Step-up challenges

Step-up challenge resolved

Sent when a step-up authentication challenge is resolved.

On VERIFIED the event carries authToken, the stepped-up token that authorizes operations requiring Strong Customer Authentication. Treat it as a credential and store it accordingly.

Enable and configure webhooks in the Embedder Portal; recent events are listed on its Webhook Logs page. Weavr sends this event to {Webhook URL}/stepup/watch.

postWebhook/stepup/watch

Headers

call-refstring

A call reference generated by the caller and unique to the caller to provide correlation between the caller and system with a maximum length of 255

published-timestampinteger required

The timestamp, expressed in Epoch timestamp using millisecond precision, when this event was published.

signaturestring required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the published-timestamp using your API key.

signature-v2string required

The signature to verify the authenticity of this request. This is the base64 hash (HmacSHA256) of the call-ref + payload + published-timestamp using your API key.

Payload

challengeIdstring required

The challenge that was resolved.

typestring required

The authentication factor the challenge was issued against.

status'VERIFIED' | 'DECLINED' | 'EXPIRED' required

The outcome of an authentication attempt:

  • VERIFIED: the attempt succeeded.
  • DECLINED: the attempt was rejected.
  • EXPIRED: the attempt was not completed in time.
authTokenstring

The stepped-up token, present when status is VERIFIED. Treat it as a credential: it authorizes operations that require Strong Customer Authentication.

publishedTimestampinteger required

When the event was published. Epoch timestamp using millisecond precision.

Example payload

{
  "credential": {
    "type": "USER",
    "id": "987654321"
  },
  "identity": {
    "type": "example",
    "id": "123456789"
  },
  "challengeId": "123456789",
  "type": "OTP",
  "publishedTimestamp": 1786118400000
}

Response

Event received.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.