## Quick reference

| Event Type | Description | Trigger |
| --- | --- | --- |
| **EVALUATION EVENTS** |  |  |
| [`evaluation_completed`](https://help.socure.com/riskos/docs/webhook-events#evaluation-completed) | Evaluation processing completed. | Asynchronous evaluation or manual case completion. |
| [`evaluation_paused`](https://help.socure.com/riskos/docs/webhook-events#evaluation-paused) | Evaluation processing paused. | Asynchronous evaluation paused. |
| [`reevaluation`](https://help.socure.com/riskos/docs/webhook-events#reevaluation) | Case reevaluated. | Case rerun in Case Management. |
| [`workflow_execution_failed`](https://help.socure.com/riskos/docs/webhook-events#workflow-execution-failed) | Evaluation execution failed. | Server errors, payload issues, or similar failures. |
| **CASE MANAGEMENT EVENTS** |  |  |
| [`decision_update`](https://help.socure.com/riskos/docs/webhook-events#decision-update) | Decision updated in Case Management. | Manual reviewer decision (for example, accept, reject, or review). |
| [`fraud_confirming`](https://help.socure.com/riskos/docs/webhook-events#fraud-confirming) | Case marked as fraud or non-fraud. | Fraud confirmation in Case Management. |
| [`review_case_assigned`](https://help.socure.com/riskos/docs/webhook-events#review-case-assigned) | Case assigned to a reviewer. | Case assignment in Case Management. |
| [`review_case_unassigned`](https://help.socure.com/riskos/docs/webhook-events#review-case-unassigned) | Case unassigned from a reviewer. | Case unassignment in Case Management. |
| [`case_status_updated`](https://help.socure.com/riskos/docs/webhook-events#case-status-updated) | Case status updated. | Status update (for example, “Awaiting documentation”). |
| [`case_notes_added`](https://help.socure.com/riskos/docs/webhook-events#case-notes-added) | Notes added to a case. | New note added in Case Management. |
| [`case_attachment_added`](https://help.socure.com/riskos/docs/webhook-events#case-attachment-added) | Attachments added to a case. | New files uploaded to a case. |

### Common fields

| Field | Type | Description |
| --- | --- | --- |
| `event_id` | String | Unique identifier for the webhook event. |
| `event_at` | String `<Date-Time>` | RFC 3339 timestamp when the event was created. |
| `event_type` | String | Type of event (see the `event_type` values listed earlier in this topic). |
| `customer_metadata` | Object | Present only when the originating evaluation included it. The opaque, caller-owned object you sent on the request, returned unchanged at the top level of the envelope. |
| `data` | Object | Event-specific payload data included in the webhook body. |

> **Note**: `customer_metadata` is returned at the top level of the envelope, alongside `event_id` and `data` — not inside `data`.

## Evaluation events

### `evaluation_completed`

This event occurs when any of the following happen:

- An asynchronous evaluation finishes processing.
- A manually created case completes processing.
- Document verification (DocV) completes.
- Any paused evaluation resumes and completes.

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer-provided identifier for the evaluation event (for example, `user_123`, `application_456`). |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use case as configured in RiskOS™. |
| `workflow_id` | String | Yes | Unique identifier (UUID) for the workflow. |
| `workflow_version` | String | Yes | Version number of the executed workflow. |
| `eval_id` | String | Yes | RiskOS™-generated unique ID for the evaluation. |
| `eval_start_time` | String `<Date-Time>` | Yes | RFC 3339 timestamp indicating when the evaluation started. |
| `eval_end_time` | String `<Date-Time>` | Yes | RFC 3339 timestamp indicating when the evaluation completed. |
| `decision` | String | Yes | Final decision outcome (for example, `ACCEPT`, `REJECT`, or `REVIEW`). |
| `decision_at` | String `<Date-Time>` | Yes | RFC 3339 timestamp when the decision was finalized. |
| `status` | String | Yes | Current case status (for example, `OPEN`, `CLOSED`). |
| `sub_status` | String | Yes | Current case sub-status (for example, `Surveillance`, `Approved`). |
| `score` | Number | No | Risk score associated with the evaluation (0–100, if available). |
| `eval_source` | String | Yes | Source of the evaluation (for example, `API`, `Manual`, `Rerun`). |
| `evaluation_status` | String | Yes | Always `"evaluation_completed"` for this event. |
| `environment_name` | String | Yes | Environment in which the evaluation was performed (for example, `Sandbox`, `Production`). |
| `reason_codes` | Array of Strings | Yes | Codes explaining the evaluation decision. |
| `tags` | Array of Strings | Yes | Tags associated with the evaluation. |
| `notes` | String | No | Additional notes related to the evaluation. |
| `review_queues` | Array of Strings | Yes | Names of the review queues assigned to the evaluation. |
| `data_enrichments` | Array of Objects | Yes | Third-party data enrichment results linked to the evaluation. |

### `evaluation_paused`

This event can be triggered when any of the following occur:

- An asynchronous evaluation needs additional input (for example, One-Time Passcode (OTP) verification).
- Document verification is waiting for user to upload documents.
- Workflow requires manual intervention before proceeding.

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer-provided identifier for the evaluation event. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use case as configured in RiskOS™. |
| `workflow_id` | String | Yes | Unique identifier (UUID) for the workflow. |
| `workflow_version` | String | Yes | Version number of the executed workflow. |
| `eval_id` | String | Yes | RiskOS™-generated unique ID for the evaluation. |
| `eval_start_time` | String `<Date-Time>` | Yes | RFC 3339 timestamp indicating when the evaluation started. |
| `eval_end_time` | String `<Date-Time>` | Yes | RFC 3339 timestamp indicating when the evaluation was paused. |
| `decision` | String | Yes | Current decision state for the evaluation. |
| `decision_at` | String `<Date-Time>` | Yes | RFC 3339 timestamp when the current decision was made. |
| `status` | String | Yes | Current case status. |
| `sub_status` | String | Yes | Current case sub-status. |
| `eval_source` | String | Yes | Source of the evaluation (for example, `API`, `Manual`, `Rerun`). |
| `eval_status` | String | Yes | Always `"evaluation_paused"`. |
| `environment_name` | String | Yes | Environment in which the evaluation was performed (for example, `Sandbox`, `Production`). |
| `tags` | Array of Strings | Yes | Tags associated with the evaluation. |
| `notes` | String | No | Additional notes related to the evaluation. |
| `review_queues` | Array of Strings | Yes | Names of the review queues assigned to the evaluation. |
| `data_enrichments` | Array of Objects | Yes | Data enrichment results available for the evaluation. |

### `reevaluation`

This event occurs when any of the following happen:

- A case is manually rerun from Case Management.
- Workflow rules are updated and cases need re-processing.
- Additional data becomes available and case needs fresh evaluation.

#### Payload schema

The payload structure is identical to `evaluation_completed` but with `eval_source: "Rerun"`.

### `workflow_execution_failed`

Triggered when an evaluation fails to execute due to errors (for example, server errors, payload issues, etc.).

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in the RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™ generated unique ID for the evaluation. |
| `workflow_version` | String | Yes | Version number associated with the executed workflow. |
| `timestamp` | String `<Date-Time>` | Yes | RFC 3339 date-time string received in the request payload. |
| `host` | String | Yes | Internal host that handled the evaluation. |
| `error_message` | String | Yes | Error message describing the reason for the failure. |

### Case Management events

### `decision_update`

Triggered when a reviewer makes a decision change in Case Management (for example, approving a case that was in manual review).

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer-provided identifier for the evaluation event (for example, `application_id`). |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use case as configured in the RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™-generated unique ID for the evaluation. |
| `reviewer_id` | String | Yes | Email address of the reviewer. |
| `decision` | String | Yes | Decision outcome (for example, `ACCEPT`, `REJECT`, or `REVIEW`). |
| `decision_at` | String `<Date-Time>` | Yes | RFC 3339 timestamp when the decision was made. |
| `status` | String | Yes | New case status. |
| `sub_status` | String | Yes | New case sub-status. |
| `decision_queue` | String | Yes | Name of the review queue from which the decision was made. |
| `reason_codes` | Array of Strings | Yes | Reason codes associated with the decision. |
| `tags` | Array of Strings | Yes | Tags associated with the decision. |
| `notes` | String | No | Notes associated with the decision update. |
| `attachments` | Array of Strings | No | Names of the attachments added with the decision update. |

### `review_case_assigned`

Triggers when a case is assigned to a reviewer in Case Management (for example, a reviewer assigned a case to themselves or to a peer reviewer).

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™ generated unique ID for the evaluation. |
| `reviewer_id` | String | Yes | Email ID of the reviewer to whom the case is assigned. |
| `queue_name` | String | Yes | Name of the review queue from which the case assignment is performed. |
| `updated_by` | String | Yes | Email ID of the reviewer who performed the case assignment. |
| `updated_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string at which the case assignment is performed. |

### `review_case_unassigned`

Triggered when a case is unassigned from a reviewer in Case Management (for example, a reviewer un-assigned from a peer reviewer).

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™ generated unique ID for the evaluation. |
| `reviewer_id` | String | Yes | Email ID of the reviewer from whom the case is unassigned. |
| `queue_name` | String | Yes | Name of the review queue from which the case is unassigned. |
| `updated_by` | String | Yes | Email ID of the reviewer who performed the case unassignment. |
| `updated_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string when the case unassignment is performed. |

### `case_status_updated`

Triggered when a case status is updated in Case Management (for example, a reviewer makes a manual decision and moves a case into another status, such as "Awaiting documentation").

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™ generated unique ID for the evaluation. |
| `reviewer_id` | String | Yes | Email ID of the reviewer of the case. |
| `decision` | String | Yes | Decision. |
| `decision_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string at which the decision was taken. |
| `status` | String | Yes | The new status of the case. |
| `sub_status` | String | Yes | The new sub-status of the case. |
| `updated_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string at which the status update occurred. Same as `decision_at` in a Case Status Update. |
| `decision_queue` | String | Yes | Name of the review queue from which the decision was taken. |
| `reason_codes` | Array of Strings | Yes | Reason codes for the status update. |
| `tags` | Array of Strings | Yes | Tags for the status update. |
| `notes` | String | No | Notes associated with the status update. |
| `attachments` | Array of Strings | No | Names of the attachments added with the status update. |

### `case_notes_added`

Triggered when a reviewer adds notes to a case in Case Management (for example, a reviewer adds a new note to a case and may also add attachments with the case notes).

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard. |
| `eval_id` | String | Yes | RiskOS™ generated unique ID for the evaluation. |
| `reviewer_id` | String | Yes | Email ID of the reviewer of the case. |
| `updated_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string at which the status update was performed. Same as `decision_at` in a Case Status Update. |
| `notes` | String | Yes | Notes associated with the status update. |
| `attachments` | Array of Strings | No | Names of the attachments added with the status update. |

### `case_attachment_added`

Triggered when attachments are added to a case in case management (for example, a reviewer adds new attachments to a case).

#### Payload schema

### `fraud_confirming`

Triggered when a reviewer marks a case as fraud or non-fraud in case management.

#### Payload schema

| Field | Type | Always Present | Explanation |
| --- | --- | --- | --- |
| `id` | String | Yes | Customer provided identifier for the evaluation event like `application_id`. |
| `workflow` | String | Yes | Workflow name corresponding to the evaluation use-case as configured in RiskOS™ Dashboard. |
| `fraud_label` | String | Yes | Fraud label: either `fraud` or `non-fraud`. |
| `fraud_type` | String | No | User-defined fraud types. |
| `notes` | String | No | Additional notes to be added when marking a case as fraud or non-fraud. |
| `tags` | Array of Strings | No | Tags associated with the fraud confirmation. |
| `recorded_by` | String | No | Fraud response team member who recorded the fraud at the customer end. |
| `recorded_at` | String `<Date-Time>` | No | RFC 3339 date-time string when the fraud feedback was recorded at the customer end. |
| `created_by` | String | Yes | Fraud response team member who recorded the fraud in RiskOS™. |
| `created_at` | String `<Date-Time>` | Yes | RFC 3339 date-time string when the fraud feedback was created in RiskOS™.