Identity & Compliance

Identity and compliance webhooks tell your systems when the identity verification (KYC) status of a user or the business verification (KYB) status of a company changes during onboarding and ongoing review. Rain sends these events whenever an application status is updated, so you can track approvals, requests for more information, and account locks in real time. Both events are informational and do not require a response. The following events are available:

Event	Description
`user.updated`	A user’s identity verification (KYC) or application status changes.
`company.updated`	A company’s business verification (KYB) or application status changes.

Both events support an optional eventReceivedAt timestamp that records when Rain first received the status change. This helps with debugging timing issues and building audit trails. It is excluded from payloads by default. Contact your Rain account manager to enable it for your tenant.

The following sequence shows how a compliance decision moves from onboarding to your endpoint.

Webhook Rain sends youYour handler (ack 2xx)Action / API callCompliance provider

The user.updated payload carries statusChangeReason only when a reason is recorded. company.updated mirrors this flow for business entities (KYB).

`user.updated`

This webhook is sent whenever a user’s identity verification (KYC) or compliance status is updated. It applies to Consumer Programs. No response is required.

{
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "resource": "user",
    "action": "updated",
    "version": "1.0.0",
    "eventReceivedAt": "2026-01-27T15:30:00.000Z",
    "body": {
        "id": "user_abc123",
        "firstName": "John",
        "lastName": "Doe",
        "email": "john.doe@example.com",
        "isActive": true,
        "isTermsOfServiceAccepted": true,
        "companyId": "company_456",
        "applicationStatus": "approved",
        "applicationReason": ""
    }
}

{
    "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "resource": "user",
    "action": "updated",
    "version": "1.0.0",
    "eventReceivedAt": "2026-01-27T15:30:00.000Z",
    "body": {
        "id": "user_abc123",
        "firstName": "John",
        "lastName": "Doe",
        "email": "john.doe@example.com",
        "isActive": true,
        "isTermsOfServiceAccepted": true,
        "applicationStatus": "needsInformation",
        "applicationCompletionLink": {
            "url": "https://use-dev.rain.xyz/kyc",
            "params": {
                "userId": "user_abc123",
                "signature": "CiQAaHR0cHM6Ly9jbG91ZGttcy5nb29nbGVhcGlzLmNvbS92MRIvAD0rF3pKq2mXbYhV8sNzQwLmT4xR9cGvUu1kZpEo6NwsAaHlDdBrMvXjPk9fWq4="
            }
        },
        "applicationReason": "documentPageMissing, badPhotoQuality"
    }
}

{
    "id": "c3d4e5f6-a7b8-9012-cdef-a12345678902",
    "resource": "user",
    "action": "updated",
    "version": "1.1.0",
    "eventReceivedAt": "2026-01-27T15:30:00.000Z",
    "body": {
        "id": "user_abc123",
        "firstName": "John",
        "lastName": "Doe",
        "email": "john.doe@example.com",
        "isActive": true,
        "isTermsOfServiceAccepted": true,
        "applicationStatus": "locked",
        "applicationReason": "",
        "statusChangeReason": "rain_initiated"
    }
}

Field	Type	Description
`id`	`string`	The user ID
`firstName`	`string`	User’s first name
`lastName`	`string` (optional)	User’s last name
`email`	`string`	User’s email
`isActive`	`boolean`	Whether the user is active
`isTermsOfServiceAccepted`	`boolean`	Whether the user has accepted the terms of service
`companyId`	`string` (optional)	Company ID (for corporate users)
`applicationStatus`	`string`	Current application or compliance status. See the application status values below.
`applicationCompletionLink`	`object` (optional)	Link for the user to complete their application
`applicationCompletionLink.url`	`string`	The URL to complete the application
`applicationCompletionLink.params.userId`	`string`	The user ID parameter
`applicationCompletionLink.params.signature`	`string`	Rain-issued signature parameter for verification
`applicationExternalVerificationLink`	`object` (optional)	Deprecated in favor of `applicationCompletionLink`
`applicationReason`	`string`	Comma-separated rejection labels from the compliance provider (empty string when no rejections)
`statusChangeReason`	`string` (optional)	Indicates the source of the user status change. Present only when a specific reason is recorded. Requires version `1.1.0` or later. See the status change reason values below.
`eventReceivedAt`	`string` (optional)	ISO 8601 timestamp of when the event was received by Rain. Present in the envelope when enabled for your tenant.

The applicationStatus field can be one of these values:

Status	Description
`approved`	Application has been approved
`pending`	Application is pending review
`needsInformation`	Additional information is required from the user
`needsVerification`	Additional verification is required
`manualReview`	Application is under manual review
`denied`	Application has been denied
`locked`	User account is locked
`canceled`	Application has been canceled
`notStarted`	Application has not been started
`tosNotAccepted`	Identity verification passed, but the program’s terms have not been accepted yet. `applicationCompletionLink` is present so you can send the applicant to accept.

An application moves through these statuses as it is reviewed, and every transition sends a user.updated webhook. For what each status means, which states are terminal, and what to expect next, see Application states. The statusChangeReason field can take these values:

Value	Description
`rain_initiated`	The status change was initiated by Rain

The applicationReason field contains comma-separated rejection labels. For a complete reference of all labels and their meanings, see the webhook rejection label reference.

`company.updated`

This webhook provides real-time updates on a company’s business verification (KYB) and compliance status, helping you track application progress and regulatory changes. It applies to Corporate Programs only and is informational, so it does not require a response.

{
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "resource": "company",
    "action": "updated",
    "version": "1.0.0",
    "eventReceivedAt": "2026-01-27T15:30:00.000Z",
    "body": {
        "id": "company_abc123",
        "name": "Acme Corp",
        "applicationStatus": "approved",
        "applicationReason": ""
    }
}

{
    "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "resource": "company",
    "action": "updated",
    "version": "1.0.0",
    "eventReceivedAt": "2026-01-27T15:30:00.000Z",
    "body": {
        "id": "company_abc123",
        "name": "Acme Corp",
        "applicationStatus": "needsInformation",
        "applicationCompletionLink": {
            "url": "https://use-dev.rain.xyz/kyb",
            "params": {
                "userId": "company_abc123",
                "signature": "CiQAaHR0cHM6Ly9jbG91ZGttcy5nb29nbGVhcGlzLmNvbS92MRIvAD0rF3pKq2mXbYhV8sNzQwLmT4xR9cGvUu1kZpEo6NwsAaHlDdBrMvXjPk9fWq4="
            }
        },
        "applicationReason": "documentPageMissing, badPhotoQuality"
    }
}

Field	Type	Description
`id`	`string`	The company ID
`name`	`string`	Company name
`applicationStatus`	`string`	Current application or compliance status. See the application status values below.
`applicationCompletionLink`	`object` (optional)	Link for the company to complete their application
`applicationCompletionLink.url`	`string`	The URL to complete the application
`applicationCompletionLink.params.userId`	`string`	The company ID parameter
`applicationCompletionLink.params.signature`	`string`	Rain-issued signature parameter for verification
`applicationExternalVerificationLink`	`object` (optional)	Deprecated in favor of `applicationCompletionLink`
`applicationReason`	`string`	Comma-separated rejection labels from the compliance provider (empty string when no rejections)
`eventReceivedAt`	`string` (optional)	ISO 8601 timestamp of when the event was received by Rain. Present in the envelope when enabled for your tenant.

The applicationStatus field can be one of these values:

Status	Description
`approved`	Application has been approved
`pending`	Application is pending review
`needsInformation`	Additional information is required
`needsVerification`	Additional verification is required
`manualReview`	Application is under manual review
`denied`	Application has been denied
`locked`	Company account is locked
`canceled`	Application has been canceled
`notStarted`	Application has not been started
`tosNotAccepted`	Identity verification passed, but the program’s terms have not been accepted yet. `applicationCompletionLink` is present so you can send the applicant to accept.

For what each status means, which states are terminal, and what to expect next, see Application states.

Overview

Compliance

Cards

Payments

Webhooks

Webhook Events

Identity & Compliance

`user.updated`

`company.updated`

​user.updated

​company.updated

`user.updated`

`company.updated`