Skip to main content
WEBHOOK
Planned protocol reference. The current Talent API sandbox does not register webhook endpoints or deliver events. Use polling and the test escalation helper for supported sandbox transitions. Start with the runnable quickstart and sandbox support matrix.

What to do

  1. Stop sending checks for the licensee. They fail with account_not_connected.
  2. Tell the licensee’s users in your product that their licensed talent is no longer available.
Return a 2xx within 10 seconds, then do the work. Deliveries can repeat; ignore an event ID you have processed.

Authentication

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

webhook-id
string
required

The event ID. Use it to ignore duplicate deliveries.

webhook-timestamp
string
required

Unix seconds when this delivery was signed. Reject deliveries more than 5 minutes old.

webhook-signature
string
required

Space-separated v1,<base64> signatures: HMAC-SHA256 with your endpoint secret over <webhook-id>.<webhook-timestamp>.<body>. More than one appears while a secret rotates.

Body

application/json
id
string
required

Equal to the webhook-id header.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always event.

Allowed value: "event"
type
enum<string>
required

The event type, connection.created or connection.revoked.

Available options:
connection.created,
connection.revoked
api_version
string
required

The API version data.object is rendered in.

livemode
boolean
required

true for live events, false for test events.

sequence
integer
required

Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.

created_at
string<date-time>
required

When the event happened.

data
object
required

The connection in object and, when the event changed it, the old values of the changed fields in previous_attributes.

account
string | null

The connected licensee the event concerns, when it is not your own account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$

Response

200

Return any 2xx status within 10 seconds. Anything else is retried.