Skip to main content
WEBHOOK
Planned protocol reference. The current Talent API sandbox does not register webhook endpoints or deliver events. Use polling and the test escalation helper for supported sandbox transitions. Start with the runnable quickstart and sandbox support matrix.

What to do

  1. Stop acting for the talent. Talent-side calls for them fail with mandate_required from this moment.
  2. Remove their escalations and drafts from your queues. Open drafts are discarded. Licenses already signed stay in force unless the talent revoked them with the mandate: read the revocation named in revocation, whose targets.licenses lists them.
Return a 2xx within 10 seconds, then do the work. Deliveries can repeat; ignore an event ID you have processed.

List mandates

Revocation

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

webhook-id
string
required

The event ID. Use it to ignore duplicate deliveries.

webhook-timestamp
string
required

Unix seconds when this delivery was signed. Reject deliveries more than 5 minutes old.

webhook-signature
string
required

Space-separated v1,<base64> signatures: HMAC-SHA256 with your endpoint secret over <webhook-id>.<webhook-timestamp>.<body>. More than one appears while a secret rotates.

Body

application/json
id
string
required

Equal to the webhook-id header.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always event.

Allowed value: "event"
type
enum<string>
required

mandate.created or mandate.ended.

Available options:
mandate.created,
mandate.ended
api_version
string
required

The API version data.object is rendered in.

livemode
boolean
required

true for live events, false for test events.

sequence
integer
required

Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.

created_at
string<date-time>
required

When the event happened.

data
object
required

The mandate and, for mandate.ended, the fields that changed.

account
string | null

The connected licensee the event concerns, when it is not your own account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$

Response

200

Return any 2xx status within 10 seconds. Anything else is retried.