# Certification webhook callback

Sent to the webhook_url when certification processing finishes (success or failure).
Follows the [Standard Webhooks](https://www.standardwebhooks.com) specification.
The payload uses a standard envelope with type, timestamp and data fields.
Every callback is signed with HMAC-SHA256 via the webhook-id, webhook-timestamp, and webhook-signature headers.
**Authentication:** this is a server-to-client callback, authenticity is verified via the `webhook-signature` header using a dedicated signing secret (`whsec_`-prefixed).

Endpoint: POST certificationCallback
Version: 1.5.0
Security: ApiKeyAuth

## Header parameters:

  - `webhook-id` (string, required)
    Unique event identifier (idempotency key)

  - `webhook-timestamp` (integer, required)
    Unix timestamp (seconds since epoch) of the delivery attempt

  - `webhook-signature` (string, required)
    Space-delimited HMAC-SHA256 signatures in format v1,{base64}

## Request fields (application/json):

  - `type` (string, required)
    Event type: certification.completed or certification.error
    Enum: "certification.completed", "certification.error"

  - `timestamp` (string, required)
    ISO 8601 timestamp of when the event occurred

  - `data` (object, required)
    Event payload: CertificationsGetByReportIdResponse on success, ErrorResponseRfc on failure