For AI agents: a documentation index is available at the root level at /llms.txt and /llms-full.txt. Append /llms.txt to any URL for a page-level index, or .md for the markdown version of any page.
  • Getting Started
    • Introduction
    • How Verifa Works
    • Quickstart
    • Choosing an Integration Method
  • Use Cases
    • KYC Onboarding
    • Age Verification
    • AML Compliance
    • Fraud Prevention
    • Marketplace Trust & Safety
  • Core Concepts
    • Overview
    • Sessions
    • Verifications & Checks
    • Workflows
    • Identities
    • Cases
    • Screening & Reports
    • Lists
  • Integration Guides
    • Overview
    • JavaScript SDK
    • Web Capture Flow
    • API-Only Integration
    • Mobile SDK
    • Webhooks Guide
    • MCP Server
    • Migrating from Persona
  • API Details
    • Overview
    • Authentication
    • Pagination
    • Rate Limiting
    • Versioning
    • Errors
    • Webhooks
    • Idempotency
    • Key Inflection
    • Data Access
    • Data Retention
  • Tutorials
    • Creating Your First Verification Session
    • Creating a Workflow
    • Receiving Webhooks & Validating Signatures
    • Handling Webhook Events
    • Custom Document Types & AI Extraction
  • Best Practices
    • Testing
    • Preventing Duplicates
    • Fraud Signals
    • Changelog
  • API Reference
      • POSTTest webhook delivery
      • GETList webhook endpoints
      • POSTCreate webhook endpoint
      • GETList available webhook event types
      • GETRetrieve webhook endpoint
      • DELDelete webhook endpoint
      • PATCHUpdate webhook endpoint
      • POSTRotate webhook signing secret
      • POSTClone webhook endpoint
      • GETList webhook deliveries
      • POSTRetry a failed webhook delivery
API ReferenceWebhooks

Create webhook endpoint

POST
https://devapi.withverifa.com/api/v1/webhooks/endpoints
POST
/api/v1/webhooks/endpoints
$curl -X POST https://devapi.withverifa.com/api/v1/webhooks/endpoints \
>     -H "X-API-Key: <apiKey>" \
>     -H "Content-Type: application/json" \
>     -d '{
>  "url": "string"
>}'
1{
2  "created_at": "2024-01-15T09:30:00Z",
3  "enabled": true,
4  "enabled_events": [
5    "string"
6  ],
7  "environment": "live",
8  "id": "wh_abc123",
9  "secret": "whsec_d6f8b0c4a9e7c2f1b3a8d4e6f0c2b8a4d6e8f0c2b4a6d8e0f2c4b6a8d0e2f4c6",
10  "updated_at": "2024-01-15T09:30:00Z",
11  "url": "string",
12  "api_version": "string",
13  "attribute_blocklist": [
14    "string"
15  ],
16  "description": "string",
17  "event_filter_conditions": {},
18  "key_inflection": "camel",
19  "label": "string"
20}
Creates a new webhook endpoint for the authenticated organization. The `secret` field in the response is the **per-endpoint** signing secret (`whsec_*`) used to verify `X-Verifa-Signature` HMAC headers on deliveries to this URL. Each endpoint has its own independent secret — this is **not** the legacy organization-level webhook secret. It is returned only in this response (and on `POST /webhooks/endpoints/{endpoint_id}/rotate-secret`); Verifa does not store the plaintext, so capture and store it securely.
Was this page helpful?
Previous

List available webhook event types

Next
Built with

Creates a new webhook endpoint for the authenticated organization.

The secret field in the response is the per-endpoint signing secret (whsec_*) used to verify X-Verifa-Signature HMAC headers on deliveries to this URL. Each endpoint has its own independent secret — this is not the legacy organization-level webhook secret. It is returned only in this response (and on POST /webhooks/endpoints/{endpoint_id}/rotate-secret); Verifa does not store the plaintext, so capture and store it securely.

Authentication

X-API-Keystring

Organization API key. Keys are prefixed with vk_live_ (production) or vk_sandbox_ (sandbox).

Headers

Verifa-VersiondateOptional

API version date string (e.g. 2026-02-01). If omitted, the version pinned to your API key is used.

Request

This endpoint expects an object.
urlstringRequiredformat: "uri"
The HTTPS URL to receive webhook events.
labelstringOptional

Human-readable label for this endpoint.

descriptionstringOptional
enabled_eventslist of stringsOptional
Event types to subscribe to. Omit or pass `["*"]` to receive all events. Available types include `session.approved`, `session.declined`, `session.resubmission-required`, `identity.created`, `identity.updated`, `identity.archived`, `identity.restored`, `identity.tag-added`, `identity.tag-removed`.
attribute_blocklistlist of stringsOptional
Attribute paths to exclude from webhook payloads.
event_filter_conditionsmap from strings to anyOptional
Conditional filters applied before dispatching events to this endpoint.
api_versionstring or nullOptional
key_inflectionenumOptional
Allowed values:

Response

Webhook endpoint created. The secret field is only returned here.

created_atdatetime
enabledboolean
enabled_eventslist of strings
Event types this endpoint is subscribed to. Empty means all events.
environmentenum
Allowed values:
idstring
secretstring

Per-endpoint HMAC-SHA256 signing secret. Used to verify the X-Verifa-Signature header on outbound webhook deliveries (HMAC over f"{t}.{raw_body}"). Always begins with whsec_. Only returned at endpoint creation and secret rotation — Verifa does not store the plaintext secret after this response, so capture and store it securely.

updated_atdatetime
urlstringformat: "uri"
api_versionstring or null
attribute_blocklistlist of strings
Attribute paths to exclude from webhook payloads.
descriptionstring or null
event_filter_conditionsmap from strings to any
Conditional filters applied before dispatching events to this endpoint.
key_inflectionenum
Allowed values:
labelstring or null

Errors

401
Unauthorized Error
422
Unprocessable Entity Error

Event types to subscribe to. Omit or pass ["*"] to receive all events. Available types include session.approved, session.declined, session.resubmission-required, identity.created, identity.updated, identity.archived, identity.restored, identity.tag-added, identity.tag-removed.