ID.me Events give your organization a structured, consent-gated record of every member interaction with your integration, from first authentication through ongoing account activity and security signals. For developers, this means a queryable event log you can use to build audit trails, trigger workflows, and detect anomalies. For compliance and security teams, it means a tamper-evident record that satisfies regulatory reporting requirements and supports fraud investigation.
Every meaningful action a member takes within an ID.me-integrated application generates an event record. Each record captures the full context of that action:
Events are organized into four high-level categories:
Events are only available for members who have explicitly granted consent to your integration. Events that occur before consent is recorded are held and released together once consent is confirmed, ensuring your integration always receives a complete picture.
Maintain a tamper-evident, time-stamped record of every member interaction with your integration. Meet regulatory reporting requirements and support legal hold without building your own logging infrastructure.
Access near-real-time signals when a member’s account is suspended, their credentials are force-reset, or account recovery is triggered — so your system can immediately gate access or flag the session for review.
Know when a member’s verified status or consent changes. Use these signals to update access permissions, prompt for re-authentication, or archive stale identity data in compliance with your data retention policies.
Access IP address, device fingerprint, and user agent data for every interaction. Correlate events across sessions to detect anomalies and support security investigations.
ID.me provides three mechanisms for accessing event data:
Events API (this guide)
Query a specific event by its unique ID using a bearer token. Suited for on-demand lookups, audit log retrieval, and verification workflows where you already have a reference to the event.
Webhooks
Push-based delivery of events to your endpoint as they occur. ID.me routes matching events to your configured receiver in near real time. Contact your account team to configure webhook delivery for your integration.
Shared Signals Framework (SSF/RISC)
OpenID-standard push delivery scoped to account security signals — account suspension, credential resets, and recovery events. Designed for security-critical workflows where low latency matters. See the SSF Overview for details.
Sign in to the ID.me Developer Portal to create your account. If you already have an account, sign in and navigate to your integration dashboard.