Skip to main content

Webhooks

Instant ID as a Service (IIDaaS) webhooks deliver real-time event notifications to your systems over HTTPS, so you don't need to poll for changes. When an event occurs, IIDaaS sends an HTTP POST request with a JSON payload to a callback URL that you configure.

Webhooks cover several categories of events:

  • Authentication: Sign-in successes and failures, useful for security monitoring, alerting, and feeding events into SIEM or compliance tools.
  • User lifecycle: Account creation, profile updates, and deletions, useful for automating onboarding, offboarding, and keeping downstream systems in sync.
  • Authenticator changes: Password resets.
  • Credential events: Creation, updates, deletions, and print operations for credentials, useful for synchronizing downstream systems and supporting pre-print workflows.

Requirements and limits​

Endpoint requirements​

Your callback URL must use HTTPS and support TLSv1.2 or TLSv1.3. Versions lower than TLSv1.2 are not supported.

Retry behavior​

Upon sending a webhook notification, acknowledge server response success by receiving an HTTP 200 OK status code within 15 seconds. Otherwise, IIDaaS will attempt to resend the notification a maximum of 5 times. If a retry fails on the 5th attempt, the webhook will be disabled. The retry schedule applies if the client URL is no longer reachable or a 200 success response is not provided within 15 seconds. For more details, refer to the following retry schedule:

  • 30 seconds after the first attempt
  • 2 minutes after the first attempt
  • 15 minutes after the first attempt
  • 2 hours after the first attempt
  • 10 hours after the first attempt

Configuration limit​

Each customer can configure a maximum of 20 active webhooks.

Topics in this section​