Decionis
Decionis Docs
Base URL: https://api.decionis.com/v1
QuickstartMain siteContact
API documentation

Webhooks

Decionis uses webhooks in two directions: inbound signal ingress for live provider events, and outbound WEBHOOK callbacks for governed decision delivery into partner systems.

Overview

Webhook ingress is part of the standard API contract for production onboarding.

Two webhook surfaces

If a provider is sending live events into Decionis today, it should post those events to a Decionis-issued ingress webhook after sample validation and deployment-bundle issuance. If the provider also wants Decionis to push governed decisions back, configure the first-class WEBHOOK integration provider with a callback URL and optional signing secret.

Issuance

Ingress credentials are issued through the signal-mapping onboarding flow. Outbound callbacks are configured from the workspace or the org integrations API.

POST/v1/public/pilot/signal-mapping/sessions/:sessionId/deployment-bundleOnboarding grant or org API key

Return the connector ID, webhook URL, webhook secret, org ID, API key, and policy version in one onboarding step.

curl -X POST https://api.decionis.com/v1/public/pilot/signal-mapping/sessions/<session_id>/deployment-bundle \
  -H "Authorization: Bearer <onboarding_or_org_key>" \
  -H "Content-Type: application/json" \
  -d '{"provider_key":"partner_webhook","workflow_key":"decision_intake","source_label":"primary_stream"}'

Inbound contract

Normalizing providers into the same ingress shape keeps onboarding productized and self-serve.

FieldRequirement
eventsArray of one or more normalized provider events.
events[].typeRequired event type emitted by the provider.
events[].timestampRequired provider event timestamp in ISO-8601 UTC.
events[].dataRequired event payload object containing mapped business fields.
x-webhook-secretRequired shared secret header unless a signed variant is explicitly issued.

Outbound decision callbacks

Use the first-class WEBHOOK provider when Decionis should push governed decisions into a partner or internal receiver.

POST/v1/orgs/:orgId/integrations/WEBHOOK/connectAPI key

Create or update a callback destination that receives Decionis event deliveries.

curl -X POST https://api.decionis.com/v1/orgs/<org_id>/integrations/WEBHOOK/connect \
  -H "Authorization: Bearer dcy_org_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "config": {
      "endpoint_url": "https://partner.example.com/decionis/webhook",
      "provider_name": "partner-webhook",
      "workflow_id": "decision_intake"
    },
    "credentials": {
      "webhook_secret": "whsec_partner_xxx"
    },
    "subscriptions": [
      {
        "event_name": "decisioning.v2.ran",
        "is_enabled": true,
        "filter": {}
      }
    ]
  }'
Header / fieldMeaning
config.endpoint_urlDestination callback URL Decionis will POST to.
credentials.webhook_secretOptional shared secret used to compute x-decionis-signature.
Authorization: Bearer <token>Sent only when access_token or api_token credentials are stored.
x-decionis-signatureHMAC SHA-256 signature over the outbound request body when webhook_secret is configured.

Authority events

Beside decisioning.v2.ran, an organisation's subscribers can name the events of execution authority: an enforced intent held for a person, what became of it, and a Decionis-managed Presence ceremony's lifecycle. Delivery never affects a decision, and no event carries a credential, a token, a receipt or an attestation.

EventWhenPayload
authority.escalation_requiredenforce-and-bind returns ESCALATE in ENFORCEMENT, direct or managed.tenant_id, intent_id, intent_hash, expires_at, decision_id, dossier_id, reason_codes, authority_requirement (the issued Presence requirement's id and selector, or null), selector and verification (the policy's: kind and role, provider, methods, level), escalation_id when managed, and the action with its parameters.
authority.escalation_resolvedA held intent is presented again with evidence.humanApproval, whatever the answer.The same identity fields; outcome (ALLOW, BLOCK, ESCALATE, REVIEW_REQUIRED, ERROR, or REFUSED when the proof was turned away before any evaluation); reason_codes; evidence (kind presence or attestation, and the verified proof's facts: provider, method, approver_role, attestation_id, key_id, request_id, approved_at); the action's type and resource.
managed_escalation.*Each transition of a Decionis-managed Presence escalation.created, presence_requested, awaiting_approver, presence_verified, presence_rejected, reauthorizing, grant_issued, blocked, cancelled, expired, failed: org_id, intent_id, intent_hash, escalation_id, evaluation_id, presence_request_id, status, expires_at.
Deduplication

Each event is keyed so a replay of the same intent, the same decision or the same refusal code lands once in the outbox. A different answer to the same intent is a new event.

Ingress endpoint

Each signal connector receives its own ingress URL.

POST/v1/signals/webhooks/:connectorIdWebhook secret

Receive normalized provider events for a provisioned connector.

curl -X POST https://api.decionis.com/v1/signals/webhooks/<connector_id> \
  -H "Content-Type: application/json" \
  -H "x-webhook-secret: whsec_xxx" \
  -d '{
    "events": [
      {
        "type": "eligibility_assessed",
        "timestamp": "2026-03-11T10:30:00Z",
        "data": {
          "case_id": "case_123",
          "outcome": "CONDITIONAL",
          "risk_score": 0.28,
          "channel": "study_abroad"
        }
      }
    ]
  }'

Retries

Treat both inbound ingress and outbound callback delivery as at-least-once and design idempotent replay handling.

ConditionExpected provider behavior
2xx responseTreat the delivery as accepted.
4xx responseDo not blind retry. Fix the payload or credentials first.
5xx or timeoutRetry with backoff and preserve the original event identifiers.
Replay after uncertaintyResend safely using idempotent event identifiers in the payload.