group.* events
Groups bundle collaborators for access control: a named permission set that several people in a team share, and someone can be in more than one.
Groups bundle collaborators for access control: a named permission set that several people in a team share, and someone can be in more than one. They are not a way to bundle projects. Creating and updating a group are Growth-tier capabilities; deleting is not, and a member sync is gated only when it adds somebody.
Renaming and re-staffing are separate events.
group.updatedcovers what the group is;group.members_syncedcovers who it applies to. A consumer mirroring access control needs the second one: before it existed, changing who a permission set applied to announced nothing while renaming the same group announced itself.
Background
Example envelope
{
"id": "evt_01HX...",
"type": "group.updated",
"created_at": "2026-05-18T10:05:00Z",
"api_version": "2026-05-01",
"project_id": null,
"data": {
"team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86",
"group_id": "1f68d92a-04c5-4e83-97b1-3d6a05e2f847",
"code": "core-community",
"name": "Core Community"
}
}project_id is always null for group.* events; these are account-level.
Required ability
Tokens subscribing to group.* events must carry group:view at mint time.
Events
group.createdA new team group is created.group.updatedA group is renamed or its permission set replaced.group.members_syncedThe set of people in a group changed, with the deltas.group.deletedA group is deleted; its members lose the permissions it granted.group.created
WEBHOOKA new team group is created.
When this fires
A team owner or manager creates a new group. Groups bundle collaborators behind a shared permission set: several people in a team can be in the same group, and someone can be in more than one.
Caveats
- Neither the permission set nor the member list is embedded in this event; read the group endpoint for the group's current permissions, and expect
group.members_syncedwhen people are put into it. - Changing who is in the group emits
group.members_synced, not this event;team.member.role_changedcovers a member's team role and is unrelated to groups.
Related events
group.updated: subsequent edits.group.deleted: terminal state.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
group.updated
WEBHOOKA group is renamed or its permission set replaced.
When this fires
A group is renamed, or the permissions attached to it are replaced. Who is in the group is a separate event, group.members_synced, because the two changes have different consequences. A rename is cosmetic; changing the permission set silently re-scopes everyone already in the group.
Caveats
- The permission set is not in the payload, so this event tells you a group changed without telling you into what. Read the group endpoint for the current permissions.
- Permissions replace, they do not merge. An update that sends
permissionssets them to exactly that list, so everyone in the group can gain and lose access in the same event. codeis immutable, so a rename never breaks a reference held elsewhere.- Membership is untouched here. See
group.members_synced.
Related events
group.members_synced: who is in the group changed.group.created: predecessor.group.deleted: terminal state.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
group.members_synced
WEBHOOKThe set of people in a group changed, with the deltas.
When this fires
The membership of a group is replaced and the result differs from what was there before, via the group members endpoint or the dashboard's group editor.
A group carries permissions, so who is in it decides who can do what. Until this event existed, renaming a group announced itself with group.updated while changing who it granted access to announced nothing at all; an integration mirroring access control could see the label change and miss the membership.
A no-op sync is silent. Syncing the same set that is already there emits nothing. This event means the membership actually moved, so receiving one always implies at least one id in
added_idsorremoved_ids.
Why the deltas are in the payload
An access-control mirror needs to know who lost the group, and diffing two snapshots on the far side is work it should not have to do: it requires having stored the previous state, and gets the answer wrong the first time it sees a group. added_ids and removed_ids are computed where the truth is, from the membership read immediately before the write and the list written immediately after it.
member_ids is still there for consumers that would rather replace their copy than apply a patch. Both are consistent with each other.
Caveats
- This is a replace, not an add. Anyone absent from the request is removed. An empty list empties the group.
- Permissions are not in the payload. What the group grants is a property of the group, not of this event; read it from the group endpoint if your mirror needs the effective permission set.
- Users, not projects. A group clusters collaborators. It is not a way to bundle projects.
- Removal from a group does not remove anyone from the team.
Related events
group.updated: the group was renamed or re-permissioned.group.created: predecessor.group.deleted: terminal state; everyone loses what it granted at once.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
group.deleted
WEBHOOKA group is deleted; its members lose the permissions it granted.
When this fires
A group is deleted. Its permission and ability attachments are detached and its membership rows are removed; the people in it stay in the team but lose whatever the group granted. This is the final event you will receive for the given group_id.
Caveats
- No per-collaborator event fires: the members' group rows cascade away with the group, and
group.members_syncedis emitted only by an explicit membership sync. - Members of the group are not removed from the team; only the group and the access it granted go away.
Related events
group.created: first event in the lifecycle.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
How is this guide?
support.* events
Member support inbox: conversations opened, replied to, assigned and resolved.
recovery.* events
The Disaster Recovery ledger as it moves: incidents opening and resolving, recoveries starting, finishing, failing and being undone, standbys kept and consumed, channels swapped and accounts relinked.