Skip to main content
POST
curl
Webhook destinations let you send different Didit events to different URLs. Each destination has its own secret_shared_key, webhook_version, and subscribed_events list.

How subscribed_events works

subscribed_events is a required array of exact event names. Didit delivers a webhook to this destination only when the payload’s webhook_type matches one of the values in the array.
  • Include at least one event.
  • Use only the supported event names below.
  • Add every event you want delivered; there is no wildcard value like * or all.
  • To route different product areas to different systems, create multiple destinations with different subscribed_events lists.

Event catalog

The Investigator (investigator.*) and Authentication (auth.*) event families are also accepted. Every event and its payload is listed in Webhooks. Common subscription sets:
For payload examples and signing code, see the webhooks guide.

Authorizations

x-api-key
string
header
required

Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is wrong, revoked or expired; 403 means no key was sent, the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.

Headers

Idempotency-Key
string

Optional retry-safety key you choose for one operation, up to 255 characters (a UUID works). A request repeated with the same key, endpoint, query and body is answered with the first response, same status and same body, and runs and bills nothing a second time. The same key with another endpoint, query or body returns 409 idempotency_key_reused, and while the first request is still running, 409 idempotency_key_in_progress with Retry-After. A failed request (any 4xx or 5xx) is not stored, so you can send it again with the same key. Keys belong to your application, whether you call with an API key or an access token. See Retries and idempotency.

Required string length: 1 - 255

Body

application/json
label
string
required

Human-readable name displayed in Console → Webhooks. Helps distinguish destinations when you have several (e.g. "Prod", "Staging mirror").

Maximum string length: 255
url
string<uri>
required

HTTPS URL that will receive POST requests. Must be unique among the application's destinations. Use a stable, hardened endpoint: Didit retries failed deliveries on a backoff schedule.

Maximum string length: 2000
enabled
boolean
default:true

When false, the destination is saved but Didit will not push any webhooks to it. Useful for staging configs you want to keep parked.

webhook_version
enum<string>

Payload schema version Didit will send. v3 is the current/recommended format; older versions are kept for backward compatibility with legacy integrations.

Available options:
v1,
v2,
v3
subscribed_events
enum<string>[]

Events to deliver. Effectively required: an explicit [] is rejected with 400, and omitting the field creates a destination with no subscriptions that receives nothing.

Minimum array length: 1

Supported webhook event name. Use these exact strings in subscribed_events; unsupported values are rejected.

Available options:
status.updated,
data.updated,
user.status.updated,
user.data.updated,
business.status.updated,
business.data.updated,
activity.created,
transaction.created,
transaction.status.updated,
travel_rule.status.updated,
workflow.compliance_changed,
transaction_rule_suggestions.created,
auth.signup,
auth.login,
auth.login_failed,
auth.password_reset_requested,
auth.password_reset_completed,
auth.mfa_changed,
auth.new_device,
auth.account_locked,
investigator.report.ready,
investigator.decision.automated,
investigator.decision.overridden,
investigator.decision.contested,
investigator.question.raised,
investigator.automation.paused,
investigator.rfi.answered,
investigator.rfi.overdue,
investigator.drift.detected,
investigator.sla.breached,
investigator.qa.failed,
investigator.external.report.ready
Example:

Response

Destination created. secret_shared_key is the HMAC signing secret — store it now.

uuid
string<uuid>

Stable destination identifier. Use as {destination_uuid} in subsequent calls.

label
string
url
string<uri>
enabled
boolean
webhook_version
enum<string>
Available options:
v1,
v2,
v3
secret_shared_key
string

Auto-generated HMAC signing secret bound to this destination (43-character URL-safe token). Use it to verify the signature headers on incoming webhooks. Always returned in full to API-key callers; Console users need the read:webhooks permission, otherwise they see an empty string.

secret_last4
string

Last four characters of the destination's current signing secret, so you can tell secrets apart. Not enough to verify a signature.

previous_secret_expires_at
string<date-time> | null

Set for 24 hours after the destination's signing secret is rotated in the Business Console. Until this time, every delivery to the destination also carries X-Signature-Previous, X-Signature-V2-Previous and X-Signature-Simple-Previous, made with the replaced secret (see Signature verification). null when no rotation happened in the last 24 hours.

subscribed_events
enum<string>[]

Event filter for this webhook destination. Didit delivers only webhooks whose event type exactly matches one of these values — there is no wildcard subscription. When sent, the list must contain at least one valid event (an explicit [] is rejected with 400); a destination whose list is empty (field omitted at create) receives nothing. On update the list is replaced wholesale, never merged.

Minimum array length: 1

Supported webhook event name. Use these exact strings in subscribed_events; unsupported values are rejected.

Available options:
status.updated,
data.updated,
user.status.updated,
user.data.updated,
business.status.updated,
business.data.updated,
activity.created,
transaction.created,
transaction.status.updated,
travel_rule.status.updated,
workflow.compliance_changed,
transaction_rule_suggestions.created,
auth.signup,
auth.login,
auth.login_failed,
auth.password_reset_requested,
auth.password_reset_completed,
auth.mfa_changed,
auth.new_device,
auth.account_locked,
investigator.report.ready,
investigator.decision.automated,
investigator.decision.overridden,
investigator.decision.contested,
investigator.question.raised,
investigator.automation.paused,
investigator.rfi.answered,
investigator.rfi.overdue,
investigator.drift.detected,
investigator.sla.breached,
investigator.qa.failed,
investigator.external.report.ready
Example:
created_by_email
string | null

Email of the Business Console member who created the destination. null for a destination created with an API key.

created_by_name
string | null

Name of the Business Console member who created the destination. null for a destination created with an API key.

created_at
string<date-time>
updated_at
string<date-time>
health_status
enum<string>

Delivery health. failing: 3 or more consecutive events failed their first delivery attempt since the destination last answered successfully (see failing_streak). degraded: not failing, but a delivery attempt failed in the last 24 hours and no later attempt has delivered that event; a retry or resend that delivers it clears this. healthy: neither. Independent of enabled. A failed attempt is one answered with HTTP 400 or above, or not answered at all.

Available options:
healthy,
degraded,
failing
failing_streak
integer

How many consecutive events failed their first delivery attempt since the destination last answered successfully, within the last 30 days. Retries are not counted, and any successful attempt, including a retry or a resend, ends the streak. 0 when no event has failed since the last success.

failing_since
string<date-time> | null

When the first failed attempt of the current failing_streak was made. null when failing_streak is 0.

last_success_at
string<date-time> | null

When the destination last answered a delivery with an HTTP status under 400, within the last 30 days. null if it has not in that window.

environment
enum<string>

Environment of the application that owns the destination.

Available options:
live,
sandbox
summary
object

Delivery metrics for the last metrics_window_days (30) days. last_delivery_at is the most recent attempt, whenever it was made.

Last modified on November 1, 2026