Webhooks
The /webhooks page is admin-only. It registers HTTPS endpoints that
the platform calls when checks complete, so your backend can react without
polling. The delivery protocol, signature verification and retry schedule
are on the Webhooks page; this page is the operator
side.
Events
| Event type | Fired when |
|---|---|
ocr.completed | A POST /v1/ocr request returns successfully. |
face.verify.completed | A POST /v1/face/verify request returns successfully. |
liveness.check.completed | A POST /v1/liveness/check request returns successfully, live or not. |
One event per successful API call; 4xx and 5xx responses do not fire
webhooks. Fraud checks and verification decisions cannot be subscribed to
yet; poll GET /v1/fraud/checks/{id} and GET /v1/verifications/{id}.
Registering an endpoint
Click New endpoint and fill in:
- URL — HTTPS only;
http://is rejected at registration. - Mode —
liveortest. An endpoint receives one mode's events; to receive both, register the URL twice. - Events — one or more of the three types. Empty is invalid.
On submit the dashboard shows the endpoint's signing secret exactly once. Copy it into your secrets manager before dismissing. If you lose it, Rotate secret mints a fresh one; deliveries carry signatures for both the new and the previous secret for 48 hours, then the previous one stops working.
Test fire sends a signed sample event of the type you choose to the endpoint and shows the response it returned, so you can check your handler before real traffic arrives.
Delivery, retries and failures
Deliveries are signed and retried on a fixed schedule (1 second, 1 minute, 1 hour, 24 hours; then marked dead), with a 30-second timeout per attempt. Endpoints are not disabled automatically. The endpoint's page lists every delivery attempt with its response status and the first part of the response body, which is where to look when your handler misbehaves.
Disabling an endpoint
Toggle Enabled off. New events are no longer queued for it, and any retry that comes due while it is disabled is marked failed with the reason "endpoint disabled". Re-enabling resumes future events, not the dropped ones.