Webhooks

Every event can be delivered to your endpoint. Headers: X-Authpermit-Signature (HMAC-SHA256 of timestamp.body), X-Authpermit-Event-ID, X-Authpermit-Timestamp. Retries use exponential backoff; every delivery attempt is visible and replayable in the developer portal.

Delivery guarantees

At least once, one delivery per event per endpoint. Each event is written with the change that caused it, so an event you receive always happened, and one that rolled back is never sent. Authpermit schedules at most one delivery of an event to an endpoint; a retry of that delivery, or a replay you ask for, can reach you again, so deduplicate on X-Authpermit-Event-ID (it is the id in the body). Events are not globally ordered: order by created_at, and fetch the resource when order matters.

Webhooks are one of several consumers of the event stream, and each consumer is retried on its own: a failure elsewhere never resends your webhook, and a failure to schedule your webhook is retried and, if it keeps failing, held for Authpermit operators to replay rather than dropped.

{"id":"evt_...","type":"verification.completed","created_at":"...","data":{"verification_id":"vs_...","status":"verified","assurance":3}}