Can I encrypt the callback body?

Yes. Switch on the option to encrypt the body of the callback request with the secret key of the scenario.

Webhooks

Q: Can I receive callbacks without identity fields?

Yes. Switch on the option that omits identity fields. The callback then omits names, document data and images, and keeps the session identifier, which links to the session. Your system fetches the result by that identifier after the event arrives.

Events

Event	Sent when
`SESSION_COMPLETE`	A verification session completes.
`QUESTIONNAIRE_COMPLETE`	A questionnaire step is filled in and committed.
`DATABASE_CHECKS_COMPLETE`	The database checks of a session, such as AML screening, complete.
`PD_ERASURE_COMPLETE`	The destruction of personal data requested through the erase call finishes.

Set up the callback

In the scenario callback settings, enter the callback URL of your backend. Options:

Encrypt the body of the callback request with the secret key of the scenario.
Omit identity fields: names, document data and images stay out of the callback, and the session identifier stays in.
Notify only when the session is finalized.
Send database checks as they become ready.

Receive and verify

Your endpoint receives a POST request with the event. If you chose encryption, decrypt the body with the secret key of the scenario. If you chose to omit identity fields, the callback omits names, document data and images, and keeps the session identifier, which links to the session. Treat the event as a signal and fetch the result by that identifier through the REST API.

After an event

Read the session with /kyc/session/status. For database checks, wait for the DATABASE_CHECKS_COMPLETE event. See session statuses for the values you can expect.

Erasure

When you request erasure through /kyc/session/erase, a call that finishes the destruction immediately answers in the same response. If part of it cannot be confirmed in time, the system finishes the work itself and sends PD_ERASURE_COMPLETE. See the data protection overview.