Skip to main content
WEBHOOK
Planned protocol reference. The current Talent API sandbox does not register webhook endpoints or deliver events. Use polling and the test escalation helper for supported sandbox transitions. Start with the runnable quickstart and sandbox support matrix.

What to do

  1. Stop output within one second. The same message arrives on the session stream, usually first.
  2. Do not renew; renewal fails with session_not_active.
  3. Report the session’s usage up to termination.at.
Return a 2xx within 10 seconds, then do the work. Deliveries can repeat; ignore an event ID you have processed.

Real-time sessions

Session stream

Authorizations

Authorization
string
header
required

Your secret key, rk_test_… or rk_live_…, sent as Authorization: Bearer <key>. Keep it on your server. Restricted keys carry only the scopes you give them.

Headers

webhook-id
string
required

The event ID. Use it to ignore duplicate deliveries.

webhook-timestamp
string
required

Unix seconds when this delivery was signed. Reject deliveries more than 5 minutes old.

webhook-signature
string
required

Space-separated v1,<base64> signatures: HMAC-SHA256 with your endpoint secret over <webhook-id>.<webhook-timestamp>.<body>. More than one appears while a secret rotates.

Body

application/json
id
string
required

Equal to the webhook-id header.

Pattern: ^evt_[0-9a-hjkmnp-tv-z]{26}$
object
string
required

Always event.

Allowed value: "event"
type
enum<string>
required

Always session.terminated.

Available options:
session.terminated
api_version
string
required

The API version data.object is rendered in.

livemode
boolean
required

true for live events, false for test events.

sequence
integer
required

Increases by one with each event about the same object. Ignore an event whose sequence is lower than one you have processed.

created_at
string<date-time>
required

When the event happened.

data
object
required

The session in object, and the fields that changed in previous_attributes.

account
string | null

The connected licensee the event concerns, when it is not your own account.

Pattern: ^acct_[0-9a-hjkmnp-tv-z]{26}$

Response

200

Return any 2xx status within 10 seconds. Anything else is retried.