{
"schemaVersion": "1.0",
"sourceEventId": "suit_8c2f4a1e9b7d40c3a6e5f1b2d9c07e4a",
"eventType": "investor.suitability.updated",
"occurredAt": "2026-10-22T10:00:00.000Z",
"data": {
"investorId": "6ace745fab21fd6924a19beb",
"externalInvestorId": "your-investor-0001",
"verificationStatus": "verified"
}
}An investors suitability verdict changed
Sent every time the verificationStatus of one of your investors’ suitability changes, whoever changed it: Securitize’s compliance team, the investor, another partner or your own call. It carries the new verdict, the value GET /investors/{investorId}/suitability answers. Delivery is at least once and can be out of order: deduplicate on sourceEventId, keep the latest occurredAt per investor, and confirm with the GET before acting on a verdict. The suitability webhooks guide on the developer portal explains when it is sent.
{
"schemaVersion": "1.0",
"sourceEventId": "suit_8c2f4a1e9b7d40c3a6e5f1b2d9c07e4a",
"eventType": "investor.suitability.updated",
"occurredAt": "2026-10-22T10:00:00.000Z",
"data": {
"investorId": "6ace745fab21fd6924a19beb",
"externalInvestorId": "your-investor-0001",
"verificationStatus": "verified"
}
}Authorizations
OAuth 2.0 client credentials. Exchange the client id and secret Securitize issued you for a bearer token at the token URL (the host root, not under the base URL), with grant_type=client_credentials; the token lasts 2 hours and goes in the Authorization: Bearer header of every request. No scope is needed. The token identifies your partner account, so you never send a partner id, and every record you create is scoped to you.
Body
The body of a suitability webhook.
Response
Any 2xx within 10 seconds acknowledges the delivery. Anything else, or no answer, is retried with backoff for up to 72 hours.