One-install Entrust Identity Verification front door over four bounded domain packs and nine operating workflows. It admits 80 of 84 operations from the current official v3.6 OpenAPI bundle. The four multipart identity-media uploads are explicitly excluded because the current static REST composition can serialize JSON but cannot construct multipart bodies. Enroll an Authorization-header connection in the tenant data region (EU, US, or CA) at https://api.eu.onfido.com, https://api.us.onfido.com, or https://api.ca.onfido.com; the pack owns /v3.6. For API-token auth, store the complete header value Token token=<API_TOKEN>. The official API also documents OAuth client credentials, but the current connection descriptor cannot perform that exchange; an externally minted bearer would need to be supplied as the complete Authorization value. All reads are uncached; SDK-token, webhook-secret, biometric, passkey, and evidence-download reads are marked sensitive-read. Every mutation is grant-off and approval-gated. Binary downloads become warehouse file references, no bundled workflow renders SDK tokens or webhook secrets, and no workflow downloads evidence, completes tasks, adjudicates matches, cancels reports, changes passkeys, or invalidates biometric tokens.