Onboarding Webhooks

QFAST sends asynchronous webhook notifications to your configured endpoint when KYB status changes and when a loan is created. Configure your webhook URL via QFAST's lender settings.

Webhook Security

Every webhook request includes an HMAC-SHA256 signature in the Signature header. Always verify this before processing the payload.

Header	Value
`Signature`	HMAC-SHA256 of the raw JSON body, using your `webhook_secret`.

Verification Example (PHP)

Expected Response

Your endpoint must return HTTP 200. Any other status code triggers a retry.

Event: `kyb.status_updated`

Fired whenever the merchant's KYB status changes. This covers all intermediate and terminal states.

Headers

Header	Value
`Content-Type`	`application/json`
`Event`	`kyb.status_updated`
`Signature`	HMAC-SHA256 of the body.

Payload Structure

Field	Type	Description
`event`	String	Always `kyb.status_updated`.
`timestamp`	String	Event time in `YYYY-MM-DD HH:MM:SS` (UTC).
`data.merchant_id`	UUID	The merchant's unique identifier.
`data.onboarding_status`	String	The new KYB status. See Get Onboarding Status.
`data.rejected_entities`	Array\|absent	Present when status is `kyb_rejected` or `kyb_revision_needed`.

`rejected_entities` Object

Field	Type	Description
`type`	String	The entity type that failed verification (e.g., `BUSINESS`, `OWNER`, `BRAND`).
`reason`	String	Human-readable rejection reason from DOKU.

Example: KYB Approved

Example: KYB Revision Needed

Event: `loan_submitted`

Fired after a successful Submit Loan call. Confirms the loan has been created.

Headers

Header	Value
`Content-Type`	`application/json`
`Event`	`loan_submitted`
`Signature`	HMAC-SHA256 of the body.

Payload Structure

Field	Type	Description
`event`	String	Always `loan_submitted`.
`timestamp`	String	Event time in `YYYY-MM-DD HH:MM:SS` (UTC).
`data.loan_id`	UUID	QFAST loan identifier.
`data.reference_account_number`	String	Your reference number.
`data.status`	String	Loan status — always `pending` on creation.
`data.principal_amount`	Number	Principal in IDR.
`data.interest_amount`	Number\|null	Total interest in IDR.
`data.admin_fee_amount`	Number\|null	Admin fee in IDR.
`data.reserve_amount`	Number	Reserve amount in IDR.
`data.term_unit`	String	Loan term unit — always `month`.
`data.term_length`	Integer	Loan duration in months.
`data.penalty_rate`	String	Daily late penalty rate as a string.
`data.start_date`	String\|null	Loan start date in `YYYY-MM-DD`.

Example: Loan Submitted

Event: `loan_active`

Fired when a loan transitions to active status (e.g., after disbursement completes).

Payload Structure

Same as loan_submitted — see table above — with status = active.

Webhook Security#

Verification Example (PHP)#

Expected Response#

Event: kyb.status_updated#

Headers#

Payload Structure#

rejected_entities Object#

Example: KYB Approved#

Example: KYB Revision Needed#

Event: loan_submitted#

Headers#

Payload Structure#

Example: Loan Submitted#

Event: loan_active#

Payload Structure#

Webhook Security

Verification Example (PHP)

Expected Response

Event: `kyb.status_updated`

Headers

Payload Structure

`rejected_entities` Object

Example: KYB Approved

Example: KYB Revision Needed

Event: `loan_submitted`

Headers

Payload Structure

Example: Loan Submitted

Event: `loan_active`

Payload Structure