SDKs & libraries

The published packages are version 0.1.1, and two things in them need care

A retried verification can be charged twice. 0.1.1 retries any request after a 5xx or a dropped connection, and it cannot send an Idempotency-Key — no method accepts one and the client never sets the header. Verification is charged when the request is accepted, so a failure arriving after that means the retry submits a second, separately billed job. This affects verify(), verify_batch() / verifyBatch() and verify_batch_and_wait() / verifyBatchAndWait().

Until 0.2.0 is published, make those calls against the REST API directly, where you set the Idempotency-Key header yourself and a retry with the same key is free. Keep using the package for everything else. Turning retries off is not a substitute: the first request still carries no key, so a dropped response is still ambiguous — and in Python max_retries=0 makes the client send no request at all.

find() works differently, and the same advice does not apply. The finder does not read Idempotency-Key at all — the API deduplicates it server-side, charging the same five credits once for an identical search from the same account inside a two-minute window (with a one-minute look-back for a retry that straddles the boundary). The client's own immediate retries therefore settle on one charge. A retry you make later is a new search and is charged again, so do not re-run a finder call minutes afterwards expecting it to be free.

The webhook helpers expect an older payload. 0.1.1's helpers read the flat payload an earlier contract delivered; Kawaa now sends an { event, data } envelope. Verify the signature and read the envelope as shown on the Webhooks page rather than through those helpers.

The rest of 0.1.1 behaves as documented: get_account() / getAccount(), the job reads and the result download. Two gaps worth knowing about rather than discovering: there is no usage method, and the account response the package returns carries the credit fields but not the usage statistics GET /v1/account sends — read those from GET /v1/usage directly. File verification is likewise REST-only; no published client exposes it. The 0.2.0 clients in the repository send an Idempotency-Key on the charged calls by default and, after an ambiguous failure, retry only requests that are safe to repeat: GETs and anything carrying a key. They still retry a 429 for any method, because the rate limiter refuses before doing any work, and the Python client also retries a failure that provably happened before the request was sent. If you need 0.2.0 before it reaches the registries, email developers@kawaa.com.