Callbacks

When a verification request is created with a callback_url, VerifAge sends a POST to that address as soon as the customer approves or denies the request, or when it expires.

Payload

{
  "id": "01J9…",
  "external_reference": "order-10432",
  "status": "approved",
  "verified": true,
  "sent_at": "2026-10-22T10:15:00Z"
}

The callback carries the same fields as GET /api/v1/merchant/verify-requests/{id}: never a name, a birth date or any document data.

Verifying the sender

Each callback is signed. The header X-VerifAge-Signature holds an HMAC-SHA256 of the raw body computed with your API key's secret. Compute the same value on your side and compare in constant time before trusting the payload. Reject callbacks older than a few minutes by checking sent_at.

Delivery

• Respond with any 2xx status within 10 seconds.
• On a network error or a non-2xx answer VerifAge retries with an increasing delay for up to 24 hours.
• Deliveries are idempotent: the same id and status may arrive twice, so update the order rather than appending.

Testing

With a va_test_… key the request is approved immediately and the callback is sent right away, so a local tunnel is enough to see the full flow during development.