{
"event": "kycUpdated",
"eventId": "0d6f1a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
"occurredAt": "2026-09-29T19:00:00Z",
"organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"kyc": {
"status": "inProgress",
"approved": false,
"needsWork": true,
"userMessage": "Please upload a current government-issued ID."
}
}kycUpdated
Fired whenever a customer’s KYC status changes, and when a write you sent was accepted but could not be applied.
The status field is one of not_started, in_progress, submitted, approved, denied (see the payload schema); approved: bool is kept for back-compat. KYC is org-level, so customerId is the identifier to key on and walletPublicKey is best-effort and may be empty.
On a denial, updateReason and userMessage explain what needs to be corrected. When needsWork is true, the customer can resubmit without creating a new KYC request.
needsWork also arrives without a status change, when one of the verification endpoints answered 202 and the work then failed. status is the customer’s current status, unchanged, and userMessage names what to send again. See KYC API error handling.
{
"event": "kycUpdated",
"eventId": "0d6f1a2b-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
"occurredAt": "2026-09-29T19:00:00Z",
"organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"kyc": {
"status": "inProgress",
"approved": false,
"needsWork": true,
"userMessage": "Please upload a current government-issued ID."
}
}Authorizations
API key sent in the Authorization header, with no Bearer prefix.
Headers
HMAC-SHA256 signature: sha256={hex}. Computed over the canonicalized (RFC 8785) request body using your webhook secret.
Body
Response
Return any 2xx to acknowledge receipt.