Face Passive Liveness Detection

Tells from one image whether a face is a live person or a spoof, such as a printed photo, a realistic mask, a screen or a video replay; active liveness adds on-device challenges on top.

POST/v3/store/ekyc/face-passive-livenessTry it

• Price0.3 ICper request
• Monthly plans from650THB a month
• Measured300/300
• Served6Mcalls

• v1.8
• Active
• Benchmark paper (PDF)

Input

file

selfie.jpg

OutputPOST /v3/store/ekyc/face-passive-liveness

filename

S__5333002.jpg

predict

SPOOF

score

0.9999989633974822

darkness

0.51

data

SPOOF: 0.9999990463256836 REAL: 9.35794162160164e-7

normalized

SPOOF: 0.9999989633974822 REAL: 0.0000010366025178232263

status_code

200

duration

0.35393

message

SUCCESS

Every field, under Response

Request

curl -X POST https://api.iapp.co.th/v3/store/ekyc/face-passive-liveness \
  -H "apikey: YOUR_API_KEY" \
  -F "file=@selfie.jpg"

Response

200OK. The fields are explained under Response.

{
    "filename": "S__5333002.jpg",
    "predict": "SPOOF",
    "score": 0.9999989633974822,
    "darkness": 0.51,
    "data": {
        "SPOOF": 0.9999990463256836,
        "REAL": 9.35794162160164e-7
    },
    "normalized": {
        "SPOOF": 0.9999989633974822,
        "REAL": 1.0366025178232263e-6
    },
    "status_code": 200,
    "duration": 0.35393,
    "message": "SUCCESS"
}

Monthly plans

• Face S2,000 checks a month650 THB a month, 0.325 THB per check
  or 6,500 THB a year, two months freeSubscribe
• Face M10,000 checks a month3,000 THB a month, 0.3 THB per check
  or 30,000 THB a year, two months freeSubscribe
• Face L50,000 checks a month13,750 THB a month, 0.275 THB per check
  or 151,250 THB a year, one month freeSubscribe

Prices before 7% VAT. Every Face verification and liveness endpoint counts against the plan; beyond it, calls cost 0.3 credits per check from your balance, the pay-as-you-go price. Renews by card each month or year; cancel any time, effective at the end of the period.

Request

multipart/form-data, one image per request. Both endpoints cost 0.3 IC per request.

Headers

apikeystringrequired

Your API key, created under API Keys in the control panel.

Body

filefilerequired

The face image. JPEG, PNG, HEIC or HEIF, up to 10 MB.

Endpoint	Returns
/v3/store/ekyc/face-passive-liveness	The verdict, tested by iBeta to PAD Level 1
/v3/store/ekyc/face-passive-liveness/v1p10	The same, from the v1p10 model

The legacy paths /anti_face_spoofing, /api/v2/fas, /face-spoofing, /passive-face-liveness-detection and /v1p10/facial_anti_spoofing answer at the same price.

Response

predictstring

REAL or SPOOF, from the normalised score

scorenumber

The normalised score of the prediction, 0 to 1

normalizeddata

The REAL and SPOOF scores after and before normalisation

normalized.REALnumber

normalized.SPOOFnumber

darknessnumber

How dark the image is, 0 to 1

filenamedurationstatus_codemessage

The file name; seconds; 200 and SUCCESS on success

Details

Measured

On the production service, 28 October 2026, through the public API: 300 attack images and 200 live images from the official test split of the public CelebA-Spoof benchmark, 30 of each of ten attack types, and 69 genuine phone selfies from three public samples.

Measure	Result
Attacks accepted as live, 300 images of 10 types	0 (APCER 0.0%, 95% upper bound 1.0%)
Printed photo, poster, A4 print (90)	0 accepted
Paper cut-outs: face, upper body, region (90)	0 accepted
Replay on a computer, tablet or phone screen (90)	0 accepted
3D mask (30)	0 accepted
Genuine phone selfies rejected, 69 images	3 (4.3%, 95% CI 0.0–10.1%)
CelebA-Spoof live images rejected, 200 web photographs	79.5%
Median time through the API	0.34 s

The verdict is strict: the benchmark's live images, celebrity photographs collected from the web, were rejected 79.5% of the time, against 4.3% for phone selfies, so capture the selfie with the camera in your app rather than accepting an uploaded file. With 30 images per attack type and 69 selfies the intervals are wide, and neither set represents Thai users specifically. Method and limits: the benchmark (PDF).

Presentation-attack detection was also tested by iBeta to PAD Level 1: the confirmation letter (PDF).

Limits

• One face per image.
• Built for photos taken live by a camera: a photograph from a gallery or the web is likely to be returned as SPOOF.
• An image too dark to judge is returned without a verdict, with the message THIS_IMAGE_IS_DARK; ask the user to retake it in better light.

Data handling

Images are processed in memory and not kept after the response. iApp keeps no copy; consent and notice under PDPA and GDPR remain with you as the data controller.