Set up monitoring webhooks to track sanctions status changes

Screening tells you whether an entity is sanctioned at the moment you ask. Monitoring webhooks do something different: they notify you the moment a sanctions status changes. When a crypto address, email, website, or government ID you care about is added to, removed from, or re-listed on any source list CompliAPI tracks, a signed event is POSTed to your endpoint within minutes of the list update being ingested.

Monitoring webhooks are available on the Developer and Team plans and are configured entirely from the Webhooks page in the dashboard.

Add monitored entities

1. Go to the Webhooks page.
2. Under Monitored entities, add the values you want to watch — crypto addresses (including ENS names), emails, websites, or government IDs.
3. Optionally add a label to each entity so you can identify it in event payloads (for example, customer hot wallet).
4. Note the plan limits: 25 monitored entities on Developer, 100 on Team.

Matching uses the same normalization as the screening API. ENS names are resolved to their address when you add them. Website matching strips the scheme and www. prefix, so https://www.example.com/ matches a listed example.com. Government ID monitoring is exact — it does not do the partial matching that the /screen/id endpoint uses.

Add a webhook endpoint

1. Under Endpoints, click Add endpoint and enter your public https URL.
2. Copy the signing secret (whsec_...) shown for that endpoint — you'll use it to verify incoming payloads.
3. You can have up to 3 endpoints per organization. Every enabled endpoint receives every event for all of your monitored entities.

Event types

Each event covers one list change for one monitored entity:

• entity.listed — the value appeared on a list it was not on before.
• entity.delisted — the value was removed from a list.
• entity.relisted — the value returned to a list it had previously been removed from.
• test — sent by the dashboard's Send test event button so you can verify your endpoint is reachable.

If a wallet is added to both the OFAC SDN list and the UK Sanctions List at the same time, you receive two separate entity.listed events, each naming its own list.

Delivery timing and retries

Events are delivered within a few minutes of CompliAPI ingesting a list update (OFAC lists are checked every 15 minutes; other sources are updated daily or weekly). If your endpoint does not respond with a 2xx status within 10 seconds, delivery is retried on a backoff schedule of approximately 1 minute, 5 minutes, 30 minutes, 2 hours, and 12 hours. After 5 consecutive failed deliveries — each having exhausted all retries — the endpoint is automatically disabled and the organization owner is emailed. You can fix the issue and re-enable the endpoint from the dashboard; delivery resumes for new events from that point forward.