A passport or identity document arrives as a file: a scan, a photo, an upload. Passport OCR turns that binary into the facts it carries - name, nationality, date of birth, document number, expiry date, and the machine-readable zone - as typed values that the matter can use. Crucially, it does not just dump text: every extracted fact carries a confidence score and a link back to where it came from, and nothing reaches a stakeholder, a KYC record, or a matter until a person has confirmed it. The extraction is the read-twin of document generation: where a template fills structured facts into a document, this reads structured facts back out of one.
What it does
Reads typed facts out of a passport or ID document. An extraction run takes a binary document reference and returns the identity fields it found as typed facts: name, nationality, date of birth, document number, expiry date, and the MRZ data. This is a sensitive operation that reaches an external document engine, so it runs through the same governed front door as everything else and is permission-checked, scope-checked, and audited before it executes. It is the structured inverse of generating a document from a matter’s data.
Every fact carries a confidence and a source. Extraction does not hand back bare values. Each fact comes with an OCR confidence score and a source_extraction reference recording where in the document it was read. Low-confidence reads are not silently accepted: under the no-silent-failure rule for regulated document types, a passport cannot quietly produce an incomplete or low-confidence result that is treated as fact. Instead, those reads route to a review lane for a human to settle.
A reviewer corrects before anything is written. The extracted facts are a proposal, not a commitment. A reviewer reads them back with their confidence and source, then corrects what is wrong and confirms what is right. Only on that human confirmation does a value land in the real record, written as an idempotent upsert that patches the existing fact rather than reconstructing the whole record. A human can never author a confidence and post fabricated fields into the live fact store: the realness contract holds, so an extraction’s candidates always come from an actual OCR or KYC run.
Identity data is treated as sensitive throughout. Personally identifying material is suppressed by default in the read surface and can be encrypted before write when the field calls for it. The passport image itself is a file with its own sensitivity marking and legal-hold controls, and the extracted facts are scoped to the matter or party they belong to: they do not become globally searchable unless that is explicitly approved. Every step - the original file, the extracted fields, the reviewer’s corrections, and the downstream write - lands in the tamper-evident audit trail.
It sits beside the KYC and verification flow. Reading a passport is usually one move within a wider identity check. The same identity material drives a verification check against an external provider (an Onfido-class rail), whose result transitions back in through the provider callback. The document capture intake records the underlying material as a governed capture record, redacted at ingest, so the passport, the extracted facts, and the verification check all hang off the same governed spine rather than three disconnected systems.
How you use it
Upload the passport. Store the passport scan or photo as a file on the matter or party, and mark its sensitivity. The file is the source the extraction reads from and the artefact the audit trail points back to.
Run the extraction. Trigger an extraction over the stored document. It returns the identity fields it found - name, nationality, date of birth, document number, expiry, and the MRZ - each as a typed fact with a confidence score and a source reference. This is the agent’s or operator’s landing path: the candidates come from a real OCR or KYC run, never typed in by hand.
Read the facts back with their confidence. List the facts for the target and you see each extracted value alongside its OCR confidence and where in the document it was read. High-confidence reads stand; anything below the threshold is flagged for review rather than accepted.
Work the review lane. Low-confidence or disputed extractions queue for a person. Open the review queue, see what is waiting and how it is ageing, and settle each one: correct a misread field, confirm a good one. Nothing updates the stakeholder, KYC, or matter record until that confirmation happens.
Confirm and write. Confirming a fact patches it into the existing record as an idempotent upsert, encrypted before write where the field is sensitive, with the transition recorded in the hash-chained audit. Pair the read with a verification check when the matter needs the identity proven against an external provider.
The kernel verbs behind it
Everything above runs through the kernel’s one front door: each call is permission-checked, scope-checked, and audited before it executes. These are the key verbs.
doc.extract- read typed facts out of a binary passport or ID document (the read-twin of document generation; OCR/KYC, sensitive, reaches the document engine).fact.list- list the extracted facts for a target, each with its OCR confidence and source-extraction reference.fact.set- confirm or correct an extracted fact, patching it into the record as an idempotent upsert with encrypt-before-write and audit.review.list- read the review queue, including the extraction lane where low-confidence reads await a human.verification.create- attach a KYC or verification check against an external (Onfido-class) provider.verification.update- the idempotent provider-callback transition that moves a check to its result.verification.cancel- cancel a verification check that is no longer needed.capture.ingest- take document or transcript material into a governed capture record, redacted at ingest.capture.list- list captures by source type (the home of DOCUMENT, MESSAGE, NOTE, and voice TRANSCRIPT captures).file.get- fetch the stored passport image the extraction reads from.file.setSensitivity- mark the identity document’s sensitivity so it is handled accordingly.
See the full set in the verification verb reference.