Sign-in

Sign-in attempt

Sent each time a sign-in is attempted, whether it succeeds or not.

Use it to drive your own audit trail, or to alert a user when their credentials are used from somewhere they do not recognize. A DECLINED run against one credential is worth watching.

Enable and configure webhooks in the Embedder Portal; recent events are listed on its Webhook Logs page. Weavr sends this event to {Webhook URL}/login/watch.

postWebhook/login/watch

Headers

call-refstring

A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255

published-timestampinteger required

The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.

signaturestring required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the published-timestamp using your API key.

signature-v2string required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the call-ref + payload + published-timestamp using your API key.

Payload

typestring required

How the user signed in, by password or by token.

status'VERIFIED' | 'DECLINED' | 'EXPIRED' required

The outcome of an authentication attempt:

  • VERIFIED: the attempt succeeded.
  • DECLINED: the attempt was rejected.
  • EXPIRED: the attempt was not completed in time.
publishedTimestampinteger required

When the event was published. Epoch timestamp using millisecond precision.

Example payload

{
  "credential": {
    "type": "USER",
    "id": "987654321"
  },
  "identity": {
    "type": "example",
    "id": "123456789"
  },
  "type": "PASSWORD",
  "publishedTimestamp": 1786118400000
}

Response

Event received.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.