Implement Veriff identity verification sessions with decision and event webhooks

Steps

1. Create a verification session by POSTing to https://stationapi.veriff.com/v1/sessions with your x-auth-client API key header and a body containing the person's name, callback URL, and a unique vendorData identifier.
2. Redirect the user to the verification URL returned in the session response; the user completes document capture and selfie on Veriff's hosted interface.
3. Configure two webhook types in the Veriff environment settings: the event webhook (receives session lifecycle events from started to submitted) and the decision webhook (receives the final approved/declined/resubmission_requested outcome with extracted data).
4. On receipt of a webhook, verify authenticity by computing HMAC-SHA256 of the raw request body using your webhook shared secret and comparing it to the x-hmac-signature header.
5. Retrieve full session details via GET /v1/sessions/{sessionId}/decision using the session ID from the original session creation response if webhook delivery fails.
6. Map the decision codes — approved, declined, and the specific reason codes within declined — to your onboarding policy to determine next steps.