Webhook: identification.refused

POSThttps://your-server.example.com/webhooks/fingerly Signed by Fingerly

Sent when Fingerly refuses identify requests for a reason you can fix. Visitors whose requests are refused are not identified, so this is the event to alert on.

At most one is sent per second for each reason in an environment. Refusals of the same reason inside that second are not sent separately; the next event counts them in suppressed. A client far past its rate limit therefore sends you one event a second, not one per request.

Body

idstring
The event's ID, a UUIDv7. The same on every retry: deduplicate on it. Also sent as X-Fingerly-Event-ID.
typestring
Always identification.refused.
versioninteger
The envelope version, 1.
organization_idstring
Your organization.
environmentstring
live for production traffic, test for staging and development.
created_atstring
When the underlying fact happened, RFC 3339 in UTC. Not when it was delivered.
dataobject
The refusal.
6 child fields
- request_idstring
  An ID for the refused request.
- sdk_key_idstring
  The key that was used.
- reasonstring
  Why it was refused. See below.
- statusinteger
  The HTTP status the client received.
- retry_after_secondsinteger
  For rate_limited: seconds until the client may retry. Omitted otherwise.
- suppressedinteger
  Refusals of the same reason since the previous identification.refused that were not sent as events of their own. Zero when there were none.

Reasons

`reason`	`status`	What to do
`expired_key`	`401`	Issue a new key and deploy it.
`revoked_key`	`401`	A revoked key is still in use somewhere. Deploy its replacement.
`origin_not_allowed`	`401`	Add the site to the key's allowed origins, or find who is using your key.
`billing_blocked`	`402`	Resolve billing in the dashboard.
`no_credit`	`402`	Add funds, or turn on auto top-up.
`rate_limited`	`429`	Traffic exceeded your rate limit. Contact support if it is expected.