> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.withverifa.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withverifa.com/_mcp/server.

# List available webhook event types

GET https://api.withverifa.com/api/v1/webhooks/endpoints/event-types

Returns all event types that can be subscribed to. Includes session
events (e.g. `session.approved`, `session.declined`,
`session.resubmission-required`), identity events
(`identity.created`, `identity.updated`, `identity.flagged`,
`identity.archived`, `identity.restored`, `identity.tag-added`,
`identity.tag-removed`), and consortium events
(`consortium.match_found`, `consortium.investigation_updated`).

The `session.resubmission-required` event fires when a session is
auto-rejected because the submitted ID photos were too blurry or
low-quality for OCR processing. The applicant must create a new
session with the same `external_ref` and resubmit clearer photos.

### `consortium.match_found` payload

Fires when the consortium executor finds a cross-org match for a
session at workflow time. Both involved organizations receive the
event. Payload fields:

```json
{
  "event": "consortium.match_found",
  "consortium_id": "cgrp_abc123",
  "matched_session_id": "ses_def456",
  "primary_session_id": "ses_abc123",
  "similarity": 0.94,
  "ghost_student_score": 78,
  "ghost_student_tier": "high",
  "is_sandbox": false
}
```

* `similarity` is a rounded float (face-embedding cosine similarity).
* `ghost_student_tier` is one of `low`, `medium`, `high`, `critical`.

### `identity.flagged` payload

Fires when an identity is flagged for review. As of Wave 4 (audit H41)
the payload **no longer includes** `flagged_by` or `flag_reason` —
those fields contained reviewer email and free-text PII. Use
`GET /identities/{identity_id}` to fetch them if your subscriber has
the right scopes. The new `has_reason` boolean lets you tell whether
a reason was recorded without exposing its contents.

```json
{
  "event": "identity.flagged",
  "identity_id": "idn_abc123",
  "session_id": "ses_def456",
  "has_reason": true,
  "is_sandbox": false
}
```

Reference: https://docs.withverifa.com/api-reference/webhooks/list-webhook-event-types

## Authentication

- `X-API-Key` header (required) — Organization API key. Keys are prefixed with `vk_live_` (production) or `vk_sandbox_` (sandbox).

## Request

### Headers

- `Verifa-Version` (date, optional) — API version date string (e.g. `2026-02-01`). If omitted, the version pinned to your API key is used.

## Response

### 200

List of event types.

- `data` (list of ApiV1WebhooksEndpointsEventTypesGetResponsesContentApplicationJsonSchemaDataItems, required)

## Errors

### 401 Unauthorized Error

Missing or invalid API key.

- `error` (string, required) — Short error code.
- `status_code` (integer, required) — HTTP status code.
- `detail` (string, optional) — Human-readable error description.

## Types

### ApiV1WebhooksEndpointsEventTypesGetResponsesContentApplicationJsonSchemaDataItems

- `event` (string, required)
- `description` (string, required)

## Examples

**Response**

```json
{
  "data": [
    {
      "event": "session.approved",
      "description": "string"
    }
  ]
}
```

**SDK Code**

```python
import requests

url = "https://api.withverifa.com/api/v1/webhooks/endpoints/event-types"

headers = {"X-API-Key": "<apiKey>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.withverifa.com/api/v1/webhooks/endpoints/event-types';
const options = {method: 'GET', headers: {'X-API-Key': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.withverifa.com/api/v1/webhooks/endpoints/event-types"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-Key", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.withverifa.com/api/v1/webhooks/endpoints/event-types")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.withverifa.com/api/v1/webhooks/endpoints/event-types")
  .header("X-API-Key", "<apiKey>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.withverifa.com/api/v1/webhooks/endpoints/event-types', [
  'headers' => [
    'X-API-Key' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.withverifa.com/api/v1/webhooks/endpoints/event-types");
var request = new RestRequest(Method.GET);
request.AddHeader("X-API-Key", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["X-API-Key": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.withverifa.com/api/v1/webhooks/endpoints/event-types")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```