Events and webhooks
102 capability events. Payload schemas are not yet declared.
- subscribable a webhook consumer is live: an endpoint registered for it receives it
- planned_webhook a webhook consumer is declared and awaited (delivery_awaiting names the ticket); nothing is delivered yet
- audit_only no webhook consumer: recorded, and heard only by the estate's own consumers
Capability events
| event | delivery | emitted by |
|---|---|---|
| access_review.closed | audit_only | close_access_review |
| access_review.created | audit_only | create_access_review |
| access_review.item_decided | audit_only | decide_access_review_item |
| access.break_glass | audit_only | break_glass_access |
| account_role.changed | audit_only | set_account_role |
| account_role.removed | audit_only | remove_account_member |
| account.created | audit_only | convert_sandbox, create_account, provision_account |
| account.provisioned | audit_only | provision_account |
| announcement.published | audit_only | publish_announcement |
| api_key.created | audit_only | create_api_key |
| api_key.limits_changed | audit_only | set_api_key_limits |
| api_key.revoked | audit_only | revoke_api_key |
| api_key.rotated | audit_only | rotate_api_key |
| api_key.version_changed | audit_only | set_api_key_version |
| audit.export_requested | audit_only | export_audit_events |
| audit.subscribed | audit_only | subscribe_audit |
| beta_list.changed | audit_only | set_beta_list_member |
| catalog_photo.visibility_changed | audit_only | hide_catalog_photo |
| catalog.price_set | planned_webhook | set_catalog_price |
| data_policy.changed | audit_only | set_data_policy |
| depot.claimed | audit_only | claim_depot, import_units |
| depot.referenced | audit_only | reference_depot |
| depot.unreferenced | audit_only | remove_depot_reference |
| device_session.pinned | audit_only | set_acting_scope |
| device.registered | audit_only | register_device |
| device.revoked | audit_only | revoke_device |
| document.parties_changed | planned_webhook | set_document_parties |
| domain.join_policy_changed | audit_only | set_domain_join_policy |
| domain.removed | audit_only | remove_domain |
| domain.verified | audit_only | verify_domain |
| entitlement.granted | audit_only | grant_capability |
| entitlement.revoked | audit_only | revoke_capability_grant |
| file.deleted | planned_webhook | delete_file |
| flag.wave_changed | audit_only | advance_flag_wave, roll_back_flag, set_flag_lists, step_back_flag, turn_off_flag |
| fx.overridden | audit_only | set_fx_rate_override |
| gate_event.conflicted | audit_only | record_gate_event |
| gate_event.recorded | audit_only | record_gate_event |
| grant.approved | audit_only | approve_grant |
| grant.rejected | audit_only | approve_grant |
| grant.requested | audit_only | request_staff_grant |
| grant.revoked | audit_only | revoke_grant |
| guest.invited | audit_only | invite_guest |
| guest.revoked | audit_only | revoke_guest |
| identity_finding.resolved | audit_only | resolve_identity_finding |
| identity_reconcile.ran | audit_only | run_identity_reconcile |
| intake.received | planned_webhook | add_file, complete_upload, route_held_file |
| invite_link.created | audit_only | create_invite_link |
| maintenance_banner.changed | audit_only | set_maintenance_banner |
| member_role.changed | audit_only | set_member_role |
| my_settings.changed | audit_only | set_my_settings |
| notification_policy.changed | audit_only | set_notification_policy |
| notification_preference.changed | audit_only | set_my_notification |
| org.created | audit_only | create_org, provision_account |
| org.customer_stage_changed | audit_only | set_customer_stage |
| org.deletion_cancelled | audit_only | cancel_org_deletion |
| org.deletion_scheduled | audit_only | schedule_org_deletion |
| org.purge_approved | audit_only | purge_org |
| org.purge_dry_run | audit_only | run_purge_dry_run |
| org.purged | audit_only | purge_org |
| org.resumed | audit_only | resume_org |
| org.settings_changed | audit_only | update_org_settings |
| org.suspended | audit_only | suspend_org |
| org.switched | planned_webhook | switch_org |
| party.claimed | audit_only | claim_party |
| po.confirmed | audit_only | confirm_purchase_order |
| po.serials_submitted | audit_only | submit_serial_batch |
| po.status_posted | audit_only | post_production_status |
| portfolio.changed | audit_only | set_portfolio_members |
| portfolio.created | audit_only | create_portfolio |
| role.cloned | audit_only | clone_role_template |
| role.deleted | audit_only | delete_role_template |
| role.updated | audit_only | update_role_template |
| sandbox.converted | audit_only | convert_sandbox |
| sandbox.provisioned | audit_only | provision_sandbox |
| security_policy.changed | audit_only | restore_security_policy, set_ip_allowlist, set_mfa_policy, set_session_policy, set_sso_policy |
| service_account.created | audit_only | create_service_account |
| service_account.disabled | audit_only | disable_service_account |
| service_account.updated | audit_only | update_service_account |
| session.impersonated | audit_only | impersonate_user |
| session.mode_changed | planned_webhook | set_session_mode |
| sessions.revoked | audit_only | revoke_sessions |
| share.created | planned_webhook | create_data_share |
| share.declined | planned_webhook | decline_data_share |
| share.revoked | planned_webhook | revoke_data_share |
| sso_connection.created | audit_only | create_sso_connection |
| sso_connection.deleted | audit_only | delete_sso_connection |
| sso_connection.updated | audit_only | update_sso_connection |
| staff_role.granted | audit_only | grant_staff_role |
| staff_role.revoked | audit_only | revoke_staff_role |
| unit_role.granted | audit_only | grant_unit_role |
| unit_role.replaced | audit_only | grant_unit_role |
| unit_role.revoked | audit_only | revoke_unit_role |
| unit.created | audit_only | create_unit |
| unit.moved | audit_only | move_unit |
| units.imported | audit_only | import_units |
| user.anonymized | audit_only | anonymize_user |
| user.deactivated | planned_webhook | deactivate_user |
| user.invited | audit_only | import_users, invite_user |
| user.mfa_reset | audit_only | reset_user_mfa |
| user.reinstated | audit_only | reinstate_user |
| users.imported | audit_only | import_users |
| version.deprecated | audit_only | announce_deprecated_versions |
Outbox webhooks
Envelope version 1: {version, id, type, op, org_id, occurred_at, object: {table, id: {<key columns>}}}, plus fields: {old, new} for the columns an endpoint opted into
asset· Assets · key asset_id subscribableasset_intake· Intakes · key intake_id subscribableasset_release· Releases · key release_id subscribableasset_reservation· Reservations · key reservation_id subscribablegate_in_event· Gate-ins · key gate_in_id subscribablegate_out_event· Gate-outs · key gate_out_id subscribableorder_invoice· Invoices · key invoice_id subscribableorder_order· Orders · key order_id subscribable
Signatures
Standard Webhooks (standardwebhooks.com)
- webhook-id
- the delivery's id, dlv_<32 hex>: stable across one delivery's retries, different per endpoint
- webhook-timestamp
- the attempt's time, Unix seconds
- webhook-signature
- v1,<base64 HMAC-SHA256 over <id>.<timestamp>.<raw body>>, one per active key, space-separated
- webhook-key-id
- the key ids, space-separated, in the signatures' order (an addition a stock verifier ignores)