# Activity decision webhooks

Fraud rules can assess transactions and non-transaction activity through the same outcome contract.

## Events

| Event | Use it for |
| --- | --- |
| `fraud.activity.assessed` | Apply the first decision for a non-transaction activity. |
| `fraud.decision.changed` | Replace the previous decision with the new effective decision. |
| `entity.step_up_requested` | Send or display the hosted reauthentication challenge. |
| `entity.step_up_completed` | Continue only when `passed` is true. |
| `entity.biometric_enrolled` | Record that biometric reauthentication is available. |
| `entity.biometric_authenticated` | Apply the resolved biometric result. |

## Assessment example

```json
{
  "id": "evt_activity_01",
  "event": "fraud.activity.assessed",
  "createdAt": "2026-08-15T14:20:09.000Z",
  "data": {
    "externalActivityId": "login_928401",
    "activityId": "act_01",
    "decisionId": "dec_01",
    "decision": "review",
    "summary": {
      "outcome": "review",
      "title": "Review required",
      "reason": "A new device and unusual location were detected.",
      "score": 78,
      "riskLevel": "high",
      "matchedRules": 2,
      "nextAction": {
        "type": "review_activity",
        "label": "Review activity"
      }
    }
  }
}
```

Use the summary for the immediate answer. Detailed rule and screening evidence remains available in the activity response for audit and investigation.

## Step-up example

```json
{
  "event": "entity.step_up_requested",
  "data": {
    "stepUpId": "stu_01",
    "externalUserId": "customer_1",
    "url": "https://trust.myaza.app/reauth/stu_01",
    "expiresAt": "2026-08-15T14:35:09.000Z",
    "environment": "SANDBOX"
  }
}
```

Treat the hosted challenge URL as sensitive. Deduplicate every webhook by its envelope `id` and use the related read API whenever current state matters.