Webhooks

Inbound data feeds

Certain payment rails can push transaction activity directly to PACIN on your institution's behalf. Inbound feed configuration is established during onboarding — contact your PACIN account team to enable or update it. You do not publish or manage a webhook URL for this path; PACIN handles the connection with the rail provider.

Outbound event delivery

Outbound webhooks — where PACIN posts a signed HTTPS event to your endpoint when a score completes or a consent status changes — are not yet generally available.

What outbound webhooks will support

When the feature is generally available, you will register an HTTPS endpoint and receive HMAC-SHA256 signed event payloads. Planned events include:

• score.completed — a score request has finished processing and the result is available via the Score API
• consent.revoked — a consent record was revoked, either by the data subject or by your institution
• consent.expired — a consent record passed its configured expiry date

All delivery attempts will include a Pacin-Signature header containing an HMAC-SHA256 digest of the raw request body. PACIN retries failed deliveries with exponential back-off. Full payload schemas, retry semantics, and endpoint registration instructions will be published here when the feature launches.

Security

When outbound webhooks are available, verify every incoming request by recomputing the HMAC-SHA256 digest of the raw body using your endpoint's signing secret, and comparing it to the value in the Pacin-Signature header. Reject requests that do not match. Signing secrets will be rotatable from your developer settings at any time.

Questions or early-access interest: developers@pacinnetwork.com