Skip to main content
WEBHOOK

Headers

​
X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication. Dedup on the delivered event's id, not on this header.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

Body

application/json

Root standing status PENDING → ACTIVE: OpenFX put the account in good standing, so a payout may now name it, as receiver or as sender. ACTIVE is reached only from PENDING, so data.previousStatus is PENDING.

​
object
string
required

The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.

Allowed value: "event"
Example:

"event"

​
id
string
required

Event identifier, the client's dedup key for this delivery.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"evt_5EdynMEiYSyiWAH9GpcbHp"

​
type
string
required

Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.

Allowed value: "accounts"
Example:

"accounts"

​
eventType
string
required

Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).

Allowed value: "common.account.activated"
Example:

"common.account.activated"

​
createdAt
string<date-time>
required

Event timestamp.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-06-04T10:30:00.000Z"

​
data
object
required

The Account resource plus event-only context, embedded as data on the account's root events: common.account.created, common.account.activated, common.account.rejected, common.account.requires_information and common.account.archived.

data.status carries the root standing as it stood when the event was emitted and data.previousStatus the one it moved from. Each capability's status rides on data.capabilities[], and each capability's settle is announced by the common.account.capability_* events. identity is not delivered to webhook endpoints; read it from GET /v3/common/accounts/{accountId}.

Response

200

Return any 2xx to acknowledge receipt of the event.