Verifix

Event catalog

What we send, grouped by surface

Subscribe per event type and per environment. Sandbox events carry livemode false.

Sessions

verification.created

A session was created and is waiting on the subject.

verification.started

The subject opened the flow and began capture.

verification.processing

Capture complete, checks are running.

verification.completed

Terminal decision reached, with risk score and reason codes.

verification.referred

A signal requires human review; the case is queued.

verification.declined

A terminal check or rule declined the subject.

verification.abandoned

The subject stopped before finishing.

verification.expired

The session lifetime elapsed without completion.

verification.data_updated

Extracted fields were corrected under review.

verification.deleted

A session and its media were deleted under retention policy.

Screening and monitoring

screening.match_found

A new sanctions, PEP, or adverse-media match on a monitored subject.

screening.match_resolved

An analyst confirmed or discounted a match, with rationale attached.

monitoring.subject_enrolled

A subject entered ongoing screening.

monitoring.subject_removed

A subject left ongoing screening.

Business verification

business.verified

Registry data confirmed and the entity record created.

business.ubo_resolved

Ownership chain resolved to natural persons.

business.ubo_changed

A registry update changed the ownership structure.

business.declined

The entity failed a terminal check.

Transactions and wallets

transaction.evaluated

A transaction was scored, with the rules that fired.

transaction.alert_raised

A rule crossed threshold and created an alert.

wallet.exposure_changed

A monitored wallet's exposure profile changed.

travel_rule.message_received

A counterparty VASP sent originator or beneficiary data.

travel_rule.message_failed

Counterparty exchange could not be completed.

Cases and platform

case.assigned

A case was routed to a reviewer or queue.

case.escalated

A reviewer escalated for second-line approval.

case.closed

A case reached a final outcome with sign-off recorded.

report.ready

An evidence bundle or period report finished generating.

journey.published

A new journey version went live.

Handling

Five rules for a handler that survives production

Register a destination

Add an HTTPS endpoint per environment in the console or through the management API, and copy the signing secret.

Verify before you parse

Compute the HMAC over the raw request body, reject on mismatch or on a timestamp older than five minutes, and only then deserialize.

Acknowledge fast, work later

Return 2xx within a few seconds and hand the event to a queue. Slow handlers cause retries, not lost events.

Deduplicate by event id

At-least-once delivery means the same event id can arrive twice. Treat the id as your idempotency key.

Reconcile on read

Webhooks are a notification, not the source of truth. On receipt, read the session or case back from the API before acting.

signature verification — node

import crypto from "node:crypto";

// Reject anything you cannot verify. Compare in constant time.
export function isValidSignature(rawBody: string, header: string, secret: string) {
  const [tsPart, sigPart] = header.split(",");
  const timestamp = tsPart.replace("t=", "");
  const signature = sigPart.replace("v1=", "");

  // Reject replays older than five minutes.
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}