curl -X GET 'https://verification.didit.me/v3/webhook/' \
-H 'x-api-key: YOUR_API_KEY'import os
import requests
resp = requests.get(
'https://verification.didit.me/v3/webhook/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
timeout=10,
)
resp.raise_for_status()
config = resp.json()
for destination in config['endpoints']:
print(destination['label'], destination['url'], destination['subscribed_events'])const resp = await fetch('https://verification.didit.me/v3/webhook/', {
headers: { 'x-api-key': process.env.DIDIT_API_KEY },
});
if (!resp.ok) throw new Error(`Request failed: ${resp.status}`);
const config = await resp.json();
for (const destination of config.endpoints) {
console.log(destination.label, destination.url, destination.subscribed_events);
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/webhook/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/webhook/"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://verification.didit.me/v3/webhook/")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/webhook/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"webhook_url": "https://yourapp.com/webhooks/didit",
"webhook_version": "v3",
"secret_shared_key": "dGhpcy1pcy10aGUtYXBwLWxldmVsLXNlY3JldC0wMDA",
"capture_method": "MOBILE",
"data_retention_months": 24,
"face_retention_policy": "delete_with_session",
"face_retention_days": null,
"available_events": [
{
"value": "status.updated",
"label": "Session status updated"
},
{
"value": "data.updated",
"label": "Session data updated"
},
{
"value": "user.status.updated",
"label": "User status updated"
},
{
"value": "user.data.updated",
"label": "User data updated"
},
{
"value": "business.status.updated",
"label": "Business status updated"
},
{
"value": "business.data.updated",
"label": "Business data updated"
},
{
"value": "activity.created",
"label": "Activity created"
},
{
"value": "transaction.created",
"label": "Transaction created"
},
{
"value": "transaction.status.updated",
"label": "Transaction status updated"
},
{
"value": "travel_rule.status.updated",
"label": "Travel Rule Status Updated"
},
{
"value": "workflow.compliance_changed",
"label": "Workflow Compliance Changed"
}
],
"allowed_return_hosts": [
"shop.example.com"
],
"endpoints": [
{
"uuid": "11111111-2222-3333-4444-555555555555",
"label": "Production session webhooks",
"url": "https://yourapp.com/webhooks/didit",
"enabled": true,
"webhook_version": "v3",
"secret_shared_key": "dGhpcy1pcy1hbi1leGFtcGxlLXNlY3JldC0wMDAwMDA",
"subscribed_events": [
"status.updated",
"data.updated"
],
"created_at": "2026-01-04T08:00:00.000000Z",
"updated_at": "2026-04-22T14:09:11.523671Z"
}
]
}Get Webhook Configuration
Read your application’s webhook settings: legacy webhook URL and secret, destinations, subscribable events, retention policy and wallet return hosts.
curl -X GET 'https://verification.didit.me/v3/webhook/' \
-H 'x-api-key: YOUR_API_KEY'import os
import requests
resp = requests.get(
'https://verification.didit.me/v3/webhook/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
timeout=10,
)
resp.raise_for_status()
config = resp.json()
for destination in config['endpoints']:
print(destination['label'], destination['url'], destination['subscribed_events'])const resp = await fetch('https://verification.didit.me/v3/webhook/', {
headers: { 'x-api-key': process.env.DIDIT_API_KEY },
});
if (!resp.ok) throw new Error(`Request failed: ${resp.status}`);
const config = await resp.json();
for (const destination of config.endpoints) {
console.log(destination.label, destination.url, destination.subscribed_events);
}<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/webhook/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/webhook/"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://verification.didit.me/v3/webhook/")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/webhook/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"webhook_url": "https://yourapp.com/webhooks/didit",
"webhook_version": "v3",
"secret_shared_key": "dGhpcy1pcy10aGUtYXBwLWxldmVsLXNlY3JldC0wMDA",
"capture_method": "MOBILE",
"data_retention_months": 24,
"face_retention_policy": "delete_with_session",
"face_retention_days": null,
"available_events": [
{
"value": "status.updated",
"label": "Session status updated"
},
{
"value": "data.updated",
"label": "Session data updated"
},
{
"value": "user.status.updated",
"label": "User status updated"
},
{
"value": "user.data.updated",
"label": "User data updated"
},
{
"value": "business.status.updated",
"label": "Business status updated"
},
{
"value": "business.data.updated",
"label": "Business data updated"
},
{
"value": "activity.created",
"label": "Activity created"
},
{
"value": "transaction.created",
"label": "Transaction created"
},
{
"value": "transaction.status.updated",
"label": "Transaction status updated"
},
{
"value": "travel_rule.status.updated",
"label": "Travel Rule Status Updated"
},
{
"value": "workflow.compliance_changed",
"label": "Workflow Compliance Changed"
}
],
"allowed_return_hosts": [
"shop.example.com"
],
"endpoints": [
{
"uuid": "11111111-2222-3333-4444-555555555555",
"label": "Production session webhooks",
"url": "https://yourapp.com/webhooks/didit",
"enabled": true,
"webhook_version": "v3",
"secret_shared_key": "dGhpcy1pcy1hbi1leGFtcGxlLXNlY3JldC0wMDAwMDA",
"subscribed_events": [
"status.updated",
"data.updated"
],
"created_at": "2026-01-04T08:00:00.000000Z",
"updated_at": "2026-04-22T14:09:11.523671Z"
}
]
}secret_shared_key; the top-level webhook_url, webhook_version and secret_shared_key are used only while no destination is enabled, and then only for status.updated and data.updated.
Authorizations
Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.
Response
The webhook configuration.
Application-level webhook configuration, retention policy and Digital ID wallet return hosts, with every webhook destination.
Application-level (legacy) webhook URL. Didit sends to it only while the application has no enabled destination, and then only status.updated and data.updated. Every create, update or delete of a destination sets it to the URL of the oldest enabled destination, or null when none is enabled.
Payload version of the legacy webhook_url. Each destination has its own webhook_version.
v1, v2, v3 Application-level signing secret (43-character URL-safe token). It signs only deliveries to the legacy webhook_url; each destination signs with its own secret_shared_key. API-key callers always receive it in full; Console users without read:webhooks receive an empty string.
Legacy application setting. The verification flow does not read it: capture options are configured per workflow.
MOBILE, MOBILE_AND_DESKTOP Automatic deletion window. User verification sessions created more than this many months ago (a month counts as 30 days) are deleted automatically, and that deletion is irreversible. null means sessions are never deleted automatically. See Data retention.
1 <= x <= 120What happens to a session's face embedding when the session is deleted. delete_with_session (default) deletes it with the session. retain_until_user_deleted is the opt-in biometric template retention: an image-free biometric template linked to the User is managed separately until its retention period ends, the User is deleted, or you purge it.
delete_with_session, retain_until_user_deleted Retention period, in days, of biometric templates under retain_until_user_deleted. Required when that policy is set.
1 <= x <= 3650Every event type a destination can subscribe to, with a display label.
Show child attributes
Show child attributes
Hostnames (exact match, HTTPS only) a standalone Digital ID wallet verification may send the user back to with its return_url. Your white-label domain is always allowed as well. See Register your return destination.
20253Every webhook destination of the application, oldest first, each with its signing secret. Read only here: manage destinations with the /v3/webhook/destinations/ endpoints.
Show child attributes
Show child attributes