---
updatedAt: 2026-08-25T19:45:54.000Z
agentTools:
  projectIndex: https://docs.vouched.id/llms.txt
---

# Webhooks

When a job is completed or reviewed via the dashboard, Vouched can post the job results to a defined webhook URL. This can be set as `callbackURL` in the [JS Plugin](https://docs.vouched.id/docs/js-plugin), the [Submit Job](https://docs.vouched.id/reference/submitjob) or [Send Invite](https://docs.vouched.id/reference/sendinvites) API endpoint.

In order to distinguish webhook types you should check the `X-WebHook-Event`http header the values as follows:

* `job-reverify`when a reverification job completes
* `job-tin-validation` see [tin job docs](https://docs.vouched.id/reference/tinverify#body-params) for more information
* `job-aml-monitoring-update` for idv jobs with aml monitoring enabled
* `job-idv-complete`when a regular IDV job completes, this will be the most common one
* `job-dlv-complete`when DLV is enabled for IDV jobs
* `job-review` when a job is reviewed manually through the dashboard

Detailed explanation for each field can be found by clicking the **200 Provide Results on Jobs.** under the [Find Jobs](https://docs.vouched.id/reference/findjobs) page.

<Image src="https://files.readme.io/2d24b21-200.png" align="center" border={true} />

### Approved/Rejected properties

In the above JSON response, the main field to check whether a job **approved** or **rejected** is `result.success`. This boolean field indicates Approved when True or Rejected when False.

Approved jobs can still have warnings we recommend checking. The field `result.warnings` is a boolean that indicates whether there are warnings on the job. If there are warnings, the field `result.error` can be checked to understand what warnings exactly.

Common warnings are: data-checks/crosscheck error, expired document, DLV error, and AML error.

## Validating Webhook Responses

All webhook requests contain `X-Signature` in request headers. The `X-Signature` is base64 encoded, created using `HMAC-SHA1` using your [private key](https://docs.vouched.id/docs/manage-keys) as the key and using the response as data. To validate the webhook response, perform the same signature procedure and confirm that your generated signature matches the sent signature.

<Callout icon="📘" theme="info">
  If your account uses the [signature key](https://docs.vouched.id/docs/manage-keys), the `X-Signature` is base64 encoded, created using `HMAC-SHA1` with your signature key instead of the private key.
</Callout>

[Here is an example](https://github.com/vouched/vouched-nodejs-example/blob/7c67983ed21ef64d274e15e99aec23ccb1dead83/src/client.test.js#L573) of validation from our Node.js sample repo.

## Whitelisting

Please ensure the following IPs are whitelisted in order to receive webhook responses:

```
34.83.180.255
35.197.15.224
```