Webhook
Method: POST (HTTPS only)
Headers
-
Content-Type: application/json -
Authorization: Bearer(optional) -
X-Cryptopass-Signature: sha256=
Important: verify the signature and use replay_protection_id for idempotency.
Request Body (cryptopass.created)
{
"event": "cryptopass.created",
"provider_slug": "myexchange",
"external_user_id": "ext-user-12345",
"timestamp": "2025-10-27T12:34:56Z",
"cryptopass": {
"id": 1234,
"order_id": 5678,
"status": "active",
"level": { "duration_days": 365 },
"user": {
"email": "optional@example.com",
"sumsub_applicant_id": "optional-abc123"
},
"verification": {
"kyc_status": "passed",
"aml_status": "passed",
"ownership_status": "passed"
},
"wallets": [{
"address": "0xabc...",
"chain": "ETH",
"ownership_signature": "0x...",
"ownership_status": "passed",
"risk_score": 14
}],
"documents": {
"pdf_report_url": "https://.../report.pdf"
}
},
"meta": {
"replay_protection_id": "jti-123",
"version": "1.0"
}
}Response
200 OK with { "ok": true }. Retries: non-2xx with backoff. Handle idempotently via replay_protection_id.