{
"data": {
"object": "event",
"id": "0193b2f6-5e4d-7c3b-8a29-1f0e9d8c7b6a",
"type": "webhook.ping",
"apiVersion": "2026-11-01",
"occurredAt": "2026-10-30T11:00:00.000Z",
"propertyId": "4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b",
"resource": {
"object": "webhook.ping",
"id": null
}
},
"meta": {
"deliveryId": "0193b2f6-5e4f-7a1b-9c2d-3e4f5a6b7c8d",
"attempt": 1,
"timestamp": "2026-10-30T11:00:00.214Z"
}
}Ping
A test event, sent only when you or KYC ask for one, to check that your endpoint receives and verifies webhooks. It is never sent on its own. It has no resource: resource.id is null.
{
"data": {
"object": "event",
"id": "0193b2f6-5e4d-7c3b-8a29-1f0e9d8c7b6a",
"type": "webhook.ping",
"apiVersion": "2026-11-01",
"occurredAt": "2026-10-30T11:00:00.000Z",
"propertyId": "4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b",
"resource": {
"object": "webhook.ping",
"id": null
}
},
"meta": {
"deliveryId": "0193b2f6-5e4f-7a1b-9c2d-3e4f5a6b7c8d",
"attempt": 1,
"timestamp": "2026-10-30T11:00:00.214Z"
}
}Authorizations
API key sent as a bearer token: Authorization: Bearer kyc_live_.... Keys are prefixed kyc_live_ (production) or kyc_test_ (test mode). OAuth2 access tokens (also Bearer) may be supported later — the header never changes.
Headers
The event ID, the same as data.id. Stable across retries: use it to deduplicate. Part of the signed content.
Unix time in seconds when this attempt was sent. New on every attempt. Part of the signed content. Reject a request whose timestamp is more than 5 minutes from your clock.
^[0-9]{1,12}$One or more space-separated signatures, each v1, followed by the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with your signing secret (the bytes after decoding the base64 part of whsec_…). Two are sent while a rotated-out secret is in its 24-hour grace period. Accept the request if any one matches.
^v1,[A-Za-z0-9+/]+={0,2}( v1,[A-Za-z0-9+/]+={0,2})*$This delivery of the event to your endpoint, the same as meta.deliveryId. Quote it to KYC support when asking about a delivery. Not part of the signed content.
Identifies KYC webhook requests.
"KYCH-Webhooks/1.0"Body
The body of every webhook request: the event in data, this delivery attempt in meta. Mirrors the API's { data, meta } success envelope. Ignore fields you don't recognise.
What happened. Identical, byte for byte, on every retry of the event.
Hide child attributes
Hide child attributes
Resource type discriminator.
"event"Event ID, also sent as the webhook-id header. Your deduplication key.
"0193b2f0-7c1e-7a4b-9f3d-2e6c8a1b5d40"
Event type, module.object.action. Each type is documented as its own webhook. Ignore types you don't handle; new ones are added without notice.
"webhook.ping""guestcomm.message.created"
Payload schema version: the date it was introduced. Payloads change only additively within a version (Decision 32 records this exception to Decision 3).
"2026-11-01"
When the event happened (UTC). Use it, not delivery order, to sequence events.
"2026-10-30T09:14:02.000Z"
The property the event belongs to, as used in the Kyc-Property-Id header.
"4a2f0c10-2e7a-4b9d-9b3a-1f0c9e8d7a6b"
This delivery attempt. Changes on every retry and is not part of the event.
Hide child attributes
Hide child attributes
This event's delivery to your endpoint, also sent as the Kyc-Delivery-Id header.
"0193b2f0-7c20-7d11-8e2a-3f4b5c6d7e8f"
Attempt number, starting at 1.
x >= 11
When this attempt was sent (UTC), with milliseconds. The same moment as the webhook-timestamp header.
"2026-10-30T09:14:03.120Z"
Response
Stop sending. KYC disables the endpoint at once and sends nothing more until it is re-enabled. Use this only when the endpoint is retired for good.