Event object structure
Every webhook event follows this structure:| Field | Type | Description |
|---|---|---|
type | string | The event type that triggered the webhook (e.g. session.status.submitted) |
data | object | The session object associated with the event. This is the same transformed session object returned by the Retrieve Session API |
Event types
| Event | Trigger |
|---|---|
session.created | A new verification session has been created |
session.status.submitted | An applicant has completed and submitted their verification session |
session.status.verified | A verification session has been marked as verified (via manual review or automatic rules) |
session.status.rejected | A verification session has been marked as rejected (via manual review or automatic rules) |
session.status.failed | A verification session has hit the workflow’s configured failed-attempt limit and been auto-failed |
Headers
Every webhook request includes the following headers:| Header | Description |
|---|---|
Content-Type | application/json |
deepidv-signature | Your webhook’s signing secret for verifying the request origin |
The data object
The data field contains the full session object. This is the same structure returned by the Retrieve Session API endpoint. The key fields are outlined below.
Session fields
| Field | Type | Description |
|---|---|---|
id | string | Unique session identifier |
organization_id | string | Organization that owns this session |
user_id | string | User ID of the applicant |
sender_user_id | string | User ID of the person who created the session |
external_id | string | Your external reference ID (if provided at session creation) |
status | string | PENDING, SUBMITTED, VERIFIED, REJECTED, VOIDED, EXPIRED, or FAILED |
type | string | session, verification, credit-application, silent-screening, or deep-doc |
session_progress | string | PENDING, STARTED, or COMPLETED |
created_at | string | ISO 8601 timestamp of session creation |
updated_at | string | ISO 8601 timestamp of last update |
submitted_at | string | ISO 8601 timestamp when the applicant submitted |
workflow_id | string | Workflow ID used for this session |
workflow_steps | string[] | List of workflow step IDs |
uploads | object | Boolean flags for each uploaded document type |
meta_data | object | Applicant submission metadata (IP, device, browser, location) |
analysis_data | object | Verification analysis results |
analysis_data object
Included when the session has been processed. Contains the full verification analysis:
| Field | Type | Description |
|---|---|---|
created_at | string | When analysis was performed |
id_analysis_data | object | Primary ID document analysis (face detection, extracted text, expiry/age/state checks) |
secondary_id_analysis_data | object | Secondary ID document analysis (same structure) |
tertiary_id_analysis_data | object | Tertiary ID document analysis (same structure) |
id_matches_selfie | boolean | Whether the ID photo matches the selfie |
faceliveness_score | number | Liveness confidence score (0–100) |
compare_faces_data | object | Face comparison results with face_match_confidence score |
pep_sanctions_data | object | PEP & sanctions screening results |
adverse_media_data | object | Adverse media screening results |
document_risk_data | object | Document fraud/risk analysis |
custom_form_data | array | Custom form question/answer entries |
For a full breakdown of all nested fields within
analysis_data and meta_data, see the Retrieve Session API reference.Example payloads
session.created
Sent when a new session is created. At this stage, the session has no analysis data or uploads.
session.status.submitted
Sent when an applicant completes and submits their verification session. The analysis_data field contains the full verification results.
session.status.verified
Sent when a session is marked as verified. The payload structure is the same as session.status.submitted, with status updated to VERIFIED.
session.status.rejected
Sent when a session is marked as rejected. The payload structure is the same as session.status.submitted, with status updated to REJECTED.
session.status.failed
Sent when a session is auto-failed by the system after reaching the workflow’s configured maximum number of failed attempts. The payload structure is the same as session.status.submitted, with status set to FAILED, session_progress set to COMPLETED, and meta_data.failureData populated with the recorded attempts.
failureData for the full field reference. reason is intentionally a loose string — new values may be added over time, so consumers should default-handle unknown values.
What to do with each event
| Event | Common use cases |
|---|---|
session.created | Log session creation, update your internal records, send a confirmation to your system |
session.status.submitted | Trigger your review workflow, notify reviewers, update applicant status in your system |
session.status.verified | Grant access, activate accounts, send confirmation emails, update CRM records |
session.status.rejected | Notify applicant, flag for manual review, trigger re-verification flow |
session.status.failed | Notify applicant, surface a “contact support” path, and log meta_data.failureData.attempts for diagnostics |