The enrollment webhook lets Certegy notify you in real time when a consumer completes online enrollment through your property’s unique subdomain URL. It is a trigger, not a data transport: the payload carries only a consumer identifier — no consumer PII — which you use to perform a secure Get Consumer Information lookup for any details you need.
Configure
A webhook URL and a webhook secret are configured per uniquely configured portal landing page (for example, a property- or integrator-specific subdomain). A webhook fires only for subdomains that have both a URL and a secret configured.
Event trigger & delivery
When a consumer completes enrollment through a configured subdomain, Certegy sends an HTTP POST to that subdomain’s configured webhook URL in real time, carrying the consumer’s consumerToken.
Payload
{
"tag": "online_enrollment",
"created_at": "2026-06-01T08:06:48",
"data": {
"consumerToken": "f2a2dc47-5db1-11f1-b314-577dece3a1d5",
"status": "created"
},
"uuid": "5330FCBB6B18C969E063FE01130A3D4C"
}| Field | Description |
|---|---|
tag |
Event type. online_enrollment identifies an online enrollment event. |
created_at |
Timestamp when the enrollment event occurred. |
data.consumerToken |
The consumer identifier. Use it to perform a Get Consumer Information lookup. |
data.status |
Enrollment event status (e.g., created). |
uuid |
Unique identifier for this webhook event. Use for idempotency / deduplication. |
Security (signature validation)
Each configured subdomain has a webhook secret used to confirm an incoming request genuinely originated from Certegy before you act on it. The webhook is signed using an X-Signature HTTP header carrying an HMAC-SHA256 of the raw payload body, generated with your webhook secret. To verify, recompute that HMAC over the raw request body using your secret and compare it to X-Signature using a time-safe comparison; reject any request that does not match.
Webhook types
Event (tag) |
Fires when |
|---|---|
online_enrollment |
A consumer completes online enrollment through a configured subdomain URL. This is the only event type available today. |