Webhooks

List webhook endpoints

Your endpoints. The signing secret is never returned here, only once at creation. Cursor-paginated, newest first. limit accepts 1 to 100 and defaults to 20. To walk further, set starting_after to the id of the last record on the page you just read. has_more tells you another page exists and next_cursor is the value to pass back; on the last page has_more is false and next_cursor is null. An unknown cursor is ignored and you get the first page. Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Query Parameters

limit?integer

How many records to return. 1 to 100, defaults to 20.

Range1 <= value <= 100

Default20

starting_after?string

A webhook endpoint id; returns the page after it.

Match^whe_

Response Body

`application/json`

curl -X GET "https://example.com/v1/webhooks"

{  "object": "list",  "data": [    {      "id": "string",      "object": "webhook_endpoint",      "url": "http://example.com",      "events": [        "string"      ],      "status": "active",      "api_key_ids": [        "46d53060-1858-4fe7-9116-50b66c33fdea"      ],      "description": "string",      "created_at": "2019-08-24T14:15:22Z"    }  ],  "has_more": true,  "next_cursor": "string"}

Create a webhook endpoint

Register a URL to receive events. The response carries signing_secret exactly once: store it now, because it is not recoverable afterwards and no later call will return it. Use it to verify the signature on every delivery.

By default the endpoint serves every API key on the account. Pass api_key_ids to narrow it to named keys, which is how one account routes each product to its own backend. Minting a key later never adds it to an endpoint.

Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

url*string

HTTPS target for deliveries.

Formaturi

events*array<>

Event names to subscribe to, e.g. verification.completed. Only names the platform actually emits are accepted; anything else is rejected with INVALID_EVENT rather than silently stored.

Items1 <= items

api_key_ids?array<>

The ids of the API keys whose verifications this endpoint should receive, from GET /v1/api-keys. AN EMPTY ARRAY MEANS ALL KEYS. That is the default and a permanently supported answer, not an unconfigured state. Listing keys narrows an endpoint, it never widens one. Omitting the field is identical to sending [].

Every id must be a key on your own account and in this endpoint's environment; anything else is a 400 INVALID_API_KEY naming the id, never a silent drop.

A verification created outside an API key, from the dashboard, carries no key and so reaches only endpoints with an empty api_key_ids.

Itemsitems <= 100

description?string

Your own label for this endpoint, e.g. "Main site" or "Partner integration". Worth setting once you scope endpoints by key, because two rows pointing at the same host are otherwise told apart only by comparing their key lists.

Lengthlength <= 200

Response Body

`application/json`

curl -X POST "https://example.com/v1/webhooks" \  -H "Content-Type: application/json" \  -d '{    "url": "http://example.com",    "events": [      "verification.created"    ]  }'

{  "id": "string",  "object": "webhook_endpoint",  "url": "http://example.com",  "events": [    "string"  ],  "status": "active",  "api_key_ids": [    "46d53060-1858-4fe7-9116-50b66c33fdea"  ],  "description": "string",  "created_at": "2019-08-24T14:15:22Z",  "signing_secret": "string"}

Rotate a signing secret

Issues a new signing_secret for this endpoint and returns it exactly once. The endpoint keeps its id and its delivery history.

THE CUTOVER IS IMMEDIATE and there is no overlap window: the previous secret stops signing as soon as this responds, so any delivery that arrives before you deploy the new one will fail signature verification on your side. Treat it as a coordinated change.

Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Path Parameters

id*string

Match^whe_

Response Body

`application/json`

curl -X POST "https://example.com/v1/webhooks/string/rotate_secret"

{  "id": "string",  "object": "webhook_endpoint",  "url": "http://example.com",  "events": [    "string"  ],  "status": "active",  "api_key_ids": [    "46d53060-1858-4fe7-9116-50b66c33fdea"  ],  "description": "string",  "created_at": "2019-08-24T14:15:22Z",  "signing_secret": "string"}

Send a test event

Delivers one sample event to this endpoint, through the real delivery path. It is signed with the endpoint's own secret, recorded in your delivery log, and retried on failure exactly like a real event, so a handler that accepts this is a handler that will accept production traffic.

THE EVENT DOES NOT HAVE TO BE ONE THE ENDPOINT SUBSCRIBES TO. Testing a handler before subscribing to the event is the point: you should not have to put production on verification.rejected to find out whether your branch for it works. The endpoint does have to be active.

The payload is easy to tell apart from a real one. The envelope carries test: true, which real events never do, and every resource id inside data is a clearly fake placeholder such as vs_test000000000000000000, so nothing in it resolves to a real person and a test can never be mistaken for a decision about one.

Responds 202 as soon as the delivery is queued. Whether your server accepted it is answered by the delivery log, not by this response.

Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Path Parameters

id*string

Match^whe_

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

event?string

Which sample to send. Defaults to verification.completed, the event every integration ends up handling. It does not have to be an event this endpoint subscribes to.

Default"verification.completed"

Value in

"verification.created"
"verification.pending"
"verification.awaiting_service"
"verification.completed"
"verification.approved"
"verification.rejected"
"verification.review"
"verification.expired"
"verification.corrected"
"verification.data_updated"
"verification.already_verified"
"check.completed"
"fraud_network.created"
"fraud_network.modified"
"action.reviewed"
"action.on_hold"
"action.pending"
"verification.tag_added"
"verification.tag_removed"

Response Body

`application/json`

curl -X POST "https://example.com/v1/webhooks/string/test" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "string",  "object": "webhook_delivery",  "endpoint_id": "string",  "event": "string",  "test": true,  "status": "pending",  "created_at": "2019-08-24T14:15:22Z"}

Update a webhook endpoint

Change where deliveries go, which events they carry, which keys they cover, or whether the endpoint is active. Send only the fields you are changing.

The endpoint keeps its id and its delivery history, which is the reason to prefer this over delete-and-recreate. The environment cannot be changed, because every delivery already recorded is labelled with it.

Watch api_key_ids in particular: omitting it leaves the routing untouched, while sending [] clears the filter and puts the endpoint back on every key.

Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Path Parameters

id*string

Match^whe_

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Every field is optional; send only what changes. At least one is required. The environment is fixed when an endpoint is registered and cannot be changed, because every delivery already recorded carries it.

OMITTING A FIELD IS NOT THE SAME AS SENDING AN EMPTY VALUE FOR IT. Omitting api_key_ids leaves this endpoint's routing exactly as it is; sending [] CLEARS the filter and returns the endpoint to receiving every key's traffic. Build the body from the fields you are actually changing rather than spreading a partial object with ?? [] defaults, or you will unfilter an endpoint you only meant to rename.

Properties1 <= properties

url?string

Formaturi

events?array<>

Event names to subscribe to, e.g. verification.completed. Only names the platform actually emits are accepted; anything else is rejected with INVALID_EVENT rather than silently stored.

Items1 <= items

status?string

Value in

"active"
"disabled"

api_key_ids?array<>

Replaces the endpoint's key list outright. AN EMPTY ARRAY MEANS ALL KEYS. That is the default and a permanently supported answer, not an unconfigured state. Listing keys narrows an endpoint, it never widens one.

OMITTING THIS FIELD IS NOT THE SAME AS SENDING []. Omit it and the routing is left alone; send [] and the filter is cleared, so the endpoint starts receiving every key again.

Itemsitems <= 100

description?|

Your own label for this endpoint. Send null to clear it; omit it to leave it unchanged.

Lengthlength <= 200

Response Body

`application/json`

curl -X PATCH "https://example.com/v1/webhooks/string" \  -H "Content-Type: application/json" \  -d '{}'

{  "id": "string",  "object": "webhook_endpoint",  "url": "http://example.com",  "events": [    "string"  ],  "status": "active",  "api_key_ids": [    "46d53060-1858-4fe7-9116-50b66c33fdea"  ],  "description": "string",  "created_at": "2019-08-24T14:15:22Z"}

Delete a webhook endpoint

Permanently removes the endpoint and stops future deliveries to it. Requires the webhook:manage permission on the calling key.

Authorization

secretKey

AuthorizationBearer <token>

Secret API key, server-side only. Example: Bearer TWK_...

In: header

Path Parameters

id*string

Match^whe_

Response Body

`application/json`

curl -X DELETE "https://example.com/v1/webhooks/string"

{  "id": "string",  "object": "webhook_endpoint",  "deleted": true}

A verification session was created

verification.created. A verification session was created.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Two answers mean "not now" rather than "this failed". Reply 429 or 503 and the delivery is deferred WITHOUT consuming an attempt, honoring Retry-After up to 6 hours per deferral and 24 hours overall, after which it fails on the normal ladder. Use them when you are throttling or briefly down, and keep your retry budget for real failures.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.created

The session is waiting on the applicant

verification.pending. The session is waiting on the applicant.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.pending

Submissions are in and the checks are queued

verification.awaiting_service. Submissions are in and the checks are queued.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.awaiting_service

The session reached a terminal state. Fires for every outcome

verification.completed. The session reached a terminal state. Fires for every outcome.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.completed

The verdict is approve

verification.approved. The verdict is approve.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.approved

The verdict is reject

verification.rejected. The verdict is reject.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.rejected

The verdict is review and a human needs to look at it

verification.review. The verdict is review and a human needs to look at it.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.review

The applicant never completed the session in time

verification.expired. The applicant never completed the session in time.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.expired

An outcome we already sent for this session was wrong, and has been corrected

verification.corrected. An outcome we already sent for this session was wrong, and has been corrected.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.corrected

Someone on your team edited this verification's applicant data. Fetch it again for the new values

verification.data_updated. Someone on your team edited this verification's applicant data. Fetch it again for the new values.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.data_updated

A new verification was attempted for someone this merchant has already approved, and was refused

verification.already_verified. A new verification was attempted for someone this merchant has already approved, and was refused.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.already_verified

An individual check inside a verification finished

check.completed. An individual check inside a verification finished.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/check.completed

A cross-merchant fraud signal was raised

fraud_network.created. A cross-merchant fraud signal was raised.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/fraud_network.created

An existing fraud signal changed

fraud_network.modified. An existing fraud signal changed.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/fraud_network.modified

A reviewer reached a decision

action.reviewed. A reviewer reached a decision.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/action.reviewed

A case was put on hold

action.on_hold. A case was put on hold.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/action.on_hold

A case is waiting on a reviewer

action.pending. A case is waiting on a reviewer.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/action.pending

One of your own labels was put on a verification

verification.tag_added. One of your own labels was put on a verification.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.tag_added

One of your own labels was taken off a verification

verification.tag_removed. One of your own labels was taken off a verification.

Return any 2xx promptly. Anything else, including a timeout, is a failed delivery and is retried with exponential backoff.

Verify the signature on every request before acting on it, and treat the event id as an idempotency key: a delivery you have already processed can arrive again.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

id*string

Unique per event. Sent as the Idempotency-Key header too, so use it to discard a delivery you have already processed.

Match^evt_

event*string

The wire name, e.g. verification.approved.

createdAt*string

When the event happened, not when this attempt was made.

Formatdate-time

test?true

Present ONLY on test deliveries, so real events simply lack the field. Every resource id inside data is a fake placeholder when it is set.

Value in

true

data*

The event body. See each event for its shape.

Response Body

Example Requests

POST/verification.tag_removed

Webhooks

200application/json

400application/json

401application/json

403application/json

429application/json

503application/json

201application/json

400application/json

401application/json

403application/json

429application/json

503application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

503application/json

202application/json

400application/json

401application/json

403application/json

404application/json

429application/json

503application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

503application/json

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

503application/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

200

Request Bodyapplication/json

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`