Webhook events

Delivery model

Webhook events notify the tenant when a review, evidence state, or partner exchange changes after the synchronous response. Return a success status only after the event has been durably stored.

The exact signature headers, retry schedule, event catalogue, and source network controls are tenant-specific during the private preview.

Example event

{
  "event_id": "evt_a81c29f4",
  "event_type": "screening.review_completed",
  "created_at": "2026-08-02T10:15:30Z",
  "data": {
    "transaction_id": "txn_8f72b1c4e5d9",
    "uway_reference": "scr_7d3a91c2",
    "status": "approved",
    "reason_codes": ["ANALYST_REVIEW_COMPLETE"]
  }
}

Receiver controls

1. Read the raw request body before JSON transformation where signature verification requires it.
2. Verify the configured signature and timestamp tolerance.
3. Reject an invalid signature without processing the event.
4. Store the event ID and payload durably.
5. Return success after storage, not after every downstream workflow completes.
6. Process the event idempotently using the event ID.

Ordering and duplicates

Do not assume events arrive once or strictly in business order. Compare event time and current object state before applying a change. Preserve duplicates for transport evidence while preventing duplicate business actions.

Failure and replay

Monitor delivery failures and provide an operational replay process. Replayed events must use the original event identity or an explicit replay reference so the receiver can distinguish transport retry from a new business state.