Webhook Event Reference

Quick reference

Event Type	Description	Trigger
EVALUATION EVENTS
`evaluation_completed`	Evaluation processing completed.	Asynchronous evaluation or manual case completion.
`evaluation_paused`	Evaluation processing paused.	Asynchronous evaluation paused.
`reevaluation`	Case reevaluated.	Case rerun in Case Management.
`workflow_execution_failed`	Evaluation execution failed.	Server errors, payload issues, or similar failures.
CASE MANAGEMENT EVENTS
`decision_update`	Decision updated in Case Management.	Manual reviewer decision (for example, accept, reject, or review).
`fraud_confirming`	Case marked as fraud or non-fraud.	Fraud confirmation in Case Management.
`review_case_assigned`	Case assigned to a reviewer.	Case assignment in Case Management.
`review_case_unassigned`	Case unassigned from a reviewer.	Case unassignment in Case Management.
`case_status_updated`	Case status updated.	Status update (for example, “Awaiting documentation”).
`case_notes_added`	Notes added to a case.	New note added in Case Management.
`case_attachment_added`	Attachments added to a case.	New files uploaded to a case.

Common fields

Field	Type	Description
`event_id`	String	Unique identifier for the webhook event.
`event_at`	String `<Date-Time>`	RFC 3339 timestamp when the event was created.
`event_type`	String	Type of event (see the `event_type` values listed earlier in this topic).
`customer_metadata`	Object	Present only when the originating evaluation included it. The opaque, caller-owned object you sent on the request, returned unchanged at the top level of the envelope.
`data`	Object	Event-specific payload data included in the webhook body.

Note: customer_metadata is returned at the top level of the envelope, alongside event_id and data — not inside data.

Evaluation events

`evaluation_completed`

This event occurs when any of the following happen:

An asynchronous evaluation finishes processing.
A manually created case completes processing.
Document verification (DocV) completes.
Any paused evaluation resumes and completes.

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer-provided identifier for the evaluation event (for example, `user_123`, `application_456`).
`workflow`	String	Yes	Workflow name corresponding to the evaluation use case as configured in RiskOS™.
`workflow_id`	String	Yes	Unique identifier (UUID) for the workflow.
`workflow_version`	String	Yes	Version number of the executed workflow.
`eval_id`	String	Yes	RiskOS™-generated unique ID for the evaluation.
`eval_start_time`	String `<Date-Time>`	Yes	RFC 3339 timestamp indicating when the evaluation started.
`eval_end_time`	String `<Date-Time>`	Yes	RFC 3339 timestamp indicating when the evaluation completed.
`decision`	String	Yes	Final decision outcome (for example, `ACCEPT`, `REJECT`, or `REVIEW`).
`decision_at`	String `<Date-Time>`	Yes	RFC 3339 timestamp when the decision was finalized.
`status`	String	Yes	Current case status (for example, `OPEN`, `CLOSED`).
`sub_status`	String	Yes	Current case sub-status (for example, `Surveillance`, `Approved`).
`score`	Number	No	Risk score associated with the evaluation (0–100, if available).
`eval_source`	String	Yes	Source of the evaluation (for example, `API`, `Manual`, `Rerun`).
`evaluation_status`	String	Yes	Always `"evaluation_completed"` for this event.
`environment_name`	String	Yes	Environment in which the evaluation was performed (for example, `Sandbox`, `Production`).
`reason_codes`	Array of Strings	Yes	Codes explaining the evaluation decision.
`tags`	Array of Strings	Yes	Tags associated with the evaluation.
`notes`	String	No	Additional notes related to the evaluation.
`review_queues`	Array of Strings	Yes	Names of the review queues assigned to the evaluation.
`data_enrichments`	Array of Objects	Yes	Third-party data enrichment results linked to the evaluation.

`evaluation_paused`

This event can be triggered when any of the following occur:

An asynchronous evaluation needs additional input (for example, One-Time Passcode (OTP) verification).
Document verification is waiting for user to upload documents.
Workflow requires manual intervention before proceeding.

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer-provided identifier for the evaluation event.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use case as configured in RiskOS™.
`workflow_id`	String	Yes	Unique identifier (UUID) for the workflow.
`workflow_version`	String	Yes	Version number of the executed workflow.
`eval_id`	String	Yes	RiskOS™-generated unique ID for the evaluation.
`eval_start_time`	String `<Date-Time>`	Yes	RFC 3339 timestamp indicating when the evaluation started.
`eval_end_time`	String `<Date-Time>`	Yes	RFC 3339 timestamp indicating when the evaluation was paused.
`decision`	String	Yes	Current decision state for the evaluation.
`decision_at`	String `<Date-Time>`	Yes	RFC 3339 timestamp when the current decision was made.
`status`	String	Yes	Current case status.
`sub_status`	String	Yes	Current case sub-status.
`eval_source`	String	Yes	Source of the evaluation (for example, `API`, `Manual`, `Rerun`).
`eval_status`	String	Yes	Always `"evaluation_paused"`.
`environment_name`	String	Yes	Environment in which the evaluation was performed (for example, `Sandbox`, `Production`).
`tags`	Array of Strings	Yes	Tags associated with the evaluation.
`notes`	String	No	Additional notes related to the evaluation.
`review_queues`	Array of Strings	Yes	Names of the review queues assigned to the evaluation.
`data_enrichments`	Array of Objects	Yes	Data enrichment results available for the evaluation.

`reevaluation`

This event occurs when any of the following happen:

A case is manually rerun from Case Management.
Workflow rules are updated and cases need re-processing.
Additional data becomes available and case needs fresh evaluation.

Payload schema

The payload structure is identical to evaluation_completed but with eval_source: "Rerun".

`workflow_execution_failed`

Triggered when an evaluation fails to execute due to errors (for example, server errors, payload issues, etc.).

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in the RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™ generated unique ID for the evaluation.
`workflow_version`	String	Yes	Version number associated with the executed workflow.
`timestamp`	String `<Date-Time>`	Yes	RFC 3339 date-time string received in the request payload.
`host`	String	Yes	Internal host that handled the evaluation.
`error_message`	String	Yes	Error message describing the reason for the failure.

Case Management events

`decision_update`

Triggered when a reviewer makes a decision change in Case Management (for example, approving a case that was in manual review).

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer-provided identifier for the evaluation event (for example, `application_id`).
`workflow`	String	Yes	Workflow name corresponding to the evaluation use case as configured in the RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™-generated unique ID for the evaluation.
`reviewer_id`	String	Yes	Email address of the reviewer.
`decision`	String	Yes	Decision outcome (for example, `ACCEPT`, `REJECT`, or `REVIEW`).
`decision_at`	String `<Date-Time>`	Yes	RFC 3339 timestamp when the decision was made.
`status`	String	Yes	New case status.
`sub_status`	String	Yes	New case sub-status.
`decision_queue`	String	Yes	Name of the review queue from which the decision was made.
`reason_codes`	Array of Strings	Yes	Reason codes associated with the decision.
`tags`	Array of Strings	Yes	Tags associated with the decision.
`notes`	String	No	Notes associated with the decision update.
`attachments`	Array of Strings	No	Names of the attachments added with the decision update.

`review_case_assigned`

Triggers when a case is assigned to a reviewer in Case Management (for example, a reviewer assigned a case to themselves or to a peer reviewer).

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™ generated unique ID for the evaluation.
`reviewer_id`	String	Yes	Email ID of the reviewer to whom the case is assigned.
`queue_name`	String	Yes	Name of the review queue from which the case assignment is performed.
`updated_by`	String	Yes	Email ID of the reviewer who performed the case assignment.
`updated_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string at which the case assignment is performed.

`review_case_unassigned`

Triggered when a case is unassigned from a reviewer in Case Management (for example, a reviewer un-assigned from a peer reviewer).

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™ generated unique ID for the evaluation.
`reviewer_id`	String	Yes	Email ID of the reviewer from whom the case is unassigned.
`queue_name`	String	Yes	Name of the review queue from which the case is unassigned.
`updated_by`	String	Yes	Email ID of the reviewer who performed the case unassignment.
`updated_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string when the case unassignment is performed.

`case_status_updated`

Triggered when a case status is updated in Case Management (for example, a reviewer makes a manual decision and moves a case into another status, such as "Awaiting documentation").

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™ generated unique ID for the evaluation.
`reviewer_id`	String	Yes	Email ID of the reviewer of the case.
`decision`	String	Yes	Decision.
`decision_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string at which the decision was taken.
`status`	String	Yes	The new status of the case.
`sub_status`	String	Yes	The new sub-status of the case.
`updated_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string at which the status update occurred. Same as `decision_at` in a Case Status Update.
`decision_queue`	String	Yes	Name of the review queue from which the decision was taken.
`reason_codes`	Array of Strings	Yes	Reason codes for the status update.
`tags`	Array of Strings	Yes	Tags for the status update.
`notes`	String	No	Notes associated with the status update.
`attachments`	Array of Strings	No	Names of the attachments added with the status update.

`case_notes_added`

Triggered when a reviewer adds notes to a case in Case Management (for example, a reviewer adds a new note to a case and may also add attachments with the case notes).

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard.
`eval_id`	String	Yes	RiskOS™ generated unique ID for the evaluation.
`reviewer_id`	String	Yes	Email ID of the reviewer of the case.
`updated_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string at which the status update was performed. Same as `decision_at` in a Case Status Update.
`notes`	String	Yes	Notes associated with the status update.
`attachments`	Array of Strings	No	Names of the attachments added with the status update.

`case_attachment_added`

Triggered when attachments are added to a case in case management (for example, a reviewer adds new attachments to a case).

Payload schema

`fraud_confirming`

Triggered when a reviewer marks a case as fraud or non-fraud in case management.

Payload schema

Field	Type	Always Present	Explanation
`id`	String	Yes	Customer provided identifier for the evaluation event like `application_id`.
`workflow`	String	Yes	Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard.
`fraud_label`	String	Yes	Fraud label: either `fraud` or `non-fraud`.
`fraud_type`	String	No	User-defined fraud types.
`notes`	String	No	Additional notes to be added when marking a case as fraud or non-fraud.
`tags`	Array of Strings	No	Tags associated with the fraud confirmation.
`recorded_by`	String	No	Fraud response team member who recorded the fraud at the customer end.
`recorded_at`	String `<Date-Time>`	No	RFC 3339 date-time string when the fraud feedback was recorded at the customer end.
`created_by`	String	Yes	Fraud response team member who recorded the fraud in RiskOS™.
`created_at`	String `<Date-Time>`	Yes	RFC 3339 date-time string when the fraud feedback was created in RiskOS™.