Skip to main content
WEBHOOK

Headers

webhook-id
string
required

The event's id (evt_…), the same on every attempt: store it to drop a delivery you already handled.

webhook-timestamp
string
required

When this attempt was sent, in Unix seconds. Refuse one more than five minutes off your clock.

webhook-signature
string
required

v1, and the base64 HMAC-SHA256 of {webhook-id}.{webhook-timestamp}.{body}, keyed with the endpoint's secret. While a rotated secret overlaps, two signatures, space-separated: accept either.

user-agent
string
required

Who is calling.

Body

application/json
id
string
required
Pattern: ^evt_[0-9a-f]{32}$
type
string
required
Allowed value: "lookup.email_verified"
timestamp
string<date-time>
required
apiVersion
string
required
Pattern: ^[0-9]{4}-[0-9]{2}$
team
object
required
actor
object | null
required
data
object
required

Response

Received. Any 2xx within 15 seconds counts; anything else, or no answer, is retried.