Skip to main content
Webhooks are event-based notifications that are received when a specific event related to the account aggregator occurs.

​
Add webhooks

Add your webhook URL in our system for us to deliver webhook events. Follow the instructions below to configure the webhook URL. Ensure to provide the publicly accessible HTTPS URL to your webhook endpoint.
  1. Log in to the Merchant Dashboard and click Developers.
  2. Click Webhooks listed under the Secure ID card.
  3. Click Add Webhook URL in the Webhook screen.
  4. In the Add Webhook popup, fill in the following information:
  • Webhook URL: Enter the URL in this field.
  1. Click Test & Add Webhook.
The following events are triggered at different stages of the account aggregator consent process:
EventDescription
AA_CONSENT_VERIFICATION_SUCCESSConsent is approved.
AA_CONSENT_VERIFICATION_PAUSEDConsent is paused.
AA_CONSENT_VERIFICATION_REVOKEDConsent is revoked.
AA_CONSENT_VERIFICATION_REJECTEDConsent is rejected.
AA_CONSENT_VERIFICATION_EXPIREDConsent has expired.

​
FI webhook event

The following events are triggered at different stages of the account aggregator financial information process:
EventDescription
AA_FI_VERIFICATION_SUCCESSFinancial information verification is successful.
AA_FI_VERIFICATION_ACTIVEFinancial information consent is active.
AA_FI_VERIFICATION_FAILEDFinancial information verification has failed.
AA_FI_VERIFICATION_EXPIREDFinancial information verification has expired.
{
    "event_type": "AA_FI_VERIFICATION_ACTIVE",
    "event_time": "2024-02-15 16:53:15",
    "version": "v1",
    "data": {
    "status": "ACTIVE",
    "fi_verification_id": "v1234567890abcdef",
    "fi_status_response": [
            {
                "fip_id": "FIP_1",
                "accounts": [
                    {
                        "link_ref_number": "b2328fa7-0dcd-2314-asb5-9ef7b4c1cz6b",
                        "fi_status": "READY"
                    },
                    {
                        "link_ref_number": "a2328fa7-0dcd-2314-asb5-9ef7b4c1cz6b",
                        "fi_status": "TIMEOUT"
                    }
                ]
            },
            {
                "fip_id": "FIP_2",
                "accounts": [
                    {
                        "link_ref_number": "c2328fa7-0dcd-2314-asb5-9ef7b4c1cz6b",
                        "fi_status": "READY"
                    }
                ]
            }
        ]
    }
}

{
    "event_type": "AA_FI_VERIFICATION_SUCCESS",
    "event_time": "2024-02-15 16:53:15",
    "version": "v1",
    "data": {
    "status": "SUCCESS",
    "fi_verification_id": "v1234567890abcdef"
    }
}

{
    "event_type": "AA_FI_VERIFICATION_FAILED",
    "event_time": "2024-02-15 16:53:15",
    "version": "v1",
    "data": {
    "status": "FAILED",
    "fi_verification_id": "v1234567890abcdef"
    }
}

{
    "event_type": "AA_FI_VERIFICATION_EXPIRED",
    "event_time": "2024-02-15 16:53:15",
    "version": "v1",
    "data": {
    "status": "EXPIRED",
    "fi_verification_id": "v1234567890abcdef"
    }
}

​
Webhook signature

You will receive the webhook signature in the webhook header. Here is a sample header from a webhook request.
Header NameHeader Value
content-length1099
x-webhook-attempt1
content-typeapplication/json
x-webhook-signature07r5C3VMwsGYeldGOCYxe5zoHhIN1zLfa8O0U/yngHI=
x-webhook-timestamp1746427759733
Always capture the webhook payload in its raw text format before parsing into JSON. Parsing and re-serialising the payload can change the structure (for example, array ordering, spacing, or null handling) and cause a signature mismatch during verification. Use the exact raw body string from the request when computing the signature.

​
Webhook payload fields

The webhook payload contains important metadata in its top-level fields.
FieldTypeDescription
event_typestringIndicates the type of event that triggered the webhook.
event_timestringThe UTC timestamp of when the event occurred, formatted in ISO 8601 (YYYY-MM-DDTHH:MM:SSZ).
versionstringIndicates the webhook format being used. Default version is “v1”.
dataobjectContains event-specific details related to this feature.
Verifying the signature is mandatory before processing any response. Refer to Signature Verification for more details.