. Ask for the PDF the utility or bank issued.
Is there a free trial?
Every account gets 3 full checks once the email is confirmed. Register with a work email and your first API key adds trial checks, so you can run real cases through it.
How long do you keep the documents?
30 days, after which the file and its report are deleted automatically, keeping only the verdict and the score. You can delete any document immediately with DELETE /documents/{id}.
Talk to us about volume
Tell us what you receive and how much of it. We answer within one working day and can add trial credits for a real test.