Skip to main content
WEBHOOK
Planned protocol reference. The current Talent API sandbox does not register webhook endpoints or deliver events. Use polling and the test escalation helper for supported sandbox transitions. Start with the runnable quickstart and sandbox support matrix.

What to do

  1. Embed c2pa in the output’s C2PA manifest and show the disclosure label.
  2. Deliver the output.
Return a 2xx within 10 seconds, then do the work. Deliveries can repeat; ignore an event ID you have processed.

Submit outputs

Embed provenance

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

webhook-id
string
required

The event ID. Use it to ignore duplicate deliveries.

webhook-timestamp
string
required

Unix seconds when this delivery was signed. Reject deliveries more than 5 minutes old.

webhook-signature
string
required

Space-separated v1,<base64> signatures: HMAC-SHA256 with your endpoint secret over <webhook-id>.<webhook-timestamp>.<body>. More than one appears while a secret rotates.

Body

application/json
id
string
required

Equal to the webhook-id header.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always event.

Allowed value: "event"
type
enum<string>
required

generation.allowed, generation.released, generation.denied or generation.expired.

Available options:
generation.allowed,
generation.released,
generation.denied,
generation.expired
api_version
string
required

The API version data.object is rendered in.

livemode
boolean
required

true for live events, false for test events.

sequence
integer
required

Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.

created_at
string<date-time>
required

When the event happened.

data
object
required

The generation in object, and the fields that changed in previous_attributes.

account
string | null

The connected licensee the event concerns, when it is not your own account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$

Response

200

Return any 2xx status within 10 seconds. Anything else is retried.