Webhooks

Webhooks let you connect Vouchsafe to other tools by sending a message when something changes, like when someone completes a verification.

For example, you can send a webhook to your CRM when a verification succeeds, so you can update the customer’s record or give them access to your service.

Setting up a webhook

You don’t need to write code to use webhooks. Just:

1. Get a webhook URL from the tool you want to send messages to. Most no-code tools like Zapier can create these URLs.
2. Paste the URL into your verification flow settings in Vouchsafe.

To get alerts by webhook, paste the URL into your alerts settings instead.

Events that trigger a webhook

You’ll get a message when a verification:

• is created – the user has started the process
• is completed – the user has finished, but results are not ready yet
• succeeds – all checks passed
• fails – the check was abandoned or flagged as likely fraud
• is manually reviewed – a member of your team has approved a case sent for manual review
• is expired – the user has not completed their steps by the time the expiry date was set for the verification

The full list of supported events is:

Event	Meaning
Created	verification has been requested, either in the dashboard or via an integration
UserCompleted	the user has completed their steps but extra action is still needed (eg. from a referee)
Verified	the user has been automatically verified
Refused	the user couldn’t be verified due to one or more fraud signals, and you need to review them
Alert	for time-sensitive due diligence notifications e.g. a user appearing in a sanctions list
ManuallyReviewed	a member of your team has approved a case sent for manual review
Expired	the user has not completed their steps by the time the expiry date was set for the verification

Each message includes different information depending on the event.

Make sure a webhook has come from Vouchsafe

There are two ways to ensure a webhook event is genuine:

• add a long, unguessable token to your webhook URL and verify it in your handling logic
• upon receiving a webhook, verify the contained data with a call to the get verification endpoint

Example webhook body

{
  "event": "Verified",
  "id": "333",
  "email": "dwebb@email.com",
  "redirect_url": "https://example.com/welcome",
  "status": "Verified",
  "created_at": "2026-08-19T09:01:00.000Z",
  "expires_at": "2026-08-26T09:01:00.000Z",
  "flow_id": "string",
  "workflow_id": "string",
  "external_id": "string"
}

event is the reason for the notification: Created, UserCompleted, Verified, Refused, ManuallyReviewed or Expired.

Alert webhooks

Alerts send an Alert message to the webhook URL in your alerts settings.

There are two kinds of alert, and both send the same event.

Fraud alerts

You’ll get a fraud alert when one of your accounts shares an email or face with someone blocked across the Vouchsafe network.

{
  "event": "Alert",
  "alertId": "string",
  "caseId": "string"
}

The alert carries a caseId when it was raised on a verification, or a smartLookupId when it was raised on a risk check.

Open the alert in your dashboard to see what matched.

AML alerts

You’ll get an AML alert when ongoing monitoring finds a new sanctions or PEP hit on one of your accounts.

{
  "event": "Alert",
  "alertId": "alert_sandbox_1",
  "smartLookupId": "sl_sandbox_001"
}

Pass the smartLookupId to GetAccountDetail to see the alert. Its source is AML, and matches lists who the account matched.

Test your webhooks

In sandbox mode you can send any webhook to your endpoint on demand.