Process Nafath webhook

Processes Nafath authentication webhook callbacks to update session status and user information.

This endpoint receives webhook notifications from Nafath when a user completes or rejects
biometric authentication. It verifies the JWT token, processes the callback data,
and updates the corresponding onboarding session status.

Security:

JWT token verification using ELM's public key (JWK)

Token signature validation and expiration checks

Request Structure (Official Nafath API):

token - JWT token signed by ELM containing request status and user information

transId - Transaction ID created upon creating the request

requestId - Request Number sent by client upon creating the request

JWT Token Status Values:

COMPLETED - Request accepted by authenticated user with successful biometric verification

REJECTED - Request rejected by user or verification failed

The JWT token contains verified user information from the Saudi national identity system
when the status is COMPLETED.

curl --location --request POST '/webhooks/nafath' \ --header 'Content-Type: application/json' \ --data-raw '{ "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", "trans_id": "NF123456789", "request_id": "s1d2e3f4-a5b6-7890-c1d2-e3f4a5b6c7d8" }'

Process Nafath webhook

Request

Responses