---
title: "IdentityProfile Needs action"
method: POST
path: "identity_profile.needs_action"
tags: ["Identity profiles"]
---

# IdentityProfile Needs action

`POST identity_profile.needs_action` (webhook)

Sent when a identity profile is needs action

Required permissions:
 - `identity:read`
 - `webhook_receive:identity_profiles`

## Headers

- `webhook-id` string, required — A unique identifier for this webhook request
- `webhook-signature` string, required — The signature of the webhook request with the webhook version prepended
- `webhook-timestamp` string, required — The timestamp in seconds since the Unix epoch that the webhook was sent at on the server

## Payload

- object
  - `api_version` 'v1', required — The API version for this webhook
  - `company_id` string, nullable — The company ID that this webhook event is associated with
  - `data` IdentityProfile, required — A consolidated identity or business profile synced from verification provider data.
    - `business_address` object, nullable, required — Registered business address reported by the identity provider. Present on `business` profiles.
      - `city` string, nullable, required — The city of the address.
      - `country` string, nullable, required — The country of the address.
      - `line1` string, nullable, required — The line 1 of the address.
      - `line2` string, nullable, required — The line 2 of the address.
      - `postal_code` string, nullable, required — The postal code of the address.
      - `state` string, nullable, required — The state of the address.
    - `business_name` string, nullable, required — Business entity name. Present on `business` profiles.
    - `business_structure` string, nullable, required — Reported legal structure of a business profile (e.g. `corp`, `llc`). Provider-specific values; present on `business` profiles.
    - `country` string, nullable, required — ISO 3166-1 alpha-2 country code reported by the identity provider, such as `US` or `GB`. For individuals this is the country of citizenship or residence; for businesses, the country of incorporation.
    - `created_at` string, date-time, required — When the identity profile was first created.
    - `date_of_birth` string, nullable, required — ISO date (`YYYY-MM-DD`) reported by the identity provider. Present on `individual` profiles.
    - `email` string, nullable, required — Email address reported by the identity provider. Typically present on `individual` profiles.
    - `first_name` string, nullable, required — Individual's first name.
    - `id` string, required — The tag of the identity profile (idpf_xxx).
    - `last_name` string, nullable, required — Individual's last name.
    - `linked_companies` object[], required — The companies this identity profile is currently linked to. Only populated for direct Whop user sessions; always empty when authenticated via API key, app, or OAuth scope (a single identity can be linked to companies the calling platform is not entitled to see).
      - `id` string, required — The unique identifier for the company.
      - `title` string, required — The display name of the company shown to customers.
    - `payout_status` 'connected' | 'disabled' | 'action_required' | 'pending_verification' | 'verification_failed' | 'not_started', required — The granular calculated statuses reflecting payout account KYC and withdrawal readiness.
    - `payouts_enabled` boolean, required — Whether this profile can receive payouts right now. True only when payout onboarding is complete and no payout holds are active on the linked account. Treat this as the single source of truth for payout readiness.
    - `personal_address` object, nullable, required — Residential address reported by the identity provider. Present on `individual` profiles.
      - `city` string, nullable, required — The city of the address.
      - `country` string, nullable, required — The country of the address.
      - `line1` string, nullable, required — The line 1 of the address.
      - `line2` string, nullable, required — The line 2 of the address.
      - `postal_code` string, nullable, required — The postal code of the address.
      - `state` string, nullable, required — The state of the address.
    - `phone` string, nullable, required — Phone number reported by the identity provider. Typically present on `individual` profiles.
    - `profile_type` string, required — Whether this is an 'individual' or 'business' profile.
    - `status` 'not_started' | 'pending' | 'approved' | 'rejected' | 'action_required', required — Derived verification status for an identity profile.
    - `updated_at` string, date-time, required — When the identity profile was last synced from a verification.
    - `verifications` object[], required — All verification attempts attached to this identity profile, ordered most-recent first.
      - `created_at` string, date-time, required — When the verification record was created.
      - `id` string, required — The numeric id of the verification record.
      - `last_error_code` 'abandoned' | 'consent_declined' | 'country_not_supported' | 'device_not_supported' | 'document_expired' | 'document_type_not_supported' | 'document_unverified_other' | 'email_unverified_other' | 'email_verification_declined' | 'id_number_insufficient_document_data' | 'id_number_mismatch' | 'id_number_unverified_other' | 'phone_unverified_other' | 'phone_verification_declined' | 'selfie_document_missing_photo' | 'selfie_face_mismatch' | 'selfie_manipulated' | 'selfie_unverified_other' | 'under_supported_age', required — An error code for a verification attempt.
      - `last_error_reason` string, nullable, required — A human-readable explanation of the most recent verification error. Null if no error has occurred.
      - `session_url` string, nullable, required — A URL the user can visit to complete the verification process. Null if the session does not require user interaction.
      - `status` 'requires_input' | 'processing' | 'verified' | 'canceled' | 'created' | 'started' | 'submitted' | 'approved' | 'declined' | 'resubmission_requested' | 'expired' | 'abandoned' | 'review' | 'action_required', required — A status for a verification.
  - `id` string, required — A unique ID for every single webhook request
  - `timestamp` string, date-time, required — The timestamp in ISO 8601 format that the webhook was sent at on the server
  - `type` 'identity_profile.needs_action', required — The webhook event type

## Acknowledgement `200`

Return a 200 status to indicate that the data was received successfully

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/60bbb4a6ffbc/schema)