On this page

Activity decision webhooks

Fraud rules can assess transactions and non-transaction activity through the same outcome contract.

Events

Event	Use it for
`fraud.activity.assessed`	Apply the first decision for a non-transaction activity.
`fraud.decision.changed`	Replace the previous decision with the new effective decision.
`entity.step_up_requested`	Send or display the hosted reauthentication challenge.
`entity.step_up_completed`	Continue only when `passed` is true.
`entity.biometric_enrolled`	Record that biometric reauthentication is available.
`entity.biometric_authenticated`	Apply the resolved biometric result.

Assessment example

json

{
  "id": "evt_activity_01",
  "event": "fraud.activity.assessed",
  "createdAt": "2026-08-15T14:20:09.000Z",
  "data": {
    "externalActivityId": "login_928401",
    "activityId": "act_01",
    "decisionId": "dec_01",
    "decision": "review",
    "summary": {
      "outcome": "review",
      "title": "Review required",
      "reason": "A new device and unusual location were detected.",
      "score": 78,
      "riskLevel": "high",
      "matchedRules": 2,
      "nextAction": {
        "type": "review_activity",
        "label": "Review activity"
      }
    }
  }
}

Use the summary for the immediate answer. Detailed rule and screening evidence remains available in the activity response for audit and investigation.

Step-up example

json

{
  "event": "entity.step_up_requested",
  "data": {
    "stepUpId": "stu_01",
    "externalUserId": "customer_1",
    "url": "https://trust.myaza.app/reauth/stu_01",
    "expiresAt": "2026-08-15T14:35:09.000Z",
    "environment": "SANDBOX"
  }
}

Treat the hosted challenge URL as sensitive. Deduplicate every webhook by its envelope id and use the related read API whenever current state matters.