Receive an Alloy journey decision

POST/webhooks/alloyNo authentication

Alloy's journey decision webhook. The body is signed with base64(HMAC-SHA256(webhook secret, raw body)) in the Authorization header, with no bank token, and its envelope timestamp must be fresh. A verified event only names the journey application: compliance reads the decision back from Alloy and applies it through the KYC path, so nothing in the body sets a status. Each request_token is handled once across replicas (a replay answers duplicate with the recorded outcome and kyc_check_id); an event that cannot change the decision is ignored. The gateway routes the path to compliance.

Headers

Idempotency-KeystringOptional

Send on every write that creates or changes money or state; a replay with the same key returns the original result with 200.

Body parameters

dataobjectRequired

AlloyWebhookData is the journey event Alloy's envelope carries.

6 child attributes

entity_tokenstringRequired

external_entity_idstringRequired

The customer id the bank sent

journey_application_tokenstringRequired

journey_tokenstringRequired

timestampintegerRequired

typestringRequired

request_tokenstringRequired

Handled once across replicas

timestampintegerRequired

Covered by the signature; judges freshness

typestringRequired

Returns

200 OK

kyc_checkobject or nullOptional

9 child attributes

business_parties_versionintegerOptional

customer_idstringRequired

Example cust_2tVh8nqLxq4GbDe0K1F6S9zRcWm

decisionstringRequired

evidenceobject or nullOptional

The vendor evaluation the decision rests on; absent for the simulator

10 child attributes

entity_tokensarray of stringsRequired

evaluation_tokensarray of stringsRequired

journey_application_tokenstringRequired

journey_tokenstringRequired

outcomestringRequired

providerstringRequired

reason_codesarray of stringsRequired

recorded_atstring · date-timeRequired

response_digeststringRequired

statusstringRequired

idstringRequired

Example kycc_2tVh8nqLxq4GbDe0K1F6S9zRcWm

providerstringRequired

provider_refstringRequired

reasonsarray of stringsRequired

risk_ratingstringRequired

kyc_check_idstringOptional

A duplicate's recorded check

Example kycc_2tVh8nqLxq4GbDe0K1F6S9zRcWm

outcomestringOptional

A duplicate's recorded outcome

statusstringRequired

Errors

Every error is a problem document with a stable code. See Errors.

400401403404409412413422424429500503