project.* events
Project lifecycle, resource link / unlink, payment method changes.
Project lifecycle, resource link / unlink, payment method changes. Fires whenever a project is created, updated, archived, restored, or deleted, plus transitions on its resources and payment methods. A project's connectors have their own family, connector.*.
Background
Example payload
{
"id": "evt_01HX...",
"type": "project.created",
"created_at": "2026-05-18T10:05:00Z",
"api_version": "2026-05-01",
"project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
"data": {
"project": {
"id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
"name": "Research Premium",
"handle": "research-premium",
"active": true,
"team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86"
}
}
}Required abilities
This family is the one exception to "one ability per family": the resource and payment-method events are scoped separately from the project itself.
| Events | Ability |
|---|---|
project.created, project.updated, project.archived, project.restored, project.deleted | project:view |
project.resource.created, project.resource.linked, project.resource.unlinked, project.resource.updated, project.resource.deleted, project.resource.status_changed | project-resource:view |
project.payment_method.updated, project.payment_method.deleted | project-payment-method:view |
Events
project.createdA creator registers a new project.project.updatedAny mutable project field changes.project.archivedCreator archives the project; access is suspended.project.restoredAn archived project is re-activated.project.deletedProject hard-deleted. Final event from that project.project.resource.createdA manual perk is registered under a project.project.resource.linkedA place a creator picked on a connector becomes a resource of a project.project.resource.unlinkedResource disconnected from a project.project.resource.deletedResource soft-deleted from a project.project.resource.updatedA resource's title, description or on/off switch changes, or a recovery moves it onto another place.project.resource.status_changedA channel or group enters or exits a degraded state: banned, deleted, or the bot lost its rights.project.payment_method.updatedA payment gateway's credentials, link state or on/off switch changes.project.payment_method.deletedA payment gateway is removed from a project.project.created
WEBHOOKA creator registers a new project.
When this fires
A creator registers a new project. The event lands the moment the new project becomes available for further configuration.
The project description is not included in the snapshot. Fetch it with the project endpoint if you need it.
Caveats
- Use the
SB-Event-Idheader to dedupe deliveries; it carries the same ULID asid, without theevt_prefix. project.createdfires only for projects created through the REST API or MCP; projects created in the dashboard emit noproject.created, so it is not guaranteed to be the first event you see for aproject_id. Subsequent events on the same project may interleave.- Archived/restored states are a separate event pair: listen for
project.archivedandproject.restoredrather than relying ondata.project.activeflipping insideproject.updated.
Related events
project.updated: fires on subsequent mutable-field changes.project.archived: paired withproject.restoredfor soft-disable transitions.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.updated
WEBHOOKAny mutable project field changes.
When this fires
Any mutable field on a project changes: display name, handle, description, terms, privacy text, or other dashboard-editable settings. State-flag transitions (archive, restore) emit dedicated events instead.
Caveats
- The
changesblock contains only the fields that mutated; unchanged fields are not included. changescan report fields theprojectsnapshot does not carry:description,terms,privacy,metrics,banner_url, andphoto_url. Read the new value fromchanges[field].to, or fetch the project from the project endpoint.POST /v1/projects/{project}/archiveand/restoreemit the dedicatedproject.archived/project.restoredevents, but a plainPATCHthat setsactivereports the flip inchanges.activeonproject.updatedinstead. Handle both.- Connecting or disconnecting an installation does not trigger
project.updated; it emitsconnector.connected/connector.disconnected.
Related events
project.created: predecessor for anyproject.updatedevent.project.archived,project.restored: dedicated state-transition events.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.archived
WEBHOOKCreator archives the project; access is suspended.
When this fires
A project is archived through POST /v1/projects/{project}/archive or the MCP archive_project tool. Archiving from the dashboard does not emit this event. The only state change is the project's active flag flipping to false; existing subscriptions and the public landing page are untouched.
Caveats
- Archive is reversible; pair with
project.restoredfor the inverse transition. - Subscribers retain their existing access until their
ends_atticks over. Expectsubscription.expiredevents to follow as those subscriptions wind down. - Hard-delete fires
project.deletedinstead and is final.
Related events
project.restored: paired transition.project.deleted: terminal state, replaces archive when the row is hard-deleted.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.restored
WEBHOOKAn archived project is re-activated.
When this fires
A previously archived project is restored. The public landing page becomes reachable again, the active flag returns to true, and new subscriptions can be created.
Caveats
- Existing churned subscribers do not auto-re-activate. They must redeem a new subscription, which triggers
subscription.created. - Connector installations persist across archive / restore. No
connector.*events fire on restore.
Related events
project.archived: paired transition.subscription.created: emits when subscribers rejoin.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.deleted
WEBHOOKProject hard-deleted. Final event from that project.
When this fires
A project is hard-deleted by the creator. The project row and dependent data are removed; this is the final event you will receive for that project_id.
This is the final event you will receive for the given
project_id. Stop emitting requests against this project after delivery.
Caveats
- After this event, the project's API endpoints will respond
404. Treat the row as gone. - Dependent rows (plans, subscriptions, resources) cascade but do not fan out their own
*.deletedevents. Handle the project-level cleanup once. - Webhook subscriptions targeting only this project should be torn down on your side; the platform stops emitting events for it.
Related events
project.archived: typical predecessor.project.created: first event in the lifecycle.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.resource.created
WEBHOOKA manual perk is registered under a project.
When this fires
A creator registers a manual perk on the project, from the dashboard's resource editor, POST /v1/projects/{project}/resources or the create_resource tool. A place a connector gates never arrives here: the connector links it and announces project.resource.linked instead.
The resource description is not included in the payload. Fetch it with the resource endpoint if you need it.
Caveats
project.resource.linkedis not a follow-up to this event; it creates its own resource row and carries a differentresource_id.- A manual perk is bound to no place and is not linkable; it appears once on creation and once on deletion.
Related events
project.resource.linked: a place a connector gates becomes a resource.project.resource.deleted: terminal state for a resource.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.resource.linked
WEBHOOKA place a creator picked on a connector becomes a resource of a project.
When this fires
A creator links a place from a connector: a channel, group or supergroup from the bot's picker, or any connector's own picker answering a link request. The connector writes the resource row and this event announces it. This creates the resource row; no project.resource.created precedes it.
Caveats
- Re-linking a place after an unlink creates a new resource row. The
project.resource.linkedyou receive carries a differentresource_idthan the earlierproject.resource.unlinked, and the unlinked row remains behind withspace: null. - Linking the same place to the same project twice announces nothing the second time: the connector's write is idempotent and answers the existing resource.
- A manual perk cannot be linked; it has no underlying place, so its
kindismanualand it arrives throughproject.resource.created.
Related events
project.resource.unlinked: paired transition.project.resource.created: the separate REST / MCP path for manual perks; not a predecessor of this event.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.resource.unlinked
WEBHOOKResource disconnected from a project.
When this fires
A previously linked place is unbound from the resource by the creator, through the REST API or MCP.
Caveats
- The resource row is preserved; only the place binding is removed. To delete it entirely, see
project.resource.deleted. - Active subscribers may receive
member.resource_removedas access is revoked.
Related events
project.resource.linked: paired transition.project.resource.deleted: terminal state.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.resource.deleted
WEBHOOKResource soft-deleted from a project.
When this fires
A resource is soft-deleted by the creator through the REST API or MCP. Existing subscriber access to the underlying place is not revoked by this action and no member.resource_removed events follow from it.
This is the final event you will receive for the given
resource_id. The row is retained withdeleted_atstamped and disappears from the API.
Caveats
- After this event, API endpoints scoped to the resource respond
404.
Related events
project.resource.unlinked: typical predecessor.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
project.resource.updated
WEBHOOKA resource's title, description or on/off switch changes, or a recovery moves it onto another place.
When this fires
A creator changes one of the three editable fields on a resource (title, description or active) and at least one of them is actually different afterwards. Every surface that can make that change raises it:
- Dashboard: the resource editor on the project's Resources page, and the on/off switch on each resource row.
- REST:
PATCH /v1/projects/{project}/resources/{resource}for title and description edits, andPOST /v1/projects/{project}/resources/{resource}/activate/deactivatefor the switch. - MCP: the
update_resource,activate_resourceanddeactivate_resourcetools.
It also fires when the place behind a resource is swapped: a Disaster Recovery replacement, an automatic failover to a standby, Swap & Grant Resource from the resources list, or the undo of any of those. That event carries changes.space_id with the previous and the new space, changes.kind when the platform upgraded the place in the same move (a group that became a supergroup), and resource.space already reads the new place.
It does not fire when:
- Nothing changed. A
PATCHthat re-sends the stored values, or anactivatecall on a resource that is already active, writes nothing and emits nothing. - The place is linked for the first time or removed. That is the connector's link (
project.resource.linked) or an unlink (project.resource.unlinked). - The resource is deleted. That is
project.resource.deleted, and noupdatedevent precedes it.
There are no
project.resource.activated/deactivatedevents. Switching a resource on or off arrives here, aschanges.active, alongside title and description edits. One save is one event, and it lists only what changed.
Caveats
- The
descriptionis not in theresourcesnapshot, matching every otherproject.resource.*event, but when the description is what changed,changes.description.tocarries the new text in full. Read it from there rather than following up with a request to the resource endpoint. - Switching a resource off does not touch the plans that sell it. The connector stops granting that one place while the plans keep selling everything else, so a
changes.activeflip tofalseis "this perk is paused", not "this plan changed". Noplan.updatedfollows. - An
activate/deactivatecall and aPATCHthat setsactiveproduce the same event with the samechanges.activeshape. The payload does not say which route was used. - A swap that also switches an inactive resource back on carries
changes.activebesidechanges.space_id, because the swap reactivates what it repairs. changescontains only the fields that mutated. APATCHcarrying all three fields where only one differs reports one key.
Related events
project.resource.created: the manual perk this event later edits.project.resource.linked/project.resource.unlinked: the place bound for the first time or removed, which this event never reports.project.resource.deleted: terminal state for a resource.project.resource.status_changed: the health transition that usually precedes a recovery swap.recovery.resource_replaced/recovery.resource_failed_over: the recovery ledger's own word for the same swap.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
A channel or group enters or exits a degraded state: banned, deleted, or the bot lost its rights.
When this fires
A channel or group linked to a project transitions into or out of a degraded state. The degraded reasons are:
reason | What the platform told us | Recovery |
|---|---|---|
chat_not_found | The chat no longer exists: deleted, or banned by the platform. | Replace the chat (a channel recovery). |
bot_removed | Our bot was removed from the chat, so it can no longer admit or remove members. | Re-add the bot as an administrator, or replace the chat. |
bot_not_administrator | The bot is still in the chat but lost its administrator role. | Promote it again with the invite and restrict rights. |
bot_missing_rights | The bot is an administrator without the invite users or restrict members right. | Grant both rights again. |
connector_api_error | The platform refused the probe for a reason we could not classify. | Re-check; replace the chat if it persists. |
The healthy event carries reason: null and fires when a probe finds the resource answering again, or when a recovery re-points it at a new chat.
A chat_not_found or bot_removed transition also opens a recovery incident on the creator's Disaster Recovery page, alerts them by email and on their connected account, and, on Growth, with automatic failover switched on, swaps the resource for its standby without anyone signed in.
It does not fire when:
- A probe finds the same state as last time. Only transitions are announced.
- A probe cannot reach the platform at all. A transport failure keeps the previous state.
- The resource is a manual perk. Only channels and groups are probed.
Fires on a transition, not on a schedule. Subscriby probes every linked channel and group hourly, every five minutes while a pass window is open or imminent, and immediately when real work fails (an invite link cannot be minted, a join request cannot be approved). You get one event when the resource breaks and one when it recovers, never an event per probe.
Related events
connector.status_changed: the same idea for the project's installation.project.resource.updated: fires withchanges.space_idwhen a recovery re-points the resource at a replacement place.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
A payment gateway's credentials, link state or on/off switch changes.
When this fires
A payment method on the project changes and at least one of active, linked or a key inside its stored config is different afterwards. The surfaces that raise it:
- Dashboard: the payment method editor on the project's Payment Methods page (credentials and switches), and the on/off toggle on each gateway row.
- Bot: the main bot's payment-method wizard, when a creator walks through connecting a gateway that the project already has in that mode. The wizard re-saves the row through the same path as the dashboard.
- REST:
POST /v1/projects/{project}/payment-methods/{method}/activateand/deactivate. There is noPATCHfor payment methods, so credentials cannot be rotated over REST. - MCP: the
activate_payment_methodanddeactivate_payment_methodtools.
It does not fire when:
- Nothing changed. Activating a gateway that is already on, or re-saving identical credentials, writes nothing and emits nothing.
- A Stripe method is switched on before its Connect account is attached. The call is refused, the row is untouched and there is no event.
- Stripe Connect onboarding completes or is disconnected. Those flows write the row directly and raise no event, even though they change
linkedandactive. - A gateway is first set up. There is no
project.payment_method.createdevent; the first thing you hear about a new gateway is its first update or its deletion. - The gateway is removed. That is
project.payment_method.deleted.
This payload never carries a credential. When gateway keys are rotated,
changes.config.keysnames which keys changed (["clientId"],["secret"]) and nothing else. Neither the old nor the new value is sent, and thepayment_methodsnapshot has noconfigat all.
Caveats
linkedcan appear inchangesbut is not in the snapshot. Read the new value fromchanges.linked.to, or from the payment method endpoint, which does carrylinked.modenever appears inchanges. A row's mode is fixed (live and test are separate rows), so switching a gateway from test to live is a different method with a differentid, not an update to this one.- Every update re-queues a sync of the project's plans to that gateway, so a
plan.sync_completedper active plan usually follows within a minute. Rotated credentials may point at a different gateway account whose catalogue has never seen the plans. config.keysare the gateway's own field names as Subscriby stores them (clientId,secret,publicKey, …), not a normalised list. Stored config is merged on save, so a key is reported when its value changed or was added; keys are never removed through an update.- Switching a gateway off does not affect subscriptions already sold through it; they keep renewing. It only stops new buyers being offered that gateway.
Related events
project.payment_method.deleted: the gateway is removed from the project.plan.sync_completed: the catalogue re-push that follows each update.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
A payment gateway is removed from a project.
When this fires
A creator removes a payment method from the project:
- Dashboard: the remove action on the project's Payment Methods page.
- Bot: the main bot's payment-method menu, "disconnect" on a connected gateway.
- REST:
DELETE /v1/projects/{project}/payment-methods/{method}. - MCP: the
delete_payment_methodtool.
It does not fire when:
- A gateway is switched off. That is
project.payment_method.updatedwithchanges.active, and the row stays. - A Stripe method is disconnected from its Connect account. The row is kept (unlinked and inactive) and that flow raises no event at all.
- The row was already gone. Deleting twice writes nothing the second time and emits nothing.
The row is soft-deleted, not destroyed. Subscriptions sold through the gateway keep pointing at it for refunds and history, and if the creator sets the same gateway up again in the same mode, the same row is revived. Expect this
idto come back to life, and remember there is noproject.payment_method.createdevent to tell you when it does.
Caveats
active: truehere means the creator removed a gateway that was live for new purchases. If you mirror the project's checkout options anywhere, this is the event to react to; a deactivation would have arrived asupdatedfirst.- Existing subscriptions are untouched. Their renewals, refunds and history keep referencing this gateway even though the row no longer appears in the project's payment methods list.
linkedis not in the snapshot, and nothing about the gateway's credentials or connected account is ever sent.
Related events
project.payment_method.updated: every change to the gateway before this one, including switching it off.project.deleted: a project going away takes its gateways with it without a per-gateway event.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
How is this guide?