API & Webhook

API Keys

Your API key and secret authenticate every request your system makes to Sigma. Sigma issues a key and secret pair and both must be included as custom headers on every API request:

apiKey: YOUR_API_KEY
apiSecret: YOUR_API_SECRET

Both values are available from the API & Webhooks page in your account. To view or generate API keys:

Log in to Sigma
Click My Account
Go to API & Webhooks → API
Copy your existing key and secret, or click Generate New Keys to create a new pair

Generating new keys immediately invalidates the previous pair. Any systems using the old keys will stop working until updated. Only regenerate keys if the current keys have been compromised.

Best practices:

Store your API key and secret in environment variables, not in source code
Never expose them in client-side applications or public repositories
Restrict access to the IP ranges your servers use, if your infrastructure supports it
Rotate keys periodically as part of your security hygiene

Webhooks

Webhooks are how Sigma delivers asynchronous results back to your system. For example, transaction decisions from webhook-mode submissions and CDD workflow outcomes are sent to your configured webhook URL. When an event completes, Sigma sends an HTTP POST request containing the result payload to the webhook URL you have configured for that product. To set up a webhook URL:

Log in to Sigma
Click My Account
Go to API & Webhooks → Webhooks
Enter your webhook URL for each product (Transaction Monitoring, AML, CDD)
Save

Each product has its own webhook URL, so you can route results to different endpoints in your system. Receiving webhook events: Your endpoint must:

Accept POST requests
Return a 200 OK response promptly to acknowledge receipt
Process the payload asynchronously if handling takes time (return 200 first, then process)

If Sigma does not receive a 200 response, it will retry delivery with exponential backoff. Webhook payload structure:

{
  "event": "transaction.decision",
  "timestamp": "2025-01-15T14:30:00.000Z",
  "data": {
    "transaction_id": "txn-001",
    "action": "REVIEW",
    "risk_level": "medium",
    "triggered_rules": ["Large Transaction Amount"]
  }
}

The event field identifies the type of result. The data object contains the full result payload for that event type.

Get Started

Products

Account

API Keys

Webhooks