Authentication factors

Authentication factor enrollment

Sent when a user's authentication factor is enrolled or removed.

A user with no ACTIVE factor cannot complete step-up authentication, so watch for INACTIVE to prompt them to enroll a replacement before they need one.

Enable and configure webhooks in the Embedder Portal; recent events are listed on its Webhook Logs page. Weavr sends this event to {Webhook URL}/authentication_factors/watch.

postWebhook/authentication_factors/watch

Headers

call-refstring

A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255

published-timestampinteger required

The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.

signaturestring required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the published-timestamp using your API key.

signature-v2string required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the call-ref + payload + published-timestamp using your API key.

Payload

typestring required

The authentication factor that was enrolled or removed.

status'ACTIVE' | 'INACTIVE' required

Whether the authentication factor is usable:

  • ACTIVE: the factor is enrolled and can be challenged.
  • INACTIVE: the factor has been removed and can no longer be challenged.
publishedTimestampinteger required

When the event was published. Epoch timestamp using millisecond precision.

Example payload

{
  "credentialId": {
    "type": "USER",
    "id": "987654321"
  },
  "type": "OTP",
  "publishedTimestamp": 1786118400000
}

Response

Event received.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.