Skip to main content
Webhooks let you receive real-time HTTP notifications when fraud events occur in your AntifraudAI account — without polling the API. When a subscribed event is triggered, AntifraudAI sends an HTTP POST request to your registered URL with a JSON payload describing the event. Use webhooks to power automated workflows such as blocking transactions, alerting your fraud team, or syncing decisions to your internal systems.
AntifraudAI signs every webhook delivery with an HMAC-SHA256 signature using your endpoint’s signing_secret. Always verify the X-AntifraudAI-Signature header on incoming requests before processing the payload.

​
POST /webhooks

Register a new webhook endpoint. After creation, AntifraudAI will begin delivering events to your URL immediately.

​
Request Parameters

​
string
required
The HTTPS URL that will receive webhook POST requests. Plain HTTP URLs are not accepted. The endpoint must respond with a 2xx status code within 10 seconds, or the delivery will be marked as failed and retried.
​
array
required
An array of event type strings to subscribe to. Available event types include:
  • transaction.screened — a transaction was screened
  • transaction.decision.block — a transaction was blocked
  • event.screened — a user event was screened
  • case.created — a review case was created
  • case.resolved — a review case was resolved
  • decision.reviewed — a manual review override was submitted
​
string
A human-readable label for this webhook endpoint to help identify it in the dashboard (e.g., "Production case alerts", "Staging test endpoint").
cURL

​
Response Fields

​
string
Unique identifier for this webhook endpoint.
​
string
The HTTPS URL registered for this endpoint.
​
array of strings
The list of event types this endpoint is subscribed to.
​
string
The HMAC-SHA256 signing secret for this endpoint. Use this to verify the X-AntifraudAI-Signature header on incoming webhook deliveries.
​
string
ISO 8601 UTC timestamp of when the endpoint was registered.
Example response:
The signing_secret is only returned once — at the time of creation. It is never included in subsequent API responses. Store it immediately in a secure location such as a secrets manager or environment variable. If you lose it, you will need to delete this endpoint and create a new one.

​
GET /webhooks

List all webhook endpoints registered for your account. The signing_secret is not included in list responses.
cURL
Example response:

​
DELETE /webhooks/

Permanently delete a webhook endpoint. No further events will be delivered to its URL after deletion.
​
string
required
The unique identifier of the webhook endpoint to delete.
cURL
A successful deletion returns 204 No Content with an empty response body.
Deleting a webhook immediately stops all future event deliveries to that endpoint. However, deliveries that were already in-flight at the time of deletion may still arrive at your URL. Ensure your endpoint can handle and safely ignore any such late deliveries.
Before deleting a webhook in production, consider first updating your subscription to an empty events array or routing it to a no-op URL. This lets you drain any in-flight deliveries gracefully before removing the endpoint entirely.