How to automate right to work checks

What you can automate

Which check applies depends on how the worker proves their right to work, and not every route can be automated.

• Most people who are not British or Irish, including eVisa and EU Settlement Scheme holders

  What they give you

  A share code from gov.uk/prove-right-to-work

  How to automate it

  The Home Office online check, run through an API such as Check Share Code

• British and Irish citizens with a valid passport or Irish passport card

  What they give you

  Their passport or passport card

  How to automate it

  Identity verification from a certified identity service provider

• Anyone who can only show original documents

  What they give you

  Documents from the Home Office lists

  How to automate it

  It can’t be: someone checks the originals by hand

• People waiting on a Home Office application or appeal

  What they give you

  Their application or appeal reference

  How to automate it

  It can’t be: you ask the Home Office Employer Checking Service

An automated check, step by step

1. 1

   Ask for the share code in your onboarding form

   Collect the share code and date of birth where you already collect the worker’s details. A share code is 9 characters and lasts 90 days.

2. 2

   Send it to the API

   POST the share code, date of birth and your company name to /api/check. The check runs on gov.uk and answers in under 15 seconds.

3. 3

   Act on the result

   ACCEPTED or REJECTED comes back with the conditions and any restrictions. A code gov.uk can’t find, or a date of birth that doesn’t match it, comes back as NOT_FOUND or DOB_MISMATCH, so you can ask the worker to check their details.

4. 4

   Confirm the photo is the person

   The response includes the photo gov.uk holds. Compare it with the worker, in person or on a video call, as the Home Office guidance asks.

5. 5

   Store the evidence

   Save the gov.uk PDF and the date of the check against the worker. Keep them while they work for you and for two years after they leave.

6. 6

   Schedule the follow up check

   If their permission to work ends, recheck_date says when to check again. Put it in your scheduler. When it is null, no follow up check is needed.

The API call

One request per worker. With a sandbox key it answers instantly and never touches gov.uk, so you can build every branch before going live. Every field is in the API reference.

const res = await fetch('https://checksharecode.co.uk/api/check', {
  method: 'POST',
  headers: {
    authorization: `Bearer ${process.env.CHECKSHARECODE_API_KEY}`,
    'content-type': 'application/json',
  },
  body: JSON.stringify({
    share_code: 'AB1CD2EF3',
    date_of_birth: '1990-01-01', // YYYY-MM-DD
    company_name: 'Acme Ltd',
  }),
});

const result = await res.json();
if (!res.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result.outcome); // "ACCEPTED" or "REJECTED"

Checking a lot of people

For a backlog, a batch of follow up checks or onboarding at volume, use asynchronous checks. The request answers at once with an id. We run the check, retry it if gov.uk fails, and post the signed result to your webhook when it is done.

Where teams build it in

What stays with you

Automation doesn’t move the legal duty. You are still responsible for checking the right person before they start work and for keeping the evidence. The Home Office guidance is the authority on what counts as a valid check: Employer’s guide to right to work checks. This guide is not legal advice.

Questions