Durable human account lifecycle notification

POST

Sent to matching tenant-scoped webhook subscriptions. Delivery is asynchronous and at least once. Retries preserve the event ID and timestamp. Consumers must deduplicate by ID and must not assume delivery order. Updated events invalidate account data and may repeat for one operation. Deletion events wait for the authentication deletion fence and guest cleanup. Registration transitions describe committed state changes; no downgrade API is introduced. Profile fields are omitted by default. Explicitly selected fields may include event-time email data; credentials are never included. The existing webhook signature protocol applies.

Authorizations

• adminBearer
• adminSessionCookie

Request Body ^required

Media type application/json

object

id

required

Stable event ID for consumer deduplication.

string

type

required

string

Allowed values: account.email.changed account.created account.updated account.deleted account.registration.changed

timestamp

required

Account mutation timestamp.

string format: date-time

tenantId

required

string

data

required

object

account_id

Canonical account ID, included with a selected snapshot.

string

before

Selected account fields immediately before deletion.

object

email

string | null

registration_state

string

Allowed values: guest registered

key

additional properties

after

Null for a deleted account.

null

changes

Selected before/after values for an email change.

object

email

object

before

required

string | null

after

required

string | null

key

additional properties

registration_state

object

before

required

string

Allowed values: guest registered

after

required

string

Allowed values: guest registered

key

additional properties

key

additional properties

userId

required

Internal user identifier, not necessarily the client’s pairwise OIDC sub.

string

registration_state

required

string

Allowed values: guest registered

previous_registration_state

required

string | null

Allowed values: guest registered

changed_fields

required

Array<string>

Allowed values: account profile contact custom_profile registration_state

key

additional properties

Responses

200

Event acknowledged by the consumer.