REST API + Webhooks — Singpass-Powered

Visitor Management API:
Sandbox to Production in Hours

Standard REST endpoints for Singpass-verified visitor check-in. Generate QR codes, poll status, get government-verified identity data. The Singpass FAPI 2.0 complexity is handled on our side.

Free plan: 50 check-ins/month · Sandbox included · No GovTech paperwork

Definition

The SingVMS Visitor Management API lets you embed Singpass-verified check-in into your own applications. It abstracts Singapore's FAPI 2.0 and OIDC protocols into standard REST endpoints you can call with an API key. Generate a QR code, poll for authentication status, and receive government-verified visitor identity — all without touching Singpass's security profile directly.

Two approaches

Build a VMS API yourself
vs. use SingVMS

You can implement FAPI 2.0 and build visitor management from scratch, or call our REST endpoints and get verified identity data back.

Direct Integration

Build it yourself with GovTech

  • Register as a Singpass relying party
  • Implement FAPI 2.0 security profile
  • Build OIDC discovery, DPoP proof, PKCE
  • Handle key rotation and mTLS
  • Pass GovTech security assessment
  • Maintain ongoing compliance
Several months
API Reference

The Visitor Management API at a glance

Three endpoints, two webhook events, six data scopes. That's the entire surface area.

Authentication Endpoints

  • POST /api/v1/auth/qr-session
  • GET /api/v1/auth/status/{sessionId}
  • GET /api/v1/auth/identity/{sessionId}

Webhook Events

  • POST checkin.completed
  • POST identity.verified

Available Scopes

  • openid
  • uinfin
  • name
  • dob
  • mobileno
  • email

Auth & Security

  • HDR X-API-Key: your_api_key
  • HDR X-Webhook-Signature: HMAC-SHA256
Example Response — Identity Endpoint JSON
01{
02  "success": true,
03  "data": {
04    "sessionId": "sess_a1b2c3d4",
05    "nricMasked": "S****567A",
06    "nricHash": "sha256:e3b0c44...",
07    "name": "TAN AH KOW",
08    "dob": "1990-01-15",
09    "mobile": "+6591234567",
10    "email": "[email protected]",
11    "verifiedAt": "2026-06-19T08:30:00Z"
12  }
13}
Getting started

Sandbox to production in three steps

No GovTech review. No security assessment. SingVMS is already a registered relying party.

1

Get API keys

Sign up for a free account. Generate sandbox API keys from the dashboard. Takes about 30 seconds.

2

Test in sandbox

Call the endpoints with sandbox keys. Generate QR codes, poll status, get test identity data. Uses Singpass staging environment.

3

Go live

Switch to production keys. Same endpoints, same response format, real Singpass authentication. No additional review needed.

Data fields

MyInfo scopes available
through the API

Request only the data you need. Each scope maps to a verified field from Singapore's MyInfo database.

openid

Authentication

Base scope required for all requests. Confirms the user authenticated via Singpass. Returns a session token.

uinfin

NRIC / FIN

Returns a masked NRIC (S****567A) and a SHA-256 hash. Full NRIC is never stored or exposed. Use the hash to match returning visitors.

name

Full Name

The user's registered name as it appears on their NRIC. Government-verified, not self-reported. Returned as an uppercase string.

dob

Date of Birth

ISO 8601 format (YYYY-MM-DD). Useful for age verification, access control rules, or compliance requirements.

mobileno

Mobile Number

The mobile number registered to the user's Singpass account. Formatted with country code (+65). Useful for follow-up communications.

email

Email Address

The email address linked to the user's MyInfo profile. Not all users have this populated. Handle null values in your integration.

Technical benefits

What the VMS API handles for you

Every piece of Singpass complexity we've abstracted away from your integration.

FAPI 2.0 handled for you

The Financial-grade API security profile is implemented and maintained on our side. You never touch OIDC discovery, token endpoints, or compliance profiles.

DPoP and PKCE abstracted

Demonstration of Proof-of-Possession and Proof Key for Code Exchange run server-side. Your integration uses a simple API key. No cryptographic operations needed.

Standard REST API

JSON in, JSON out. No proprietary SDKs, no SOAP, no XML. Works with any language or framework that can make HTTP requests.

Webhook support

Get notified when events happen instead of polling. Configure webhook URLs in the dashboard and receive signed POST requests for check-in and identity events.

PDPA compliant data handling

NRICs are masked and hashed, not stored in full. Data retention follows PDPA guidelines. You get verified identity without the compliance burden of holding raw PII.

Free plan included

50 check-ins per month on the free plan. No credit card to start. Need more? Enterprise plans with custom pricing are available — WhatsApp us.

FAQ

Common integration questions

What developers usually ask before starting.

API key authentication via the X-API-Key header. Keys are scoped per environment (sandbox and production) and can be rotated from your dashboard at any time. All requests must be made over HTTPS.

Yes. The API gives you the building blocks: QR code generation, status polling, and identity retrieval. You can embed these in any frontend you want, whether that's a kiosk app, a mobile check-in flow, a web portal, or a Singpass visitor management system. The UX is yours to design.

100 requests per second per API key. API access starts on the Professional plan. For higher volume, WhatsApp us for custom enterprise pricing.

No. SingVMS is already registered as a Singpass relying party with GovTech. Your authentication requests go through our registered integration. You skip the GovTech onboarding process, security assessment, and ongoing compliance maintenance entirely.

The session status endpoint will show a timeout if no one authenticates. You can detect this and fall back to a manual registration form. In practice, most Singapore citizens and PRs (4M+ users) already have Singpass, so this is an edge case rather than the norm.

Set a webhook URL in your dashboard. When events fire (like checkin.completed or identity.verified), we send a POST request with a JSON payload to your URL. Each request includes an X-Webhook-Signature header with an HMAC-SHA256 signature so you can verify it came from us.

Full NRICs are never stored or returned. You get a masked version (S****567A) for display and a SHA-256 hash for matching returning visitors. This approach satisfies PDPA requirements while still giving you a stable identifier for repeat check-ins.

Yes. The sandbox environment connects to Singpass staging, which provides test NRICs and mock authentication flows. You can run the full integration cycle without real user data. When you're ready, switch to production keys and everything works the same way against real Singpass.

Start building with
the SingVMS Visitor Management API.

Free tier. Sandbox included. No GovTech paperwork.

Free plan: 50 check-ins/month. Enterprise: custom pricing.