`kyc.quick.compensated`

A quick KYC binding has been compensated after failure and is no longer an active binding

When Emitted

Two situations share this event: an operator confirms failure compensation manually, or the first upstream application reaches terminal failure and compensation is applied automatically. By the time you receive it, the quick KYC binding has already moved from “currently active” to compensated: the data fee has been refunded, the binding no longer participates in subsequent card applications, and the underlying profile has returned to the pool for future reuse. data.id is the quick KYC binding ID and can remain your audit key. To see which quick KYC bindings are still active for the member, retrieve GET /v1/kyc/quick with x-on-behalf-of. That endpoint returns only bindings that are still active, so the ID in this event will typically no longer appear in the list. compensation_source indicates how compensation was triggered: admin for an operations-confirmed manual compensation, and auto for automatic compensation after the first upstream terminal failure. application_id is returned only when this compensation is tied to a card application. It uses the public application ID with the cap_ prefix, so you can correlate it directly with the original application.

This event is not initiated by an API call

Quick KYC failure compensation is triggered either manually by our operations team or automatically after the first upstream application reaches a terminal failure. Neither path is initiated directly by a merchant OpenAPI endpoint.

Payload

{
  "event_id": "evt_ad41781d3e763829951e2ce3ebf9ea46",
  "event_type": "kyc.quick.compensated",
  "created_at": "2026-09-30T16:21:00.157Z",
  "merchant_id": "acme",
  "livemode": true,
  "data": {
    "object": "quick_kyc_binding",
    "id": "bcce5b6a-e48b-4527-9738-a12957084f92",
    "external_member_id": "u_88123",
    "status": "compensated",
    "status_version": 1790785259185,
    "compensation_source": "admin",
    "application_id": "cap_e27e3409-4abb-4b52-8c45-9bc5729cf17f"
  }
}

Payload Fields

Field	Type	Description
`id`	string	Use this for deduplication. `evt_…` remains unchanged when the same event is redelivered.
`type`	string	Always `kyc.quick.compensated`
`created_at`	string	Time the event was created (RFC3339), not its delivery time. It is unchanged on redelivery.
`data.object`	string	Object type; determines which endpoint to query with `data.id`
`data.id`	string	Object ID; use it to retrieve details.
`data.status`	string	Treat unrecognized values as unknown and raise an alert; do not fall back to “processing”
`data.status_version`	number	Monotonically increasing; use it to discard older states that arrive late.

Signature Verification and Deduplication

Verify the signature against the raw request body bytes. Do not parse and reserialize the JSON: your JSON library may change key order or whitespace, which changes the signature and can look like a key configuration error.

// Node · Run before parsing JSON
const raw = await readRawBody(req);            // Buffer / string; do not use parsed req.body
const expect = crypto.createHmac("sha256", WEBHOOK_SECRET).update(raw).digest("hex");
const got = req.headers["z-signature"];        // Format: t=<unix>,v1=<hex>
if (!timingSafeEqual(expect, parseV1(got))) return res.status(400).end();

// Deduplicate using the envelope id, not data.id
if (await seen(JSON.parse(raw).id)) return res.status(200).end();

For the full procedure, including timestamp tolerance and redelivery semantics, see Webhook Guide.