access_code.* events
Access-code batch generation, redemption, and expiry.
Emitted at the batch level for generation (never per-code, to prevent fan-out) and per-code for redemption and expiry.
Events
access_code.generated
Bulk-generate job completes.
access_code.redeemed
Code successfully redeemed by a subscriber.
access_code.expired
Code passes expiry without redemption.
| Event | Fires when |
|---|---|
access_code.generated | A bulk-generate job completes. Carries the batch size, not individual codes. |
access_code.redeemed | A code is successfully redeemed by a subscriber. |
access_code.expired | A code passes its expiry window without being redeemed. |
See the dedicated pages above for full payload, field reference, and caveats per event.
Example payload — access_code.generated
{
"id": "evt_01HX...",
"type": "access_code.generated",
"created_at": "2026-05-18T10:05:00Z",
"api_version": "2026-05-01",
"project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
"data": {
"plan_id": "c4e82f16-93a7-4d5b-b81c-6e0f27a94d3b",
"plan_name": "Premium Monthly",
"count": 250,
"expires_at": "2026-08-18T00:00:00Z"
}
}Example payload — access_code.redeemed
{
"id": "evt_01HX...",
"type": "access_code.redeemed",
"created_at": "2026-05-18T10:05:00Z",
"api_version": "2026-05-01",
"project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
"data": {
"subscription_id": "5b7e2d40-1a86-4c39-97f2-e83d0b16c5a4",
"project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
"plan_id": "c4e82f16-93a7-4d5b-b81c-6e0f27a94d3b",
"subscriber_id": "2a91c4e7-6f38-4b52-8e0d-9c1a7b3f5d80",
"access_code": "9c1a7b3f-5d80-4e62-a4f1-0b83d2e6c517"
}
}The access_code string is the full redeemed code, not a masked fragment. It is already consumed and cannot be redeemed again, but treat it as a customer identifier and avoid forwarding it to systems you do not control.
Why batch, not per-code
A 10,000-code bulk generation would produce 10,000 webhook deliveries per subscribed endpoint otherwise. The generated event fires once per batch with the count, and the per-code events fire later as codes are actually used.
Required abilities
Tokens subscribing to access_code.* events must carry project-access-code:view.
How is this guide?