{
"id": "evt_z77z2f3mrha6c3wvhbsb02vwbj",
"object": "event",
"type": "connection.created",
"api_version": "2026-10-15",
"livemode": true,
"account": null,
"sequence": 1,
"created_at": "2026-09-29T10:12:01Z",
"data": {
"object": {
"id": "con_av0baahbfheftkzxqbkns02qwf",
"object": "connection",
"livemode": true,
"status": "active",
"licensee": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"licensee_name": "Ridgeline",
"platform": "acct_7p4r6s9t0wxyhk5zba2q8v1m3n",
"platform_name": "Northlight",
"scopes": [
"files:write",
"checks:write",
"generations:write",
"usage:write"
],
"licenses": {
"mode": "all",
"ids": []
},
"revoked_by": null,
"revoked_at": null,
"created_at": "2026-09-29T10:12:00Z"
}
}
}connection.created
A licensee connected your platform.
{
"id": "evt_z77z2f3mrha6c3wvhbsb02vwbj",
"object": "event",
"type": "connection.created",
"api_version": "2026-10-15",
"livemode": true,
"account": null,
"sequence": 1,
"created_at": "2026-09-29T10:12:01Z",
"data": {
"object": {
"id": "con_av0baahbfheftkzxqbkns02qwf",
"object": "connection",
"livemode": true,
"status": "active",
"licensee": "acct_2q8v1m3n7p4r6s9t0wxyhk5zba",
"licensee_name": "Ridgeline",
"platform": "acct_7p4r6s9t0wxyhk5zba2q8v1m3n",
"platform_name": "Northlight",
"scopes": [
"files:write",
"checks:write",
"generations:write",
"usage:write"
],
"licenses": {
"mode": "all",
"ids": []
},
"revoked_by": null,
"revoked_at": null,
"created_at": "2026-09-29T10:12:00Z"
}
}
}What to do
- Store the licensee’s account ID from
data.object.licensee. - Send that licensee’s checks with
Reflections-Accountset to it.
2xx within 10 seconds, then do the work. Deliveries can repeat; ignore an event ID you have processed.
Related
Authentication
Parties
Authorizations
Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it
on your server. Restricted keys carry only the scopes you give them.
Headers
The event ID. Use it to ignore duplicate deliveries.
Unix seconds when this delivery was signed. Reject deliveries more than 5 minutes old.
Space-separated v1,<base64> signatures: HMAC-SHA256 with your endpoint secret over
<webhook-id>.<webhook-timestamp>.<body>. More than one appears while a secret rotates.
Body
Equal to the webhook-id header.
^evt_[0-9a-hjkmnp-tv-z]{26}$Always event.
"event"The event type, connection.created or connection.revoked.
connection.created, connection.revoked The API version data.object is rendered in.
true for live events, false for test events.
Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.
When the event happened.
The connection in object and, when the event changed it, the old values of the
changed fields in previous_attributes.
Show child attributes
Show child attributes
The connected licensee the event concerns, when it is not your own account.
^acct_[0-9a-hjkmnp-tv-z]{26}$Response
Return any 2xx status within 10 seconds. Anything else is retried.