role.* events
Role create, update and delete.
Role create, update and delete. Creating and updating a role are Growth-tier capabilities; deleting is not.
Background
Example envelope
{
"id": "evt_01HX...",
"type": "role.updated",
"created_at": "2026-05-18T10:05:00Z",
"api_version": "2026-05-01",
"project_id": null,
"data": {
"team_id": "a83f0d51-4c92-4b7e-8615-2fd9e70a3c86",
"role_id": "d05e1a83-7c46-4f29-b613-8ae407c9d251",
"code": "plan-editor",
"name": "Plan Editor"
}
}project_id is always null for role.* events; these are account-level.
Required ability
Tokens subscribing to role.* events must carry role:view at mint time.
Events
role.createdA new role is created within a team.role.updatedA role's name or abilities change.role.deletedA role is deleted. Only roles no collaborator currently holds can be deleted.role.created
WEBHOOKA new role is created within a team.
When this fires
Any member of the team (or a token carrying role:create) creates a new role. It also fires three times when a team is first seeded, once for each default role.
Caveats
- The full ability list is not embedded in this event; fetch the role from the API for complete detail.
- The three default roles a new team is seeded with (
admin,manager,viewer) emit this event too, one per role, at the moment the team is created.
Related events
role.updated: subsequent edits.role.deleted: terminal state.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
role.updated
WEBHOOKA role's name or abilities change.
When this fires
A role's name, description, or permission set is saved, including the default admin, manager and viewer roles. The event is emitted on every save, even one that changes nothing, so treat it as "the role was written" rather than "the role changed".
Caveats
- This event fires on both name changes and ability-set changes; fetch the role from the API to determine what actually changed.
- Collaborators currently holding the role pick up the new abilities immediately on next request.
Related events
role.created: predecessor.team.member.role_changed: fires when a collaborator's role assignment changes (different surface).
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
role.deleted
WEBHOOKA role is deleted. Only roles no collaborator currently holds can be deleted.
When this fires
A role that no collaborator currently holds is deleted. A role still assigned to someone cannot be deleted at all; the database refuses it.
Caveats
- Deleting is restricted to the role's creator, unless the caller owns the team: a team owner can delete any role in their team, including the default
admin,managerandviewerroles. The dashboard hides the action for roles you did not create; the API and MCP surfaces do not.
Related events
role.created: first event in the lifecycle.team.member.role_changed: emits for explicit role re-assignments.
Ability to subscribe
A token needs this to subscribe an endpoint to the event.
Header Parameters
t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.
The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.
The event name, the same as the envelope's type.
Always application/json.
Always Subscriby-Webhooks/1.0.
Payload
JSONWhat Subscriby posts to your endpointapplication/json
The signed JSON envelope posted to your endpoint.
The envelope every event is delivered in.
Responses
2XXAny success status
Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.
defaultAny other status
Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.
How is this guide?