Skip to main content
Alentra delivers results to the webhook URL configured for your business. For the delivery model and signature verification, see Webhooks; this page is the event payload reference.

Headers (every delivery)

Every payload is { "event": "...", "data": { ... } }, and data always echoes session_id plus the workflow id/revision/definition hash/launch mode. Caller metadata is included when set. The body also includes sent (RFC 3339) and delivery_id, matching the delivery header. The compact examples below omit those two envelope fields.

step.completed

Created once logically for each step after it verifies. The result fields depend on the primitive. Use stage to order results: at-least-once retries mean webhook arrival order is not guaranteed.
integer
Zero-based index of the completed step.
string
The step’s primitive.
string
Id of this step’s audit record — fetch the proof via GET /v1/audits/{id}.
string
Non-anonymous results — route jurisdiction.
string
Non-anonymous results — presentation provider id.
string
Non-anonymous results — verified credential profile id.
object
identify, sign, and light_sign — disclosed identity blocks. Signing steps include the default signer fields.
boolean
age_verify only — the threshold result. The birth date is never included.
integer
age_verify only — the threshold that was checked.
string
sign/light_sign only — the device signature.
string
sign/light_sign only — the hash that was signed.

session.completed

All steps verified.

session.stopped

You ended an active session via stop.

session.failed

A step failed verification, funds ran out, or an internal error occurred.
string
e.g. a verification error message, insufficient_funds, or internal_error.

session.expired

A total or per-step deadline elapsed. Expiry is persisted before this event is enqueued, and the deterministic delivery id ensures it is announced at most once logically (transport retries remain at-least-once).
Always verify the signature over the raw body and dedupe on X-Alentra-Delivery-Id before acting — delivery is at-least-once. After eight failed attempts the delivery is dead-lettered; use a one-off session GET for reconciliation rather than polling continuously.