Fired when the recipient of a consent request (an authorization) taps Allow. The authorization is now active; an approver who is not the account owner must still complete encryption enrollment before confirmations can be sent to them (403 approver_not_enrolled until then).

postWebhookauthorization.approved

Payload

event'authorization.approved' | 'authorization.denied' required

The event type — the same value as the X-Proof-Event header

authorization_idstring required

MongoDB ObjectId

hitl_idstring

HITL configuration the consent was asked for

status'active' | 'denied' required

active when the recipient allowed, denied when they refused

channel'whatsapp' | 'telegram' | 'sms' | 'email' required

Channel authorized for sending confirmations

scope'confirmations' | 'identity_challenge'

Scope of the authorization. identity_challenge is the Proof of Me scope.

proof_tokenstring

Signed proof of the recipient's decision (its decision claim is approve or deny)

decided_atstring date-time

When the recipient answered

expires_atstring date-time

When the authorization expires

Example payload

{
  "authorization_id": "507f1f77bcf86cd799439011",
  "hitl_id": "507f1f77bcf86cd799439011",
  "channel": "whatsapp",
  "scope": "confirmations"
}

Response

Webhook received

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.