Identity Document Processing in Make.com: Intake Folder to Multi-API CRM

Shared “KYC drop” folders collect passports, PANs, Aadhaar cards, and licenses with inconsistent names. This Make.com scenario watches an intake folder, Filters by MIME type and filename hints, Routes to the correct Cryvis identity API, and upserts a CRM contact. It is the unlabeled counterpart to the explicit Typeform document-type flow in Automate KYC.

Architecture

Cloud drive / SFTP / intake folder
        |
        v
Make: Watch + Download
        |
        v
Filter: MIME in pdf/jpeg/png/webp
        |
        v
Router (filename / path hints)
  |        |         |          |
  v        v         v          v
Passport  PAN     Aadhaar   Driver License
  |        |         |          |
  +--------+----+----+----------+
               |
               v
            CRM upsert
         + doc_type + status

Endpoint cheat sheet (do not mix field names)

Base: https://api.cryvis.com
Header: Authorization: Bearer YOUR_API_KEY

Step 1: Intake conventions

Even “unlabeled” folders need light conventions or accuracy drops:

/intake
  /unknown          <- default watch
  /passport_pairs   <- optional: paired biodata+final
  /_done
  /_needs_human

Filename hints you will Filter on (examples):

MIME Filter first: reject image/heic, application/zip, etc., before HTTP spend.

Step 2: Watch, download, classify

1. Drive/Dropbox/OneDrive → Watch files on /intake/unknown.
2. Download binary.
3. Set variables:

mime       = file MIME
name_l     = lower(filename)
path_l     = lower(path)

4. Filter: mime ∈ allowed set.

5. Router with Filters on name_l / path_l as in the table above.

Step 3: Passport route (pair problem)

Passport is the hardest unlabeled case because Cryvis requires two parts. Strategies:

A. Pairing by applicant id prefix

rahul_passport_first.jpg
rahul_passport_last.jpg

Use Make to group by prefix rahul_passport_ within a short time window (Data store or Aggregate). Only call Cryvis when both arrive.

B. Dual upload in one PDF

If policy allows a single PDF containing both pages, you still must supply two multipart fields — split pages upstream or require two files. Do not invent a single-file passport call.

HTTP when both binaries ready:

POST /v1/documents/passport
first_page = <biodata>
last_page  = <final>

Map data.full_name, passport_number, date_of_birth, nationality, expiry_date, mrz.check_digits_valid.

Docs: /docs/api/extractPassport · /apis/passport.

Step 4: PAN route

POST /v1/documents/pan
file = <binary>

Map pan_number, full_name, father_name, date_of_birth, holder_type, pan_structure.*.

Docs: /docs/api/extractPan · /apis/pan.

Step 5: Aadhaar route (PII)

POST /v1/documents/aadhaar
file = <front>
file = <back>   # optional second part, same name

If only one file is in intake, send one file part. Map aadhaar_number, is_masked, address, pincode, etc.

CRM rules:

• Restrict Aadhaar property visibility
• If is_masked and policy needs full UID → CRM status needs_unmasked
• Never put raw Aadhaar in shared Slack from this Router

Docs: /docs/api/extractAadhaar · /apis/aadhaar.

Step 6: Driver license route

Filename cannot carry country reliably (dl_usa helps). Prefer path:

/intake/unknown/USA/jane.jpg  -> country=USA

Or a sidecar country.txt. Required multipart:

file    = <binary>
country = USA | IND | VNM | GBR | THA | IDN

Map common fields plus country-specific (state, license_class for USA, etc.).

Docs: /docs/api/extractDriverLicense · /apis/driver-license.

Step 7: CRM upsert contract

Normalize before HubSpot / Salesforce / Attio:

crm_email          = from path metadata or companion form (required)
crm_doc_type       = passport | pan | aadhaar | driver_license
crm_id_number      = passport_number | pan_number | aadhaar_number | license_number
crm_full_name      = data.full_name
crm_dob            = data.date_of_birth
crm_status         = extracted_ok | review | needs_human | error
crm_source_file    = original path

Without an email/phone key in the folder metadata, write to a staging CRM object or Airtable, then human-link. Do not invent contact emails.

Step 8: Human fallback route

Router fallback:

1. Move file to /intake/_needs_human
2. Create CRM task “Classify KYC document”
3. Skip Cryvis (saves credits)

Ops can rename to include pan / passport and drop back into /unknown.

Step 9: Error handler

Any Cryvis HTTP
  success -> CRM upsert -> move /_done
  error   -> CRM status=error -> move /_needs_human
            alert with filename + status code

Field-name mismatches are the top failure mode when copying modules between routes (e.g. reusing PAN file module for passport without renaming parts).

Decision guide

Confidence and human review queue

Filename routing will misclassify. Budget for it:

1. After each successful Cryvis call, if critical IDs are null (passport_number, pan_number, aadhaar_number, license_number), move to _needs_human even if the route “matched.”
2. Weekly, sample 20 _done files: open CRM doc_type vs visual check; tighten Filters (*pan* matching company is a classic false positive — require pan as a path segment or _pan_ token).
3. Prefer explicit Typeform document_type once volume justifies a form change; keep this folder Router as a fallback for email forwards.

Credits burn from misroutes

Sending a PAN image to the passport endpoint fails (wrong multipart) but still costs engineering time. Sending a passport pair to PAN may return low-quality or null fields while consuming 1 credit per image. Strict MIME + filename Filters before HTTP are cheaper than fixing CRM junk.

CRM property pack (shared)

Create once, use on every route:

kyc_doc_type
kyc_id_number
kyc_full_name
kyc_dob
kyc_status
kyc_source_path
kyc_last_error

Document-specific extras (MRZ valid, holder_type, is_masked, license country) live as optional properties filled only on their routes.

Related reading

• Extract passport data
• Extract PAN card data
• Extract Aadhaar data
• Extract driver's license data
• /blog/make-com

CTA

Point your intake Router at Cryvis identity APIs — Passport, PAN, Aadhaar, Driver's license — using the exact multipart shapes above against https://api.cryvis.com with Bearer auth. Classify first, then extract; do not force every file through one endpoint.