Skip to main content

Reading Webhook Reports

When WeCheck completes a scan, it delivers the result to your configured webhook endpoint as a JSON payload. This page explains how to interpret and act on that information: what each field means, how confidence scores should inform your decision logic, and how to handle flagged content.

For webhook setup and security (signature verification, retries), see Webhooks.

General Payload Structure​

Each scan.completed event delivers a payload with the following top-level structure:

{
  "event_id": "evt_12345abcde",
  "type": "scan.completed",
  "created_at": "2024-03-23T12:00:00Z",
  "data": {
    "scan_id": "scn_98765",
    "subject": { ... },
    "confidence_score": 87,
    "risk_score": 72,
    "risk_status": "high_risk",
    "signal_clusters": { ... },
    "flags": [ ... ]
  }
}
FieldDescription
event_idUnique identifier for this webhook delivery — use it for idempotency checks.
typeEvent type: scan.completed, scan.failed, or risk_flag.surfaced.
created_atISO 8601 timestamp of when the event was generated.
data.scan_idThe unique ID of the completed scan.
data.subjectSubject identifiers sent in the original scan request.
data.confidence_scoreWeCheck's confidence level that the discovered footprint belongs to the submitted subject (0–100).
data.risk_scoreAggregate risk level of the discovered content (0–100).
data.risk_statusRisk category: low_risk, moderate_risk, high_risk.
data.signal_clustersBreakdown of findings by source category.
data.flagsArray of specific flagged items requiring manual review.

Understanding Confidence Scores​

The confidence_score reflects how strongly the discovered digital footprint matches the submitted subject — not the severity of the content found.

Score RangeLabelMeaning
80–100High ConfidenceStrong visual match or multiple independent behavioral overlaps. Act on the findings.
50–79Medium ConfidenceNarrative and behavioral overlap, but no visual anchor. Review findings with appropriate skepticism.
< 50Low ConfidenceName-only match or ambiguous signals. Request additional information from the subject before acting.

A high confidence score with no flags represents a clean result. A low score with flags indicates those flags are tentative — the footprint may not belong to the right person.

See AI Matching for a detailed explanation of how these scores are calculated.

Signal Clusters Breakdown​

The signal_clusters object groups findings by the type of source where they were discovered:

"signal_clusters": {
  "social_professional": { "profiles_found": 4, "risk_signals": 0 },
  "public_contributions": { "profiles_found": 2, "risk_signals": 1 },
  "news_media": { "mentions_found": 7, "risk_signals": 2 },
  "interactive_assets": { "images_found": 12, "identity_confirmed": true }
}
ClusterSources
social_professionalLinkedIn, X/Twitter, Instagram, Facebook, professional networks.
public_contributionsReddit, forums, GitHub, blogs, StackOverflow.
news_mediaLocal and international press, releases, publications.
interactive_assetsPublicly shared images and videos — used for facial recognition anchoring.

Reading Flagged Items​

The flags array contains each specific item that sentiment and relationship agents identified as a potential risk signal:

"flags": [
  {
    "flag_id": "flg_001",
    "category": "threatening_rhetoric",
    "severity": "high",
    "confidence": 91,
    "source_platform": "Reddit",
    "source_url": "https://reddit.com/...",
    "published_at": "2023-11-14T08:32:00Z",
    "excerpt": "...[content summary]...",
    "context": "...[surrounding content for reviewer context]..."
  }
]
FieldDescription
categoryRisk category: threatening_rhetoric, extremist_content, hate_speech, professional_misrepresentation, financial_misconduct, harassment.
severitylow, medium, or high — reflects the assessed severity of this specific item.
confidenceLikelihood that this is a genuine signal (not a false positive).
source_platformPlatform where the content was found.
excerptThe specific content snippet that triggered the alert.
contextSurrounding content to provide the reviewer with a complete picture.

Suggested Decision Logic​

WeCheck is a decision-support tool — your team defines the thresholds. A recommended starting framework:

if confidence_score >= 80 AND flags.length > 0:
    → Route to human review queue

if confidence_score >= 80 AND flags.length == 0:
    → Proceed (clean result)

if confidence_score >= 50 AND confidence_score < 80:
    → Apply enhanced review; assess flags with moderate skepticism

if confidence_score < 50:
    → Request additional subject information; do not act on flags alone

if risk_status == "high_risk":
    → Escalate to senior reviewer regardless of confidence score

Adjust thresholds according to your specific use case's risk tolerance — the standard for a low-access contractor is different from a CFO hire or a high-value financial onboarding.