Event payloads - Instant Compliance API

Every webhook has the same JSON envelope. Only type and the contents of data.customer differ between events.

Envelope

{
  "id": "5f8c…-e2b1",          // matches the IC-Event-Id header; dedupe on it
  "type": "customer.kyc_completed",
  "created": "2026-09-01T12:34:56.000Z",
  "data": {
    "customer": { /* the public DTO — see below */ }
  }
}

Field	Type	Notes
`id`	string (uuid)	The event id. Same value as the `IC-Event-Id` header. Stable across redeliveries.
`type`	string	The event type. Switch on this; ignore unknown values.
`created`	string (ISO-8601)	When the event fired (UTC).
`data.customer`	object	The public customer/entity DTO — identical to `GET /v1/customers/{id}` or `GET /v1/entities/{id}`.

`customer.kyc_completed`

Fires when a record reaches a terminal verification verdict. data.customer is the individual DTO (kyc_status is VERIFIED or FAILED) or the entity DTO (kyb_status is VERIFIED or FAILED) depending on the record type.

{
  "id": "…",
  "type": "customer.kyc_completed",
  "created": "2026-09-01T12:34:56.000Z",
  "data": {
    "customer": {
      "id": "c_123",
      "external_id": "crm-987",
      "type": "INDIVIDUAL",
      "full_name": "Jane Citizen",
      "kyc_status": "VERIFIED",
      "kyc_completed_at": "2026-09-01T12:34:55.000Z",
      "aml": { "status": "CLEAR", "flags": { "pep": false, "sanctions": false, "adverse_media": false, "terrorism": false } }
    }
  }
}

`aml.review_completed`

Fires when the compliance team finishes reviewing a customer’s AML matches and the AML status settles to RESOLVED. Read data.customer.aml for the resolved status and category flags.

`customer.updated`

Fires when a customer/entity your integration owns is updated. data.customer is the current DTO. Because this can fire often, dedupe on IC-Event-Id and diff against your own copy if you only care about specific fields.

Handling unknown fields and events

Treat the payload as forward-compatible: we may add fields to a DTO or new values to type. Parse defensively — don’t fail on an unrecognised event type or an unexpected extra field.