Identity verification API timeout: recover without assuming approval

The API timeout issue in identity verification requires careful handling. Simply approving or rejecting a user based on a timeout is not justified, as it indicates the check could not complete successfully. This article explores a synthetic identity example, its time constraints, and possible failure scenarios to help you determine the appropriate course of action. The source material emphasizes that the decision is not a simple pass or fail, but rather which state to record and who should take the next step.

When a provider is unavailable or slow, your code must decide the user's experience and the application's actions. The decision should be recorded separately from the outcome. A timeout should never be logged as a decline or approval. There are three distinct outcomes: a mismatch (assertion), insufficient evidence (lacking required signal), and a technical failure (check could not complete). These outcomes should be recorded separately from the HTTP status code.

The downloadable example in this article is a synthetic fixture, not a live provider adapter. It uses SQLite to persist sessions and expires them if no callback arrives within the timeout period. The session can be in one of three states: pending, expired, or unknown. The recover method handles sessions that have expired, resetting their state locally without contacting the provider. The outcome of the recover operation is that the session is marked as "expired" and the "permission_granted" flag is set to false.

In a hypothetical scenario, a synthetic session with a 60-second timeout is created. If the provider call times out, a recover call at time 61 will mark the session as "expired" with no permission granted and without informing the provider. The system will then display a neutral message to the user and offer a new session or route them to an authorized provider refresh. The outcome is that no approval or denial occurs, and the user is not automatically reattempted.