---
title: Webhooks
description: The webhooks Figure sends as inquiries and applications move
  forward, and how to receive them
---

## Partner endpoint requirements

Webhooks are delivered via HTTP `POST` to the URL you provide during onboarding.

Your endpoint should return a `200 OK` status to acknowledge receipt of the message. If it returns anything other than a 2xx status, or can't be reached, Figure retries delivery several times with exponential backoff.

## Encryption
Figure can deliver webhooks encrypted or unencrypted, whichever you prefer. Encryption is optional, but your endpoint must use HTTPS.

Only RSA encryption is supported. To receive encrypted webhooks, give Figure a public key to encrypt them with. Each payload then arrives as a string that you decrypt with your matching private key, as described in [Decrypting a JWE](/jwe-data-protection/jwe#4-decrypting-a-jwe-for-reference).

{% details summary="Show an example encrypted payload" %}
```text {% title="Encrypted webhook payload (JWE)" %}
eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.qNAYpqG_t9ujLWt3_Jv7P82WZ7_hU0UvTHyzSMah7v68k_CfKydgC-w8dDQcYpAqjOtYpAmgQrAJT4-ipdCDkMqwgX7rSbgbBqEYBNLkvkiNfHrhKE4HCDywaTdiZmCnsjVGfEkNAkf1KvLNNWGcc_arvQdGqzoMI61cgZXJfuOfWnsDUWdXtckQaiBP3JL9yQv_p16jhVamgQYXTtXz5IlLDL4TS6gSGnZ7hRRZI3JGC0eQHCzDXuY_mF0Tfd89Z5QgMjiHrUaMEw60sTkKSW_NyNG62D5T6STNgKk6w6GsB3bpn4m1kiyQ7cxkraHCJyOOWQ80NK9EGu0A3g0ATg.aCUl2PDUPTvFBSHF.Gd3VxWjTGGK6tCqSnXhMDZ90BvM9Qv9vJOAqGiajjwTV_HSN7LVVxJ1R5NSloO8slgHNiZRy-dbL8wfY3BdfsixemFd1BeM9Pov_QJMb7GYRayza1WF96eHGtWE-pgILzR3SGMfxgFFGVCbiKTCU8KEymL5xH5eN6YLaKbCKxq2LHRaa3dU590ChaG1kIBf7x8-iGWH89vAB45YtutQRR340lm2jpCj3_6gX-tP40pkFUDE6yBtEDQeTgvC0W7xf6sLo3WTJeg.q_wQXu0TaxbjfGdbxtJlhQ
```
{% /details %}

## Default inquiry webhooks {% #default-inquiry-webhooks %}

Inquiries move through several processing steps. During onboarding, Figure can set up a webhook that notifies you at the key points. When processing finishes and the next [`nextInquiryStepType`](/heloc-inquiries/enum-types#nextinquirysteptype) is ready, Figure sends a `POST` to your URL with the payload below. It tells you the next action to take, or that the inquiry has moved to the borrower.

```json5 {% title="Payload shape (types, not literal values)" %}
{
  "applicationUuid": string, // uuid
  "loanOriginatorNmls": string,
  "productType": string,
  "eventTimestamp": string,
  "nextInquiryStepType": string,
  "organization": string
}
```

When a webhook arrives, call [Inquiry details](/heloc-inquiries/details) to get the updated inquiry, then move the borrower forward in your system.

### Examples
```json {% title="Unencrypted webhook payload" %}
{
  "applicationUuid": "82f5176b-7dbf-4f37-b40d-6e9580f3d4f1",
  "loanOriginatorNmls": "NMLS_1234",
  "productType": "HELOC",
  "eventTimestamp": "2025-06-26T12:54:16.726009161Z",
  "nextInquiryStepType": "OFFERS_AVAILABLE",
  "organization": "<your organization>"
}
```

## Default application webhooks {% #default-application-webhooks %}
As the application progresses, your webhook endpoint receives these status updates. It can be the same endpoint as your inquiry webhooks or a different one.

{% callout type="info" title="Note" %}
Once an inquiry transitions to an application, the webhook payload will have this schema.
Instead of `nextInquiryStepType`, the payload includes a `status` field with the application's current status.
{% /callout %}

```json5 {% title="Payload shape (types, not literal values)" %}
{
  "applicationUuid": string, // uuid
  "loanOriginatorNmls": string,
  "productType": string,
  "eventTimestamp": string,
  "status": string,
  "overallStatus": string,
  "organization": string
}
```

## Custom webhooks {% #custom-application-webhooks %}
If your systems need a different payload, Figure can configure one: anything in the [Inquiry details](/heloc-inquiries/details) response can go in it.