Fired when a verification request passes its expires_at without completing. Delivered by the hourly expiry sweep (never on a request read) — at-least-once, including for requests marked expired on read before the sweep ran. A one-shot marker de-duplicates, but rare overlapping sweeps may deliver more than once: dedupe on request_id. The payload carries status: "expired" and any proofs verified before expiry (an empty array when none were).

postWebhookverification_request.expired

Payload

event'verification_request.completed' | 'verification_request.partial' | 'verification_request.expired' | 'verification.completed' | 'confirmation.approved' | 'confirmation.denied' | 'authorization.approved' | 'authorization.denied' | 'proof.revoked' | 'proof.suspended' | 'proof.unsuspended' | 'account.deletion_scheduled' | 'account.deletion_cancelled' required

Type of webhook event. proof.suspended/proof.unsuspended fire for a delegation (ph_dlg_*) lifecycle act on the account's own configured webhook_url — not a channel to a separately-addressed delegate (h-fix-delegation-suspend-governance).

request_idstring required

MongoDB ObjectId

reference_idstring
status'pending' | 'partial' | 'completed' | 'expired' | 'cancelled' required

Status of a verification request

action_type'verification' | '2fa' | 'login' | 'custom' | 'confirmation' | 'authorization' required

Type of action for verification request or authorization

client_metadataobject

Client-provided metadata passed through to webhook

completed_atstring date-time
testboolean

Present and true for test-mode webhooks

Example payload

{
  "event": "verification_request.completed",
  "request_id": "507f1f77bcf86cd799439011",
  "reference_id": "order_12345",
  "status": "pending",
  "action_type": "verification",
  "action_context": {
    "title": "Approve wire transfer",
    "amount": 15000,
    "currency": "USD",
    "entity": "production-cluster"
  },
  "proofs": [
    {
      "type": "phone",
      "identifier": "+1234567890",
      "channel": "whatsapp",
      "confidence": "high"
    }
  ]
}

Response

Webhook received

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.