Skip to main content
GET
curl
The payload inside request_body is the one described in Webhooks, and the headers are the ones covered in signature verification. To send the delivery again, use Resend session webhook delivery.

Authorizations

x-api-key
string
header
required

Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.

Path Parameters

sessionId
string<uuid>
required

UUID of the verification session, user (KYC) or business (KYB): the session_id returned by POST /v3/session/. The server resolves it against both session types.

Must be a valid UUID. The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router before any application code runs and the response is a 404 HTML page rather than the JSON {"detail": ...} envelope shown below.

webhook_uuid
string<uuid>
required

UUID of the delivery: the uuid of an entry returned by GET /v3/session/{sessionId}/webhooks/. It must belong to the session in the path.

Response

The delivery, with its request headers and body.

One webhook delivery attempt recorded for a verification session, with the exact request headers and body Didit sent.

uuid
string<uuid>
required

Delivery ID. Use it as {webhook_uuid} to get or resend this delivery.

session_id
string<uuid>
required

The session the delivery belongs to (the session in the path).

request_url
string<uri> | null
required

URL the delivery was sent to.

response_status
integer | null
required

HTTP status your endpoint returned. null while the delivery is queued and not yet attempted. When no HTTP answer was received Didit records a status of its own: 504 when your endpoint did not answer within 5 seconds, 503 for a connection failure, 400 when the URL was refused as unsafe (for example a private or internal address), and 404 for any other request error. 400 or above counts as a failed delivery.

status
string | null
required

Session status when the event was generated, for example In Progress, Approved or Declined.

webhook_type
enum<string>
required

Supported webhook event name. Use these exact strings in subscribed_events; unsupported values are rejected.

Available options:
status.updated,
data.updated,
user.status.updated,
user.data.updated,
business.status.updated,
business.data.updated,
activity.created,
transaction.created,
transaction.status.updated,
travel_rule.status.updated,
workflow.compliance_changed,
auth.signup,
auth.login,
auth.login_failed,
auth.password_reset_requested,
auth.password_reset_completed,
auth.mfa_changed,
auth.new_device,
auth.account_locked,
investigator.report.ready,
investigator.decision.automated,
investigator.decision.overridden,
investigator.decision.contested,
investigator.question.raised,
investigator.automation.paused,
investigator.rfi.answered,
investigator.rfi.overdue,
investigator.drift.detected,
investigator.sla.breached,
investigator.qa.failed,
investigator.external.report.ready
request_header
string
required

JSON text (a string) of the request headers Didit sent: Content-Type, X-Signature, X-Signature-V2, X-Signature-Simple, X-Timestamp and User-Agent. Parse it with a JSON parser. It holds signatures, never the signing secret.

request_body
string
required

JSON text (a string) of the exact payload Didit sent, keys sorted, including event_id and timestamp. Parse it with a JSON parser; see Payload shape. For a scoped key without media: read, media URLs inside it are null; without sessions: write, session tokens and hosted verification links are null. A body changed that way no longer matches its signatures. Didit does not record the response body your endpoint returned.

created_at
string<date-time>
required

When the delivery was created.