Webhooks

Instead of polling, pass a callbackUrl when creating a session and AveTrust POSTs a signed event to it when the verification changes.

The event

{
  "type": "verification.completed",
  "data": {
    "sessionId": "b0e78b78-…",
    "status": "APPROVED",
    "externalUserId": "user_42",
    "checks": [{ "type": "FACE_MATCH", "result": "passed", "score": 0.91 }],
    "decision": { "outcome": "APPROVED", "mode": "AUTO" }
  }
}

Verify the signature

Every request carries an X-AveTrust-Signature header (HMAC-SHA256 of the raw body with your webhook secret). Always verify it before trusting the payload — the SDKs do it for you:

const event = av.webhooks.constructEvent(
  rawBody,
  req.headers["x-avetrust-signature"],
  process.env.AVETRUST_WEBHOOK_SECRET!,
);

Next steps

• Results & decisions
• n8n Trigger — webhooks without code.