Webhooks

You can configure webhooks for 1-Click Health: see here in the Setup guide. This allows you to receive 1-Click Health output data asynchronously. (You can alternatively poll the GET /1-click/health endpoint.)

Method	POST
URL	Defined by webhooks brand setting
Authentication	Defined by webhooks brand setting (None, API Key, or Basic Auth)
Retries	After 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, and 12 hours (in total, about 22 hours from first attempt)
Expected response	Respond with a 2xx status (for example 200) to acknowledge receipt; a timeout or response with any other status is treated as a failed delivery and triggers a retry
Delivery	At least once (multiple deliveries possible)
Retention	After final retry, undelivered event is moved to dead-letter queue (DLQ) and retained there for 14 days

Headers

Each webhook request includes the following headers:

Header	Value	Notes
Content-Type	application/json	The payload is always sent as JSON.
User-Agent	VerifiedInc-Webhook/1.0	Identifies the request as coming from Verified.
X-Webhook-Timestamp	Timestamp used to sign the request	Use this exact value when verifying the webhook signature.
X-Webhook-Signature	v1=...	HMAC-SHA256 signature of the timestamp and raw request body.

Any authentication headers you configure in your webhooks brand setting (API Key or Basic Auth) are also included.

Signatures

When you define a webhook in the webhooks brand setting, or rotate the secret of an existing webhook, we display a new signing secret but only once: store it securely.

Verify each webhook using the signing secret for your webhook:

1. Read the raw request body before parsing JSON, and read X-Webhook-Timestamp from the request headers.

2. Compute the expected signature from the secret, timestamp, and raw body, then compare it with the v1 value in X-Webhook-Signature using a constant-time comparison:

   v1=HMAC-SHA256(secret, `${timestamp}.${rawBody}`)

3. Reject requests with a timestamp outside your allowed freshness window to reduce replay risk.

note

For 24 hours after rotation, we sign requests with both the previous and new secret. During this overlap, accept a valid signature from either secret.

Payload

GET /1-click/health Response Body

{
    event: "1-click.health.lookup",
    healthDataUuid: string,
    externalReference?: string,
    sentAt: integer,
    ...1ClickHealthEntity
}

Property	Type	Format	Description	Example
event	string	-	Response from the 1-Click Health lookup	"1-click.health.lookup"
healthDataUuid	string	Version 4 UUID	Unique identifier for the 1ClickHealthEntity that will be returned at the end of the 1-Click Health flow	"9e12fe5b-5bb8-410a-ac6b-6e053e4c7e8d"
externalReference	string	1–256 characters	Optional customer identifier echoed unchanged from the POST /1-click/health request; not a lookup key	"appointment-1042"
sentAt	integer	Unix time (milliseconds)	When the payload was sent	1760053705000
...	1ClickHealthEntity	See 1ClickHealthEntity	1ClickHealthEntity for the 1-Click Health flow	See 1ClickHealthEntity

Webhook payloads are delivered at least once. The same event may be delivered more than once, including during retries, so deduplicate using healthDataUuid as the idempotency key. The externalReference is for correlating the result with your own record: it can't be used to retrieve the result.

Webhooks for 1-Click Signup are Coming Soon!

We don't yet support webhooks for 1-Click Signup, but those are coming soon. If you'd like to be notified when they're available, please email us at Support@Verified.inc.