Webhooks events and payloads

Read more about webhooks in spektr here.

All webhook events are sent in batches of the following shape:

{
  "results": [
    { "eventType": "process_run_start", "data": {} }
  ]
}

In the above representation, the results array contains individual events as described below.

Webhook	Description
process_run_start	A process starts running.
loop_run_start	A loop starts running. Data also includes execution fields and configured loop settings.
process_run_end	A process reaches an outcome. Data includes customer and execution fields alongside the process result.
process_expired	A process link expires.
service_run	A service response is received. vendorSearchId identifies the raw vendor response available through the record API.
alert_escalated	An alert is escalated.
alert_resolved	An alert is resolved.
customer_tag_add	A tag is added to a customer.
customer_tag_remove	A tag is removed from a customer.
customer_status_change (deprecated)	Legacy status change event. Use customer_status_changed for new integrations.
customer_status_changed	A customer status changes through a process, a user, or the API.
customer_duplicate_detection	A duplicate customer is detected.
customer_record_changed	Customer record fields change. JSON array values are delivered as arrays.
ownership_ai_created	A customer is created by AI ownership discovery.
ownership_ai_added_owner	AI discovery adds an owner to the connection graph.
client_record_sync	An imported customer is synchronized through a connector.
step_init	A form step is initialized.
step_submit	A form step is submitted. Data can include submitted field values.
behavior_signal_raised	A behavior signal is published after ingest. One event per reconciled transaction.
signal_claimed	An analyst claims a case with a linked RAI behavior signal.
signal_resolved	An analyst resolves a case with a linked RAI behavior signal.
external_data_waiting	An External Data step is waiting for your integration to supply data.
external_data_received	An External Data step receives and accepts data.
external_data_timed_out	An External Data step times out before receiving data.

Common fields

Every event in a batch carries these fields. The sections below document the event-specific fields.

Name	Type	Description
id	string	Unique event ID. Use it to deduplicate deliveries.
workspaceId	string	Workspace that emitted the event.
eventType	string	Type of event, for example process_run_start. Each section below documents one event type.
timestamp	number	Event creation time: Unix epoch milliseconds. HMAC header timestamps use seconds.
spektrId	string \| undefined	Customer related to this event, when present.
source	object \| undefined	Origin of the event, when known.
source.sourceType	string	Origin: spektr_process, external, manual, or unknown.
source.processId	string \| undefined	ID of the originating process when sourceType is spektr_process.
source.userId	string \| undefined	ID of the user who triggered a manual event, when available.
source.userName	string \| undefined	Name of the user who triggered a manual event, when available.
source.userEmail	string \| undefined	Email of the user who triggered a manual event, when available.
additionalFields	object \| undefined	Customer fields selected in the matching delivery setting, when available.

process_run_start

A process starts running.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "process_run_start",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "token": "example-process-token",
    "parentProcessId": "686660b573833dea357e86f0",
    "parentSpektrId": "parent-customer-123",
    "method": {
      "type": "process",
      "processId": "686660b573833dea357e86f0"
    }
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.token	string \| undefined	Optional token associated with this process run.
data.method	object \| undefined	How the run was started, when known. The type selects the applicable metadata: process (processId), user (userId), or api.
data.method.type	string	Method that triggered the action; see the method object for the supported variants.
data.method.processId	string \| undefined	ID of the process that triggered the action, present when type is process.
data.method.userId	string \| undefined	ID of the user that triggered the action, present when type is user.
data.parentProcessId	string \| undefined	Optional ID of the parent process, present when another process triggered the process issuing this event.
data.parentSpektrId	string \| undefined	Optional ID of the parent customer, present when another process triggers this process through a linked UBO block.

loop_run_start

A loop starts running. Data also includes execution fields and configured loop settings.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "loop_run_start",
  "timestamp": 1788278400000,
  "data": {
    "processType": "loop",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "token": "example-process-token",
    "parentProcessId": "686660b573833dea357e86f0",
    "parentSpektrId": "parent-customer-123",
    "method": {
      "type": "process",
      "processId": "686660b573833dea357e86f0"
    },
    "company_name": "Example Ltd",
    "loopHeader": "Complete your details",
    "loopMessage": "Please review and update your company details.",
    "loopUrl": "https://actions.spektr.com/form?token=example-process-token"
  }
}

Name	Type	Description
data	object	Event-specific payload. Also includes customer and execution fields, such as company_name, alongside the attributes below.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.token	string \| undefined	Optional token associated with this process run.
data.method	object \| undefined	How the run was started, when known. The type selects the applicable metadata: process (processId), user (userId), or api.
data.method.type	string	Method that triggered the action; see the method object for the supported variants.
data.method.processId	string \| undefined	ID of the process that triggered the action, present when type is process.
data.method.userId	string \| undefined	ID of the user that triggered the action, present when type is user.
data.parentProcessId	string \| undefined	Optional ID of the parent process, present when another process triggered the process issuing this event.
data.parentSpektrId	string \| undefined	Optional ID of the parent customer, present when another process triggers this process through a linked UBO block.
data.loopHeader	string \| undefined	Header configured in the loop settings.
data.loopMessage	string \| undefined	Message configured in the loop settings.
data.loopUrl	string \| undefined	URL for filling in the loop form.

process_run_end

A process reaches an outcome. Data includes customer and execution fields alongside the process result.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "process_run_end",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "processOutput": "approved",
    "customerStatus": "approved",
    "score": 0,
    "risk_class": "low",
    "tags": [
      {
        "color": "rgba(0,128,0,1)",
        "label": "Reviewed"
      },
      {
        "color": "rgba(255,0,0,1)",
        "label": "Requires monitoring",
        "icon": "Siren"
      }
    ],
    "company_name": "Example Ltd",
    "company_number": "12345678",
    "country_of_incorporation": "GB"
  },
  "fields": {
    "groups": [
      {
        "group_id": "686660b573833dea357e8710",
        "fields": [
          "company_name",
          "company_number",
          "country_of_incorporation"
        ]
      }
    ]
  }
}

Name	Type	Description
data	object	Event-specific payload. Also includes customer and execution fields, such as company_name, alongside the attributes below.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.score	number \| undefined	Score calculated for the process run; may be 0.
data.risk_class	string \| undefined	Risk classification associated with the run, for example low.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.tags	object[] \| undefined	Tags associated with the customer or process result. An empty array means there are no tags in the result.
data.tags[].color	string	Color of the tag, for example rgba(255,0,0,1).
data.tags[].label	string	Display label of the tag, for example Requires monitoring.
data.tags[].icon	string \| undefined	Optional icon name for the tag, for example Siren.
data.processOutput	string \| undefined	Outcome reached by the process, for example approved or unknown.
data.customerStatus	string \| undefined	Customer status after the process result: pending, approved, rejected, or archived.
fields	object \| undefined	Workspace field groups present in the process result.
fields.groups	object[]	Workspace groups containing fields included in this result.
fields.groups[].group_id	string	ID of the workspace field group.
fields.groups[].fields	string[]	Keys of the fields belonging to this group that are present in data.

process_expired

A process link expires.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "process_expired",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "linkExpiredAt": 1788278400000,
    "expiredAt": 1788278400000
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.processName	string \| undefined	Name of the process.
data.linkExpiredAt	number	Configured process-link expiry time, in Unix epoch milliseconds.
data.expiredAt	number	Time the process was marked expired, in Unix epoch milliseconds.

service_run

A service response is received. vendorSearchId identifies the raw vendor response available through the record API.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "service_run",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "complyAdvantageKyc",
    "stepId": "686660b873833dea357e8702",
    "vendorType": "complyAdvantageKyc",
    "vendorSearchId": "6867b8db50ffa326d667ac61",
    "vendorData": {
      "complyAdvantageKyc_has_sanctions": false,
      "complyAdvantageKyc_is_PEP": false,
      "complyAdvantageKyc_has_adverse_media": false
    }
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.stepType	string	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string	ID of the step associated with the event.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.stepTitle	string \| undefined	Display title of the step, when configured.
data.vendorSearchId	string \| undefined	ID of the vendor call. Use it to retrieve the raw vendor response through the record API.
data.vendorType	string \| undefined	Type of service called, for example complyAdvantageKyc.
data.vendorData	object \| undefined	Fields mapped from the service response. Field names depend on the vendor and workspace configuration.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.

alert_escalated

An alert is escalated.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "alert_escalated",
  "timestamp": 1788278400000,
  "data": {
    "contextId": "6867b8db50ffa326d667ac60",
    "processId": "686660b573833dea357e86f6",
    "alertId": "alert-123",
    "alertName": "Review required",
    "alertType": "manual_review",
    "reference": "customer-123",
    "datasetId": "dataset-123",
    "status": "open"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.alertId	string	ID of the alert.
data.alertName	string \| undefined	Display name of the alert.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.alertType	string \| undefined	Type of alert, for example manual_review.
data.workspaceId	string \| undefined	Same value as the top-level workspaceId.
data.spektrId	string \| undefined	Same value as the top-level spektrId, when present.
data.datasetId	string \| undefined	ID of the dataset containing the customer associated with the alert.
data.status	string \| undefined	Status of the alert, for example open.

alert_resolved

An alert is resolved.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "alert_resolved",
  "timestamp": 1788278400000,
  "data": {
    "contextId": "6867b8db50ffa326d667ac60",
    "processId": "686660b573833dea357e86f6",
    "alertId": "alert-123",
    "alertName": "Review required",
    "alertType": "manual_review",
    "reference": "customer-123",
    "selectedAction": "accept"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.alertId	string	ID of the alert.
data.alertName	string \| undefined	Display name of the alert.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.alertType	string \| undefined	Type of alert, for example manual_review.
data.selectedAction	string \| undefined	Action selected when resolving the alert, when available.

customer_tag_add

A tag is added to a customer.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_tag_add",
  "timestamp": 1788278400000,
  "data": {
    "action": "add",
    "tag": {
      "color": "rgba(255,0,0,1)",
      "label": "Requires monitoring",
      "icon": "Siren"
    },
    "tagName": "Requires monitoring",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.tag	object \| undefined	Tag added to or removed from the customer, when available.
data.tag.color	string	Color of the tag, for example rgba(255,0,0,1).
data.tag.label	string	Display label of the tag, for example Requires monitoring.
data.tag.icon	string \| undefined	Optional icon name for the tag, for example Siren.
data.tagName	string \| undefined	Name of the tag, when available.
data.contextId	string \| undefined	ID of the process run (execution context).
data.processId	string \| undefined	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.token	string \| undefined	Optional token associated with this process run.
data.action	string	Tag action: add or remove.

customer_tag_remove

A tag is removed from a customer.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_tag_remove",
  "timestamp": 1788278400000,
  "data": {
    "action": "remove",
    "tag": {
      "color": "rgba(255,0,0,1)",
      "label": "Requires monitoring",
      "icon": "Siren"
    },
    "tagName": "Requires monitoring",
    "reference": "customer-123"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.tag	object \| undefined	Tag added to or removed from the customer, when available.
data.tag.color	string	Color of the tag, for example rgba(255,0,0,1).
data.tag.label	string	Display label of the tag, for example Requires monitoring.
data.tag.icon	string \| undefined	Optional icon name for the tag, for example Siren.
data.tagName	string \| undefined	Name of the tag, when available.
data.contextId	string \| undefined	ID of the process run (execution context).
data.processId	string \| undefined	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.token	string \| undefined	Optional token associated with this process run.
data.action	string	Tag action: add or remove.

customer_status_change

Deprecated. Legacy status change event. Use customer_status_changed for new integrations.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_status_change",
  "timestamp": 1788278400000,
  "data": {
    "oldStatus": "pending",
    "newStatus": "approved",
    "customerName": "Example Ltd",
    "processId": "686660b573833dea357e86f6",
    "processName": "Customer onboarding",
    "reference": "customer-123"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.oldStatus	string \| undefined	Customer status before the change, when available: pending, approved, rejected, or archived.
data.newStatus	string	Customer status after the change: pending, approved, rejected, or archived.
data.customerName	string	Name of the customer (individual or company).
data.processId	string \| undefined	ID of the process associated with this event.
data.processName	string \| undefined	Name of the process.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.

customer_status_changed

A customer status changes through a process, a user, or the API.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_status_changed",
  "timestamp": 1788278400000,
  "data": {
    "oldStatus": "pending",
    "newStatus": "approved",
    "method": {
      "type": "process",
      "processId": "686660b573833dea357e86f6"
    },
    "reference": "customer-123"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.oldStatus	string \| undefined	Customer status before the change, when available: pending, approved, rejected, or archived.
data.newStatus	string	Customer status after the change: pending, approved, rejected, or archived.
data.method	object	How the status change was triggered. The type selects the applicable metadata: process (processId), user (userId), or api.
data.method.type	string	Method that triggered the action; see the method object for the supported variants.
data.method.processId	string \| undefined	ID of the process that triggered the action, present when type is process.
data.method.userId	string \| undefined	ID of the user that triggered the action, present when type is user.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.

customer_duplicate_detection

A duplicate customer is detected.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_duplicate_detection",
  "timestamp": 1788278400000,
  "data": {
    "contextId": "6867b8db50ffa326d667ac60",
    "processId": "686660b573833dea357e86f6",
    "customerDuplicateData": {
      "newRecordId": "customer-123",
      "oldRecordId": "customer-456"
    }
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.customerDuplicateData	object	Identifiers of the duplicate and original customer records.
data.customerDuplicateData.newRecordId	string \| undefined	spektrId of the new customer record, when available.
data.customerDuplicateData.oldRecordId	string \| undefined	spektrId of the existing customer record, when available.

customer_record_changed

Customer record fields change. JSON array values are delivered as arrays.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "customer_record_changed",
  "timestamp": 1788278400000,
  "data": {
    "reference": "customer-123",
    "method": {
      "type": "api"
    },
    "changes": [
      {
        "fieldId": "company_name",
        "oldValue": "Example",
        "newValue": "Example Ltd"
      }
    ]
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.method	object \| undefined	How the change was triggered. The type selects the applicable metadata: process (processId, processType), user (userId), vendor (vendorName), or api.
data.method.type	string	Method that triggered the action; see the method object for the supported variants.
data.method.processId	string \| undefined	ID of the process that triggered the action, present when type is process.
data.method.processType	string \| undefined	Type of the triggering process, when available.
data.method.userId	string \| undefined	ID of the user that triggered the action, present when type is user.
data.method.vendorName	string \| undefined	Name of the connector that triggered the change, present when type is vendor.
data.changes	object[] \| undefined	List of customer fields that changed.
data.changes[].fieldId	string	ID of the field that changed.
data.changes[].oldValue	any \| undefined	Previous field value, omitted when no previous value is available.
data.changes[].newValue	any \| undefined	Updated field value, omitted when no new value is available. JSON array values are delivered as arrays.

ownership_ai_created

A customer is created by AI ownership discovery.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "ownership_ai_created",
  "timestamp": 1788278400000,
  "data": {
    "parentId": "customer-123"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.parentId	string	spektrId of the parent customer in the ownership graph.

ownership_ai_added_owner

AI discovery adds an owner to the connection graph.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "ownership_ai_added_owner",
  "timestamp": 1788278400000,
  "data": {
    "childId": "customer-456"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.childId	string	spektrId of the child customer discovered by AI.

client_record_sync

An imported customer is synchronized through a connector.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "client_record_sync",
  "timestamp": 1788278400000,
  "data": {
    "lastSyncedAt": 1788278400000,
    "vendor": "hubspot",
    "objectType": "hubspot companies"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.lastSyncedAt	number	Time the customer was synchronized, in Unix epoch milliseconds.
data.vendor	string	Connector used to synchronize the customer, for example hubspot.
data.objectType	string \| undefined	Customer object type in the connector: hubspot companies or hubspot contacts.

step_init

A form step is initialized.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "step_init",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "form",
    "stepId": "686660b873833dea357e8702",
    "token": "example-process-token"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.processId	string	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.contextId	string	ID of the process run (execution context).
data.stepType	string \| undefined	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string \| undefined	ID of the step associated with the event.
data.token	string \| undefined	Optional token associated with this process run.

step_submit

A form step is submitted. Data can include submitted field values.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "step_submit",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "form",
    "stepId": "686660b873833dea357e8702",
    "token": "example-process-token",
    "company_name": "Example Ltd"
  }
}

Name	Type	Description
data	object	Event-specific payload. Also includes the submitted field values, such as company_name, alongside the attributes below.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.processId	string	ID of the process associated with this event.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.contextId	string	ID of the process run (execution context).
data.stepType	string \| undefined	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string \| undefined	ID of the step associated with the event.
data.token	string \| undefined	Optional token associated with this process run.

behavior_signal_raised

A behavior signal is published after ingest. One event per reconciled transaction.

{
  "id": "507f1f77bcf86cd799439011",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "behavior_signal_raised",
  "timestamp": 1788278400000,
  "data": {
    "source": "rai",
    "sourceVendor": "rai",
    "externalId": "rai_alert_01801291b5de61db",
    "externalUpdateId": "rai_upd_20260115_001",
    "externalCaseId": "rai_case_77a057f8d708ab7f",
    "detectorName": "aml_split_merge_fragmentation",
    "category": "aml",
    "priority": "HIGH",
    "priorityReasons": [
      "Unusual pattern detected",
      "High-risk jurisdiction"
    ],
    "title": "Split & merge fragmentation",
    "summary": "Suspicious money flow detected across multiple accounts.",
    "externalTransactionIds": [
      "txn_sepa_1042",
      "txn_sepa_1043"
    ],
    "externalMainEntity": {
      "value": "cust_acme_gmbh",
      "type": "customer_id"
    },
    "raisedAt": 1788278400000,
    "payload": {
      "alert_id": "01801291-b5de-61db-481f-f7db038616a8"
    },
    "signalId": "507f1f77bcf86cd799439099",
    "transactionId": "507f1f77bcf86cd799439088",
    "customerId": "customer-123"
  }
}

Name	Type	Description
data	object	Published behavior signal.
data.source	string	Source system that raised the signal, for example rai. Unrelated to the top-level source, which describes where the event came from.
data.sourceVendor	string \| undefined	The vendor that produced the signal.
data.externalId	string	ID of the signal in the source system.
data.externalUpdateId	string \| undefined	ID of the source-system update that produced this event, when present.
data.externalCaseId	string \| undefined	External case identifier from the source system.
data.detectorName	string	Name of the detection rule or model that raised the signal.
data.category	string \| undefined	Category of the signal.
data.priority	string	Priority level of the signal.
data.priorityReasons	string[]	Reasons supporting the assigned priority.
data.title	string	Short title describing the signal.
data.summary	string	Detailed summary of the signal.
data.externalTransactionIds	string[]	IDs of the source-system transactions the signal relates to.
data.externalMainEntity	object \| undefined	The main entity associated with this signal.
data.externalMainEntity.value	string	The entity identifier value.
data.externalMainEntity.type	string	The entity identifier type.
data.raisedAt	number	Unix timestamp (milliseconds) representing when the signal was raised.
data.payload	object	Arbitrary key/value payload from the source system.
data.signalId	string	spektr ID of the behavior signal, assigned at ingest.
data.transactionId	string	spektr ID of the transaction this event is bound to.
data.customerId	string \| undefined	spektr ID of the resolved customer record, when known.
data.existingCaseId	string \| undefined	ID of the existing case, when the signal was attached to a prior case.

signal_claimed

An analyst claims a case with a linked RAI behavior signal.

{
  "id": "686f58da3b9059f19eb2d066",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "signal_claimed",
  "timestamp": 1788278400000,
  "data": {
    "caseId": "67eba5f9ce9a594e4519cc88",
    "signalId": "67eba62500dd50ed396deb0c",
    "alertId": "rai_a3f7b41969f8b48e77a057f8d708ab7f",
    "externalCaseId": "rai_case_77a057f8d708ab7f",
    "feedbackEventId": "11111111-1111-4111-8111-111111111111",
    "analystId": "6610c91e8f2a4b12c3d4e5f6",
    "occurredAt": 1788278400000
  }
}

Name	Type	Description
data	object	Claim feedback for the linked behavior signal.
data.caseId	string	Case the analyst claimed.
data.signalId	string	spektr ID of the behavior signal this feedback refers to.
data.alertId	string	ID of the alert in the signal source.
data.externalCaseId	string \| undefined	ID of the case in the signal source, when present.
data.feedbackEventId	string	Idempotency key for this feedback delivery.
data.analystId	string	Stable analyst identifier. Analyst email is intentionally omitted.
data.occurredAt	number	Unix timestamp (milliseconds) when the claim occurred.

signal_resolved

An analyst resolves a case with a linked RAI behavior signal.

{
  "id": "686f58da3b9059f19eb2d067",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "signal_resolved",
  "timestamp": 1788278400000,
  "data": {
    "caseId": "67eba5f9ce9a594e4519cc88",
    "signalId": "67eba62500dd50ed396deb0c",
    "alertId": "rai_a3f7b41969f8b48e77a057f8d708ab7f",
    "externalCaseId": "rai_case_77a057f8d708ab7f",
    "feedbackEventId": "11111111-1111-4111-8111-111111111111",
    "analystId": "6610c91e8f2a4b12c3d4e5f6",
    "occurredAt": 1788278400000,
    "outcome": "closed_as_productive",
    "analystComment": "Confirmed suspicious flow, reported."
  }
}

Name	Type	Description
data	object	Resolution feedback for the linked behavior signal.
data.caseId	string	Case the analyst resolved.
data.signalId	string	spektr ID of the behavior signal this feedback refers to.
data.alertId	string	ID of the alert in the signal source.
data.externalCaseId	string \| undefined	ID of the case in the signal source, when present.
data.feedbackEventId	string	Idempotency key for this feedback delivery.
data.analystId	string	Stable analyst identifier. Analyst email is intentionally omitted.
data.occurredAt	number	Unix timestamp (milliseconds) when the resolution occurred.
data.outcome	string	Outcome selected for this signal when the case was resolved.
data.analystComment	string \| undefined	Optional closing comment from the analyst.

external_data_waiting

An External Data step is waiting for your integration to supply data.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "external_data_waiting",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "externalData",
    "stepId": "686660b873833dea357e8702",
    "expectedFields": [
      {
        "spektrDataField": "credit_score",
        "type": "number",
        "required": true
      }
    ],
    "expiresAt": 1788278400000
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.stepType	string	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string	ID of the step associated with the event.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.stepTitle	string \| undefined	Display title of the step, when configured.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.expectedFields	object[] \| undefined	Fields requested by the External Data step.
data.expectedFields[].spektrDataField	string	Key of the spektr data field to supply.
data.expectedFields[].type	string	Expected type of the field, for example number.
data.expectedFields[].required	boolean	Whether the field must be supplied to complete the step.
data.expiresAt	number \| undefined	Deadline for supplying external data, in Unix epoch milliseconds, when configured.

external_data_received

An External Data step receives and accepts data.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "external_data_received",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "externalData",
    "stepId": "686660b873833dea357e8702",
    "receivedFields": [
      "credit_score"
    ],
    "receivedData": {
      "credit_score": 720
    }
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.stepType	string	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string	ID of the step associated with the event.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.stepTitle	string \| undefined	Display title of the step, when configured.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.
data.receivedFields	string[] \| undefined	Keys of the external data fields received and accepted.
data.receivedData	object \| undefined	Accepted external data, keyed by spektr data field.

external_data_timed_out

An External Data step times out before receiving data.

{
  "id": "6867b8db50ffa326d667ac63",
  "workspaceId": "workspace-123",
  "spektrId": "customer-123",
  "eventType": "external_data_timed_out",
  "timestamp": 1788278400000,
  "data": {
    "processType": "onboarding",
    "processName": "Customer onboarding",
    "processId": "686660b573833dea357e86f6",
    "contextId": "6867b8db50ffa326d667ac60",
    "reference": "customer-123",
    "stepType": "externalData",
    "stepId": "686660b873833dea357e8702"
  }
}

Name	Type	Description
data	object	Event-specific payload.
data.stepType	string	Type of the step, for example form, ownershipTreeForm, complyAdvantageKyc, or externalData.
data.stepId	string	ID of the step associated with the event.
data.contextId	string	ID of the process run (execution context).
data.processId	string	ID of the process associated with this event.
data.processName	string	Name of the process.
data.processType	string	Type of process, for example risk, monitoring, onboarding, or loop.
data.stepTitle	string \| undefined	Display title of the step, when configured.
data.reference	string \| undefined	Optional reference associated with the customer or run. For onboarding, this can be passed through the reference query parameter.