> For the complete documentation index, see [llms.txt](https://docs.compliance.phalcon.blocksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.compliance.phalcon.blocksec.com/manual/notification-channels/webhook-format.md).

# Webhook Format

## Webhook Message

<table><thead><tr><th width="192.21875">Field</th><th width="125.03125">Type</th><th>Description</th></tr></thead><tbody><tr><td>type</td><td>Integer</td><td><p>Type of message received by the Webhook:</p><ol><li>notification (Risk Engine alert)</li><li>monitorEvent (Monitor event)</li></ol></td></tr><tr><td>typeDescription</td><td>String</td><td><p>The valid value range of the variable:</p><p>["notification", "monitorEvent"]</p></td></tr><tr><td>data</td><td>Object</td><td>The specific details of the message are determined by the value of type.</td></tr></tbody></table>

### Notification Data

<table><thead><tr><th width="198.01953125">Field</th><th width="133.109375">Type</th><th>Description</th></tr></thead><tbody><tr><td>triggeringId</td><td>String</td><td>The alert ID that triggered the notification.</td></tr><tr><td>riskEngineId</td><td>String</td><td>The risk engine ID that triggered the notification.</td></tr><tr><td>riskEngineName</td><td>String</td><td>The risk engine name that triggered the notification.</td></tr><tr><td>targetType</td><td>Integer</td><td><p>1: address</p><p>2: transaction</p></td></tr><tr><td>targetTypeDescription</td><td>String</td><td><p>The valid value range of the variable:</p><p>["address", "transaction"]</p></td></tr><tr><td>chainId</td><td>Integer</td><td>The chain ID for different blockchain networks.</td></tr><tr><td>targetIdentifiter</td><td>String</td><td><p>If targetType is 1, it is address</p><p>If targetType is 2, it is transaction hash</p></td></tr><tr><td>riskType</td><td>Integer</td><td><p>The risk type associated with the risk engine that triggered the notification.</p><p>1: exposure</p><p>2: behavior</p></td></tr><tr><td>riskTypeDescription</td><td>String</td><td><p>The valid value range of the variable:</p><p>["exposure", "behavior"]</p></td></tr><tr><td>riskLevel</td><td>Integer</td><td><p>The user-defined risk level associated with the risk engine that triggered the notification.</p><ol><li>critical</li><li>high</li><li>medium</li><li>low</li><li>informational</li></ol></td></tr><tr><td>riskLevelDescription</td><td>String</td><td><p>The valid value range of the variable:</p><p>["critical", "high", "medium", "low", "informational"]</p></td></tr><tr><td>timestamp</td><td>String</td><td>The timestamp of the alert, in ISO 8601 format.</td></tr><tr><td>type</td><td>Integer</td><td><p>Type of detailed notification data</p><p>Address type:</p><p>1: Entity Risk Data</p><p>2: Interaction Risk Data</p><p>3: Large Transfer Data</p><p>4: High-Frequency Data</p><p>5: Transit Address Data</p><p>6: Blocklist Interaction Data</p><p>Transaction type:</p><p>7: Participant Risk Data</p><p>8: Interaction Risk Data</p><p>9: Large Transfer Data</p><p>10: Rapid Transit Data</p><p>11: Blocklist Interaction Data</p></td></tr><tr><td>data</td><td>Array[Object]</td><td><p>The list of detailed information for the notification is determined by the risk engine type.</p><p>For more details, please refer to the following sections.</p></td></tr></tbody></table>

#### 1. Address - Entity Risk Data

<table><thead><tr><th width="203.15234375">Field</th><th width="133.04296875">Type</th><th>Description</th></tr></thead><tbody><tr><td>riskIndicator</td><td>Integer</td><td><p>The risk indicator that matched based on pre-configured rules.</p><p>1: Sanctioned</p><p>2: Attack</p><p>3: Scam</p><p>4: Ransomware</p><p>5: Child Abuse Material</p><p>6: Laundering</p><p>7: Mixing</p><p>8: Dark Market</p><p>9: Darkweb Business</p><p>10: Blocked</p><p>11: Gambling</p><p>12: No KYC Exchange<br>13. Terrorist Financing<br>14. FATF High Risk Jurisdiction<br>15. FATF Grey List Jurisdiction<br>16. Human Trafficking<br>17. Drug Trafficking</p></td></tr><tr><td>riskIndicatorDescription</td><td>String</td><td><p>The valid value range of the variable:</p><p>["Sanctioned", "Attack", "Scam", "Ransomware", "Child Abuse Material", "Laundering", "Mixing", "Dark Market", "Darkweb Business", "Blocked", "Gambling", "No KYC Exchange", "Terrorist Financing", "FATF High Risk Jurisdiction", "FATF Grey List Jurisdiction", "Human Trafficking", "Drug Trafficking"]</p></td></tr><tr><td>detail</td><td>Array[String]</td><td>Supplementary information</td></tr></tbody></table>

#### 2. Address - Interaction Risk Data

<table><thead><tr><th width="213.07421875">Field</th><th width="133.50390625">Type</th><th>Description</th></tr></thead><tbody><tr><td>riskIndicator</td><td>Integer</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>riskIndicatorDescription</td><td>String</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>direction</td><td>Integer</td><td>Transfer direction:<br>• 1 : In (received funds)<br>• 2 : Out (sent funds)</td></tr><tr><td>hop</td><td>Integer</td><td>Degree of separation from the risky entity:<br>• 1 : Direct interaction<br>• 2+ : Indirect interaction (hop count)</td></tr><tr><td>exposureValue</td><td>String</td><td>The absolute value of the exposed funds (in USD)</td></tr><tr><td>exposurePercent</td><td>String</td><td>The percentage of the total transaction volume considered to be "contaminated" by risk</td></tr><tr><td>contributions</td><td>Array[Object]</td><td>Details of this interaction, including a list of each contributing address and its specific risk exposure information in this interaction.</td></tr><tr><td>>address</td><td>String</td><td>The address with the risk indicator.</td></tr><tr><td>>label</td><td>String</td><td>The label of the address.</td></tr><tr><td>>detail</td><td>String</td><td>Detailed risk information.</td></tr><tr><td>>hop</td><td>Integer</td><td>The minimum hop count to the screened address.</td></tr><tr><td>>exposureValue</td><td>String</td><td>The contributed risk exposure value, in USD.</td></tr><tr><td>>exposurePercent</td><td>Number</td><td>The contributed risk exposure percentage.</td></tr></tbody></table>

#### 3. Address - Large Transfer Data

<table><thead><tr><th width="205.31640625">Field</th><th width="97.8984375">Type</th><th>Description</th></tr></thead><tbody><tr><td>transaction</td><td>String</td><td>Transaction hash</td></tr><tr><td>usdValue</td><td>String</td><td>Transfer value, in USD</td></tr><tr><td>direction</td><td>Integer</td><td>Transfer direction:<br>• 1 : In (received funds)<br>• 2 : Out (sent funds)</td></tr><tr><td>timestamp</td><td>String</td><td>The timestamp of the transaction, in ISO 8601 format</td></tr><tr><td>token</td><td>String</td><td>Token contract address</td></tr><tr><td>tokenSymbol</td><td>String</td><td>Token symbol</td></tr><tr><td>tokenAmount</td><td>String</td><td>Token amount</td></tr></tbody></table>

#### 4. Address - High-Frequency Data

<table><thead><tr><th width="201.19140625">Field</th><th width="142.28515625">Type</th><th>Description</th></tr></thead><tbody><tr><td>transactionCount</td><td>Integer</td><td>The total number of transactions within the observation period</td></tr><tr><td>duration</td><td>Integer</td><td>Rounded to the nearest minute</td></tr><tr><td>transactionList</td><td>Array[Object]</td><td>An array of individual transaction details</td></tr><tr><td>>transactionItem</td><td>Object</td><td>Transaction item format: same as **Large Transfer Data schema**</td></tr></tbody></table>

#### 5. Address - Transit Address Data

<table><thead><tr><th width="179.84765625">Field</th><th width="118.41796875">Type</th><th>Description</th></tr></thead><tbody><tr><td>inTransaction</td><td>String</td><td>Inbound transaction hash</td></tr><tr><td>inTimestamp</td><td>String</td><td>Inbound transaction timestamp, in ISO 8601 format</td></tr><tr><td>inUsdValue</td><td>String</td><td>Inbound transfer value (USD)</td></tr><tr><td>outTransaction</td><td>String</td><td>Outbound transaction hash</td></tr><tr><td>outTimestamp</td><td>String</td><td>Outbound transaction timestamp, in ISO 8601 format</td></tr><tr><td>outUsdValue</td><td>String</td><td>Outbound transfer value (USD)</td></tr><tr><td>transitPercent</td><td>String</td><td>Percentage of funds transited</td></tr></tbody></table>

#### 6. Address - Blocklist Interaction Data

<table><thead><tr><th width="213.07421875">Field</th><th width="133.50390625">Type</th><th>Description</th></tr></thead><tbody><tr><td>direction</td><td>Integer</td><td>Transfer direction:<br>• 1 : In (received funds)<br>• 2 : Out (sent funds)</td></tr><tr><td>hop</td><td>Integer</td><td>Degree of separation from the risky entity:<br>• 1 : Direct interaction<br>• 2+ : Indirect interaction (hop count)</td></tr><tr><td>exposureValue</td><td>String</td><td>The absolute value of the exposed funds (in USD)</td></tr><tr><td>exposurePercent</td><td>String</td><td>The percentage of the total transaction volume considered to be "contaminated" by risk</td></tr><tr><td>contributions</td><td>Array[Object]</td><td>Details of this interaction, including a list of each contributing address and its specific risk exposure information in this interaction.</td></tr><tr><td>>address</td><td>String</td><td>The address with the risk indicator.</td></tr><tr><td>>label</td><td>String</td><td>The label of the address.</td></tr><tr><td>>hop</td><td>Integer</td><td>The minimum hop count to the screened address.</td></tr><tr><td>>exposureValue</td><td>String</td><td>The contributed risk exposure value, in USD.</td></tr><tr><td>>exposurePercent</td><td>Number</td><td>The contributed risk exposure percentage.</td></tr></tbody></table>

#### 7. Transaction - Participant Risk Data

<table><thead><tr><th width="158.515625">Field</th><th width="143.9140625">Type</th><th>Description</th></tr></thead><tbody><tr><td>address</td><td>String</td><td>The participant address where the risk indicator was detected.</td></tr><tr><td>riskIndicator</td><td>Integer</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>riskIndicatorDescription</td><td>String</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>detail</td><td>Array[String]</td><td>Supplementary information</td></tr></tbody></table>

#### 8. Transaction - Interaction Risk Data

<table><thead><tr><th width="213.07421875">Field</th><th width="133.50390625">Type</th><th>Description</th></tr></thead><tbody><tr><td>riskIndicator</td><td>Integer</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>riskIndicatorDescription</td><td>String</td><td>Uses the same values and definitions as ***Entity Risk Data***</td></tr><tr><td>direction</td><td>Integer</td><td>Transfer direction:<br>• 1 : In (received funds)<br>• 2 : Out (sent funds)</td></tr><tr><td>hop</td><td>Integer</td><td>Degree of separation from the risky entity:<br>• 1 : Direct interaction<br>• 2+ : Indirect interaction (hop count)</td></tr><tr><td>exposureValue</td><td>String</td><td>The absolute value of the exposed funds (in USD)</td></tr><tr><td>exposurePercent</td><td>String</td><td>The percentage of the total transaction volume considered to be "contaminated" by risk</td></tr><tr><td>contributions</td><td>Array[Object]</td><td>Details of this interaction, including a list of each contributing address and its specific risk exposure information in this interaction.</td></tr><tr><td>>address</td><td>String</td><td>The address with the risk indicator.</td></tr><tr><td>>label</td><td>String</td><td>The label of the address.</td></tr><tr><td>>detail</td><td>String</td><td>Detailed risk information.</td></tr><tr><td>>hop</td><td>Integer</td><td>The minimum hop count to the screened address.</td></tr><tr><td>>exposureValue</td><td>String</td><td>The contributed risk exposure value, in USD.</td></tr><tr><td>>exposurePercent</td><td>Number</td><td>The contributed risk exposure percentage.</td></tr></tbody></table>

#### 9. Transaction - Large Transfer Data

<table><thead><tr><th width="224.0390625">Field</th><th width="202.22265625">Type</th><th>Description</th></tr></thead><tbody><tr><td>transaction</td><td>String</td><td>Transaction hash</td></tr><tr><td>usdValue</td><td>String</td><td>Transfer value, in USD</td></tr><tr><td>fromAddress</td><td>String</td><td>Sender address</td></tr><tr><td>toAddress</td><td>String</td><td>Receiver address</td></tr><tr><td>timestamp</td><td>String</td><td>The timestamp of the transaction, in ISO 8601 format</td></tr><tr><td>token</td><td>String</td><td>Token contract address</td></tr><tr><td>tokenSymbol</td><td>String</td><td>Token symbol</td></tr><tr><td>tokenAmount</td><td>String</td><td>Token amount in this transfer</td></tr></tbody></table>

#### 10. Transaction - Rapid Transit Data

<table><thead><tr><th width="223.77734375">Field</th><th width="201">Type</th><th>Description</th></tr></thead><tbody><tr><td>proceedTransaction</td><td>Object</td><td>Object format: same as Large Transfer Data schema</td></tr><tr><td>ScreenedTransaction</td><td>Object</td><td>Object format: same as Large Transfer Data schema</td></tr></tbody></table>

#### 11. Transaction - Blocklist Interaction Data

<table><thead><tr><th width="213.07421875">Field</th><th width="133.50390625">Type</th><th>Description</th></tr></thead><tbody><tr><td>direction</td><td>Integer</td><td>Transfer direction:<br>• 1 : In (received funds)<br>• 2 : Out (sent funds)</td></tr><tr><td>hop</td><td>Integer</td><td>Degree of separation from the risky entity:<br>• 1 : Direct interaction<br>• 2+ : Indirect interaction (hop count)</td></tr><tr><td>exposureValue</td><td>String</td><td>The absolute value of the exposed funds (in USD)</td></tr><tr><td>exposurePercent</td><td>String</td><td>The percentage of the total transaction volume considered to be "contaminated" by risk</td></tr><tr><td>contributions</td><td>Array[Object]</td><td>Details of this interaction, including a list of each contributing address and its specific risk exposure information in this interaction.</td></tr><tr><td>>address</td><td>String</td><td>The address with the risk indicator.</td></tr><tr><td>>label</td><td>String</td><td>The label of the address.</td></tr><tr><td>>hop</td><td>Integer</td><td>The minimum hop count to the screened address.</td></tr><tr><td>>exposureValue</td><td>String</td><td>The contributed risk exposure value, in USD.</td></tr><tr><td>>exposurePercent</td><td>Number</td><td>The contributed risk exposure percentage.</td></tr></tbody></table>

***

## Monitor Event Data

When a notification channel has **Monitor Events** enabled, Monitor events are delivered as `type: 2` (`monitorEvent`) messages. Only risk-related events are pushed (not lifecycle events like monitoring started/stopped). Delivery is controlled by your [notification trigger settings](/manual/monitor.md#setting-up-notifications).

### Common Fields

All Monitor event messages share these fields in the `data` object:

<table><thead><tr><th width="210">Field</th><th width="110">Type</th><th>Description</th></tr></thead><tbody><tr><td>eventType</td><td>Integer</td><td>Event type: 4 (risk_level_increased), 5 (risk_level_decreased), 6 (alert_triggered), 7 (alert_expired)</td></tr><tr><td>eventTypeDescription</td><td>String</td><td>Human-readable event type name</td></tr><tr><td>targetType</td><td>Integer</td><td>1: address, 2: transaction (currently only address is supported)</td></tr><tr><td>targetTypeDescription</td><td>String</td><td>"address" or "transaction"</td></tr><tr><td>chainId</td><td>Integer</td><td>Chain ID</td></tr><tr><td>targetIdentifier</td><td>String</td><td>The monitored address</td></tr><tr><td>riskLevel</td><td>Integer</td><td>Current overall risk level of the address (1: critical, 2: high, 3: medium, 4: low)</td></tr><tr><td>riskLevelDescription</td><td>String</td><td>Risk level name</td></tr><tr><td>timestamp</td><td>String</td><td>Event time in ISO 8601 format</td></tr></tbody></table>

### Risk Level Increased / Decreased (eventType 4, 5)

Sent when the overall risk level of a monitored address changes. Includes these additional fields:

<table><thead><tr><th width="210">Field</th><th width="110">Type</th><th>Description</th></tr></thead><tbody><tr><td>prevLevel</td><td>Integer</td><td>Risk level before the change</td></tr><tr><td>prevLevelDescription</td><td>String</td><td>Previous risk level name</td></tr><tr><td>newLevel</td><td>Integer</td><td>Risk level after the change</td></tr><tr><td>newLevelDescription</td><td>String</td><td>New risk level name</td></tr><tr><td>relatedAlerts</td><td>Array</td><td>Alerts that caused the level change</td></tr></tbody></table>

Each object in `relatedAlerts`:

<table><thead><tr><th width="210">Field</th><th width="110">Type</th><th>Description</th></tr></thead><tbody><tr><td>alertId</td><td>String</td><td>Alert ID</td></tr><tr><td>riskEngineId</td><td>String</td><td>Risk Engine ID</td></tr><tr><td>riskEngineName</td><td>String</td><td>Risk Engine name</td></tr><tr><td>riskLevel</td><td>Integer</td><td>Alert risk level</td></tr><tr><td>riskLevelDescription</td><td>String</td><td>Alert risk level name</td></tr><tr><td>action</td><td>String</td><td>"triggered" or "expired"</td></tr></tbody></table>

### Alert Triggered / Expired (eventType 6, 7)

Sent when alerts are triggered or expire without causing a risk level change. If they do cause a level change, they are included in the `relatedAlerts` of the Risk Level Increased/Decreased message instead.

These events include an `alerts` array with the following fields per object:

<table><thead><tr><th width="230">Field</th><th width="110">Type</th><th>Description</th></tr></thead><tbody><tr><td>alertId</td><td>String</td><td>Alert ID</td></tr><tr><td>riskEngineId</td><td>String</td><td>Risk Engine ID</td></tr><tr><td>riskEngineName</td><td>String</td><td>Risk Engine name</td></tr><tr><td>alertRiskLevel</td><td>Integer</td><td>The alert's own risk level (distinct from the address's overall risk level)</td></tr><tr><td>alertRiskLevelDescription</td><td>String</td><td>Alert risk level name</td></tr><tr><td>description</td><td>String</td><td>Alert description</td></tr></tbody></table>