Skip to navigation
Webhook event reference

Activity decisions

Fraud rules can assess transactions and non-transaction activity through the same outcome contract.

Events

EventUse it for
fraud.activity.assessedApply the first decision for a non-transaction activity.
fraud.decision.changedReplace the previous decision with the new effective decision.
entity.step_up_requestedSend or display the hosted reauthentication challenge.
entity.step_up_completedContinue only when passed is true.
entity.biometric_enrolledRecord that biometric reauthentication is available.
entity.biometric_authenticatedApply the resolved biometric result.

Assessment example

{
  "id": "evt_activity_01",
  "event": "fraud.activity.assessed",
  "createdAt": "2026-08-15T14:20:09.000Z",
  "data": {
    "externalActivityId": "login_928401",
    "activityId": "act_01",
    "decisionId": "dec_01",
    "decision": "review",
    "summary": {
      "outcome": "review",
      "title": "Review required",
      "reason": "A new device and unusual location were detected.",
      "score": 78,
      "riskLevel": "high",
      "matchedRules": 2,
      "nextAction": {
        "type": "review_activity",
        "label": "Review activity"
      }
    }
  }
}

Use the summary for the immediate answer. Detailed rule and screening evidence remains available in the activity response for audit and investigation.

Step-up example

{
  "event": "entity.step_up_requested",
  "data": {
    "stepUpId": "stu_01",
    "externalUserId": "customer_1",
    "url": "https://api.toden.co/reauth/stu_01",
    "expiresAt": "2026-08-15T14:35:09.000Z",
    "environment": "SANDBOX"
  }
}

Treat the hosted challenge URL as sensitive. Deduplicate every webhook by its envelope id and use the related read API whenever current state matters.