> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.portreeve.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.portreeve.com/_mcp/server.

# A queued review was resolved

POST 

Delivered to the webhook URL configured in dashboard Settings when a human resolves a review.

**Verify the signature against the raw request bytes.** The `Portreeve-Signature` header carries `sha256=<hex>`, the HMAC-SHA256 of the exact body we sent, keyed with your webhook secret (`whsec_…`). If a JSON body parser runs before verification, re-serialised whitespace will make verification fail.

**Deliveries retry with backoff until you return 2xx**, so your handler must be idempotent — revoking an already-revoked account is a no-op, not an error. Respond 2xx quickly and do slow work (refunds, emails) asynchronously.

Reference: https://docs.portreeve.com/api-reference/verdicts/review-resolved

## Request

### Headers

- `Portreeve-Signature` (string, required) — `sha256=<hex>` — HMAC-SHA256 of the raw request body, keyed with your webhook secret.

### Payload

- `type` ("review.resolved", required) — Always `review.resolved`. Switch on it rather than assuming — more webhook types will exist.
- `event_id` (string, required) — The `id` from the original verdict response.
- `resolution` (enum, required) — `approved`: nothing to do. `denied`: revoke.
  - Allowed values: `approved`, `denied`
- `final_verdict` (enum, required) — The verdict after resolution. A denial flips the original `review` to `block`.
  - Allowed values: `allow`, `review`, `block`
- `resolved_at` (datetime, required) — RFC 3339 timestamp of the resolution.
- `external_user_id` (string, optional) — The `external_user_id` from the original event — sent at verdict time or attached later via `PATCH /v1/events/{id}`. Resolve by this first.
- `email` (string, optional) — The email from the original event, when one was sent. Fallback resolution handle if no `external_user_id` was ever bound — emails are mutable, so prefer the account id.