Webhooks will be sent out during the webhook creation on specified widget user KYC status events. This way you can have different webhook URLs to handle each event or one URL for all events.

A signature is sent in a X-YC-Signature header for verification of the webhook request data.

The signature is a base64 encoded sha256 hash of the request body using the secretkey of the apiKey the initial request was made with. The apiKey is also available in the request payload.

📘

Static IP

Webhooks are sent from a static IP on production which we will provide. We recommend whitelisting and only accepting webhook data from this IP, to prevent any security risks.

EVENTS

See list of all events and descriptions here

📘

Note that when creating webhooks, you will need to prepend WIDGET_USER.to the event state to receive widget user KYC events.

For example, to create a webhook for KYC events in the APPROVED state, the correct state is WIDGET_USER.APPROVED.

Creating Webhooks

You can use the API to create webhooks for specific events. When creating the webhook, if you omit the state field, it will execute for all events.

If you omit the active field, it will default to true.

Webhook Data

The events will POST data to the webhooks in the following format

{
  "id": "00e97bc4-1429-4ce7-acb5-841f9d9ed059",//widget user id
  "kycStatus": "Approved",
  "apiKey": "513fc4c3aaeb2a8f292a740ea178d830",
  "event": "WIDGET_USER.APPROVED",
  "executedAt": "2023-02-20T14:25:30.459Z",
}

The event data contains the widget user KYC information, as well as the current event being fired, and the time at which it was executed.