Webhook Events & Payloads – Propelus Data Solutions

Propelus sends various event notifications triggered by license verifications, batch completions, and monitoring checks. Each message includes event type, timestamp, status, input details, and results. Security options for webhook endpoints include API key validation and HMAC-SHA256 signature verification to ensure authenticity.

Available events

Event	When it fires
`licenseVerified` On-demand	A single license/certification check finished. Fires once per credential in a batch, whether found or not.
`licenseVerificationBatchFinished` On-demand	Every credential in a submitted batch has finished processing (`COMPLETED`, or `FAILED` if all failed).
`monitoredLicenseVerified` Monitoring	A monitored license was re-checked on its schedule (daily for automated items). Fires every check.
`monitoredLicenseVerifiedChanged` Monitoring	A monitored license’s latest result differs from the previous one — or it’s the first result.
`monitoredExclusionsCoreMatch` Monitoring	Input matched a sanctions/exclusions list during the monthly check. Only fires on a match.
`monitoredExclusionsCoreChanged` Monitoring	A person’s stored Exclusions Monitoring data was updated, prompting a re-verification.
`automationStatusChanged`	A board’s automation status changed — `AUTOMATED`, `MANUAL`, or `INTERRUPTED`.
`monitoredAdverseEssentialsMatch` Monitoring	Input matched an exclusion list during the monthly AdverseCheck Essentials check. Only on a match.
`monitoredAdverseProMatch` Monitoring	Input matched an exclusion/sanctions list during the monthly AdverseCheck Pro check. Only on a match.
`monitoredAdverseEssentialsChanged` Monitoring	A person’s stored AdverseCheck Essentials data was updated.
`monitoredAdverseProChanged` Monitoring	A person’s stored AdverseCheck Pro data was updated.
`monitoredAdverseEssentialsChecked` Monitoring	A scheduled AdverseCheck Essentials check ran. Sent regardless of result.
`monitoredAdverseProChecked` Monitoring	A scheduled AdverseCheck Pro check ran. Sent regardless of result.

What every message looks like

All events share the same envelope. The detail object carries the outcome; result holds the event-specific data.

{
  "eventType": "<event-type>",
  "timestamp": "<ISO-8601 datetime>",
  "detail": {
    "code": "<status-code>",
    "message": "<status-message>",
    "batchId": "<batch-uuid>",
    "input": { /* the details you submitted */ },
    "status": "<COMPLETED | FAILED>",
    "isFound": true,
    "customProperties": { /* your own values, echoed back */ },
    "result": { /* event-specific result */ }
  }
}

Field	Required	What it tells you
eventType	Yes	Which event this is.
timestamp	Yes	When it happened (ISO-8601).
code	Yes	Outcome code — e.g. `found`, `not_found`.
message	Yes	Human-readable outcome.
batchId	No	The batch this result belongs to.
input	Yes	The original details you submitted.
status	Yes	`COMPLETED` or `FAILED`.
isFound	Yes	Whether a record was found (`true`/`false`/`null`).
customProperties	No	Your own key/values, echoed straight back.
result	Yes	The event-specific result (or `null` on failure).

Example: a credential verification

Found — the license verified successfully:

{
  "eventType": "licenseVerified",
  "timestamp": "2026-02-04T16:28:54Z",
  "detail": {
    "code": "found",
    "message": "THE LICENSE WAS VERIFIED",
    "input": { "stateCode": "FL", "licenseNumber": "908398", "professionCode": "PRFA" },
    "status": "COMPLETED",
    "isFound": true,
    "result": { "type": "FOUND", "isFound": true }
  }
}

Not found — the check ran, but no matching record:

{
  "eventType": "licenseVerified",
  "detail": {
    "code": "not_found",
    "message": "THE LICENSE WAS NOT FOUND",
    "input": { "stateCode": "FL", "licenseNumber": "908398", "professionCode": "PRFZ" },
    "status": "COMPLETED",
    "isFound": false,
    "result": { "type": "NOT_FOUND", "isFound": false }
  }
}

Securing your endpoint

Because Propelus calls a public URL, you can require proof that a request truly came from us. Two methods, usable together:

Method	How it works
API key	You set an `authentication` value when creating the webhook. Propelus then sends it on every callback as an `x-api-key` header — your server checks it matches.
Signature	You set a `signature` key. Propelus signs each payload with HMAC-SHA256 and sends an `x-propelus-signature` header you can recompute and compare.

The signature formula

Your server recomputes HMAC-SHA256(key, requestBody + "." + clientId) as base64 and confirms it matches the header. If it doesn’t, reject the request.

Where to go next

For additional features and technical information, see W ebhooks: Additional Features