Webhook event catalog
Customer-outbound webhook event types (integrator subscriptions). This is not the inbound PSP billing/commerce webhook surface and does not include provider secrets.
Webhooks ≠ Local Relay sync
| Customer webhooks | Local Relay | |
|---|---|---|
| Direction | Platform → your HTTPS endpoint (push notifications) | Relay Host → cloud (outbound sync) + LAN clients → Host |
| Purpose | Integrator automation (CRM, audit, provisioning) | On-site license enforcement with constrained WAN |
| Payload | Event envelope (type, ids, timestamps) — not a signed lease | Leases / validation state in the local store |
| Crypto trust | Optional HMAC on delivery (integrator secret) | Same ES256 / JWKS posture as Runtime (Verify trust) |
Subscribing to webhooks does not replace Runtime validate, lease verify, or Relay. Relay does not “receive cloud webhooks” as its sync model — it pulls/pushes on an outbound Host→cloud channel. Overview: Local Relay.
Delivery security (HMAC)
Outbound delivery to your HTTPS endpoint is signed with an integrator webhook secret (HMAC), not with PSP signing secrets.
- Verify the signature header with your subscription secret before trusting the body.
- Payloads carry ids, status, and timestamps only — no PSP secrets, card PAN, or raw license key plaintext.
- Inbound Stripe/Fake provider webhooks (
/api/v1/commerce/webhooks/{providerId}) are a different surface.
Subscription URL + secret management UX ships with Partner Console Integrations (Wave 71.4). Until then, events are enqueued on the platform outbox for tenant-scoped delivery wiring.
Machine catalog
Download: /artifacts/catalogs/webhook-events.v1.json
Event type values follow {domain}.{entity}.{action}.v{N}. Envelope fields include messageId, correlationId, tenantId, type, occurredAtUtc, and related versioning fields.
Catalog events
| Type | Category |
|---|---|
licensing.license.created.v1 | licensing |
licensing.license.assigned.v1 | licensing |
licensing.license.extended.v1 | licensing |
licensing.license.suspended.v1 | licensing |
licensing.license.revoked.v1 | licensing |
devices.device.registered.v1 | devices |
releases.release.published.v1 | releases |
releases.release.yanked.v1 | releases |
commerce.order.paid.v1 | commerce |
commerce.order.fulfilled.v1 | commerce |
The JSON catalog above is the machine-readable authority; this table is a human summary. See also OpenAPI (Partner subset) and API Reference.