Skip to main content
Screening tells you whether an entity is sanctioned right now. Monitoring webhooks tell you when that answer changes: register the crypto addresses, emails, websites, or government IDs you care about, add a webhook endpoint, and CompliAPI POSTs a signed event to it whenever one of those values is added to, removed from, or re-listed on any list we track. Webhook monitoring is available on the Developer and Team plans. It is configured entirely from the dashboard’s Webhooks page.

​
Concepts

Monitored entities are exact-match values, using the same normalization as the screening API: Plan limits: 25 monitored entities per organization on Developer, 100 on Team, and up to 3 endpoints per organization. Endpoints are public https URLs owned by your organization. Every enabled endpoint receives every event for the organization’s monitored entities. Each endpoint has its own signing secret (view and rotate it from the dashboard). Events fire per list: if a wallet is added to both the OFAC SDN list and the UK Sanctions List, you get two entity.listed events, each naming its list. Event types:
  • entity.listed — the value appeared on a list it wasn’t on before
  • entity.delisted — the value was removed from a list
  • entity.relisted — the value returned to a list it had been removed from
  • test — sent by the dashboard’s test button
List updates are ingested continuously (OFAC every 15 minutes, other sources daily or weekly — see data sources), and events reflect changes to our copy of each list.

​
Delivery and retries

Events are delivered within a few minutes of ingestion. A delivery is considered successful when your endpoint answers any 2xx status within 10 seconds. Anything else is retried on a backoff schedule of roughly 1 minute, 5 minutes, 30 minutes, 2 hours, and 12 hours before the delivery is marked failed. Delivery is at-least-once and unordered: the same event can occasionally arrive twice, and two events may arrive out of order. Deduplicate on the event id (stable across retries) and use created_at to order. After 5 consecutive failed deliveries (each having exhausted its retries), the endpoint is automatically disabled and the organization owner is emailed. Fix the endpoint and re-enable it from the dashboard — delivery resumes with new events from that point; events that occurred while it was disabled are not replayed.

​
Verifying signatures

Every delivery carries an X-CompliAPI-Signature header signed with the endpoint’s secret. Always verify it before trusting a payload — see webhook events for the payload format and verification code in Python and Node.

​
Webhooks vs. polling

The public GET /api/v1/delisted feed is the polling counterpart: it lists recent removals across all lists, unauthenticated. Webhooks are the push counterpart, scoped to exactly the entities you monitor.