KYC webhooks

Every time the status of one of your investors changes, Securitize sends one POST with the event investor.kyc.updated to your account’s webhook endpoint. You receive it for every investor of your account.

KYC webhooks are available in sandbox. Ask your Securitize contact for production.

POST https://your.endpoint.invalid/securitize/webhooks
content-type: application/json
svix-id: msg_3KxqA7cTfW2mR9pLzN4vB8hJ6dE
svix-timestamp: 1792510174
svix-signature: v1,Q2l4bWh0dFJ2Nk1vZ3FzWlB5dUVhS3NUcjlXbGN4Rk0=

{
  "schemaVersion": "1.0",
  "sourceEventId": "kyc_5b1e0c9a7d3f42e8b6a1c4d2e9f07a3b",
  "eventType": "investor.kyc.updated",
  "occurredAt": "2026-10-20T15:29:34.698Z",
  "data": {
    "investorId": "6ace745fab21fd6924a19beb",
    "externalInvestorId": "your-investor-0001",
    "status": "processing"
  }
}

data.investorId is the investorId the create returned, and data.externalInvestorId your own id: look the investor up by either. data.status is the new status. Every field is in the API reference.

Webhooks

How every Securitize webhook is delivered: the headers, verifying the signature, acknowledging within 10 seconds, retries and your endpoint. Start there, then come back for what is specific to KYC.

Apply it

Delivery is at least once and can be out of order: retries repeat an event, and two quick status changes can arrive in either order.

Rule	Why
Deduplicate on `sourceEventId`	A retry carries the same id; every status change gets a new one. Store the ids you have applied and skip a repeat
Keep the latest by `occurredAt` per investor	An event older than the status you hold is a late delivery: ignore it
Read the status before you act on it	Before granting access or telling the investor the outcome, confirm with `GET /investors/{investorId}`: it always answers the current status

Past KYC webhooks stay readable for 90 days and failed deliveries can be resent, through the webhook events routes shared by every API (Replay and recover; ask your Securitize contact to enable them for your account). Keep the poller running at a low cadence as a safety net: with webhooks, it only has to catch what a webhook missed.

Get started

Guides

Concepts

Help

API reference

Webhooks

Apply it