API documentation

Webhooks

Decionis uses webhooks in two directions: inbound signal ingress for live provider events, and outbound WEBHOOK callbacks for governed decision delivery into partner systems.

Overview

Webhook ingress is part of the standard API contract for production onboarding.

Two webhook surfaces

If a provider is sending live events into Decionis today, it should post those events to a Decionis-issued ingress webhook after sample validation and deployment-bundle issuance. If the provider also wants Decionis to push governed decisions back, configure the first-class WEBHOOK integration provider with a callback URL and optional signing secret.

Issuance

Ingress credentials are issued through the signal-mapping onboarding flow. Outbound callbacks are configured from the workspace or the org integrations API.

POST/v1/public/pilot/signal-mapping/sessions/:sessionId/deployment-bundleOnboarding grant or org API key

Return the connector ID, webhook URL, webhook secret, org ID, API key, and policy version in one onboarding step.

curl -X POST https://api.decionis.com/v1/public/pilot/signal-mapping/sessions/<session_id>/deployment-bundle \
  -H "Authorization: Bearer <onboarding_or_org_key>" \
  -H "Content-Type: application/json" \
  -d '{"provider_key":"partner_webhook","workflow_key":"decision_intake","source_label":"primary_stream"}'

Inbound contract

Normalizing providers into the same ingress shape keeps onboarding productized and self-serve.

Field	Requirement
events	Array of one or more normalized provider events.
events[].type	Required event type emitted by the provider.
events[].timestamp	Required provider event timestamp in ISO-8601 UTC.
events[].data	Required event payload object containing mapped business fields.
x-webhook-secret	Required shared secret header unless a signed variant is explicitly issued.

Outbound decision callbacks

Use the first-class WEBHOOK provider when Decionis should push governed decisions into a partner or internal receiver.

POST/v1/orgs/:orgId/integrations/WEBHOOK/connectAPI key

Create or update a callback destination that receives Decionis event deliveries.

curl -X POST https://api.decionis.com/v1/orgs/<org_id>/integrations/WEBHOOK/connect \
  -H "Authorization: Bearer dcy_org_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "config": {
      "endpoint_url": "https://partner.example.com/decionis/webhook",
      "provider_name": "partner-webhook",
      "workflow_id": "decision_intake"
    },
    "credentials": {
      "webhook_secret": "whsec_partner_xxx"
    },
    "subscriptions": [
      {
        "event_name": "decisioning.v2.ran",
        "is_enabled": true,
        "filter": {}
      }
    ]
  }'

Header / field	Meaning
config.endpoint_url	Destination callback URL Decionis will POST to.
credentials.webhook_secret	Optional shared secret used to compute x-decionis-signature.
Authorization: Bearer <token>	Sent only when access_token or api_token credentials are stored.
x-decionis-signature	HMAC SHA-256 signature over the outbound request body when webhook_secret is configured.

Ingress endpoint

Each signal connector receives its own ingress URL.

POST/v1/signals/webhooks/:connectorIdWebhook secret

Receive normalized provider events for a provisioned connector.

curl -X POST https://api.decionis.com/v1/signals/webhooks/<connector_id> \
  -H "Content-Type: application/json" \
  -H "x-webhook-secret: whsec_xxx" \
  -d '{
    "events": [
      {
        "type": "eligibility_assessed",
        "timestamp": "2026-03-11T10:30:00Z",
        "data": {
          "case_id": "case_123",
          "outcome": "CONDITIONAL",
          "risk_score": 0.28,
          "channel": "study_abroad"
        }
      }
    ]
  }'

Retries

Treat both inbound ingress and outbound callback delivery as at-least-once and design idempotent replay handling.

Condition	Expected provider behavior
2xx response	Treat the delivery as accepted.
4xx response	Do not blind retry. Fix the payload or credentials first.
5xx or timeout	Retry with backoff and preserve the original event identifiers.
Replay after uncertainty	Resend safely using idempotent event identifiers in the payload.

Loading…

Decionis API Reference

Base URL: https://api.decionis.com/v1

Quickstart Main site Contact