How do I mock the Onfido API locally?

Install stunt, add a one-service block to stunt.yaml (adapter: embedded:onfido-style), and run stunt up. You get a local, stateful stand-in for Onfido API v3.6 — 7 routes over rest — with no remote account, no network, and no bills.

Is the Onfido API mock data synthetic?

Yes — entirely. The adapter returns generated data only; stunt's adapter lint rejects real-looking secrets and PII at build time. It simulates the shape and behavior of Onfido API (routes, status codes, pagination, webhooks), never real records.

← all adapters

onfido-style

simulates Onfido API v3.6

restadapter v0.1.07 routes

verification

VMVM tier — no SDK suite yet· surface 7 · not implemented 5 · differs 6

use it

# add to stunt.yaml
services:
  onfido:
    adapter: embedded:onfido-style

# then
$ stunt up

The embedded: source extracts this adapter from the binary — no git clone, fully offline.

how to mock the Onfido API locally

Install stunt, paste the service block above into stunt.yaml, run stunt up — then point your client at localhost instead of Onfido API. It works offline, keeps state across requests and restarts, and every response is synthetic: the route shapes, status codes, pagination, and webhook delivery follow the real Onfido API v3.6 surface — the data is fake, the behavior is real.

backing stores

applicantsdocumentslive_photoscheckswebhook_events

api surface (7)

generated from the adapter manifest — exactly what boots, nothing more · covers 8% of the real API's 84 routes (derived from spec onfido-openapi-spec @ v3.6)

7 routes

POST/v3.6/applicants

POST/v3.6/documents

POST/v3.6/live_photos

POST/v3.6/checks

GET/v3.6/applicants/{applicant_id}

GET/v3.6/checks/{check_id}

POST/v3.6/webhooks

VM-verified behaviors (7)

✓a missing or non-Token Authorization header is 401 authorization_error
✓applicant create flags exactly the blank names and reads back by id
✓document and live photo uploads bind to a real applicant and default side
✓check create demands report_names and a known applicant
✓the check completes from the clock and emits check.completed exactly once
✓simulate_fail completes with consider and consider breakdowns
✓the webhook receiver MACs the exact raw bytes

Not implemented (5)

No SDK token generation (POST /v3.6/sdk_token)
No applicant list, update, delete, or resume endpoints
No reports sub-resource (GET /v3.6/reports/{id}); results inline only
No motion capture or video uploads; no document/live photo list or delete
No webhook registration or listing (local receiver only)

Differs from the real API (6)

Check lifecycle fixed: in_progress ~3s then complete; awaiting_applicant skipped
simulate_fail yields result consider; real sandbox uses special sandbox documents
Webhook HMAC secret is the public constant stunt_onfido_mock_signing_key
POST /v3.6/webhooks is a local stand-in receiver, not an Onfido endpoint
Synthetic sequential ids (app-000001...) where real Onfido uses UUIDs
The awaiting_applicant phase is skipped; documents assumed on file

full scorecard →

want more of the Onfido API surface? adapters are YAML + Starlark — the authoring guide covers adding routes, fixtures, and state machines. Open an issue for anything big first, or just file a PR — merged routes ship in the next release.