Skip to main content
WEBHOOK

Headers

​
X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication. Dedup on the delivered event's id, not on this header.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

Body

application/json

A capability moved PENDING → ACTIVE: it may now back its activity on a payout. Fires once per capability transition rather than once when every one has settled, and however fast the settle came: a check that resolves inside the create call itself fires it too, so this event can be delivered before common.account.created, or before the creating caller has read the response that already reports the capability ACTIVE.

data.capability names which capability moved; its new status is on data.capabilities[].

​
object
string
required

The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.

Allowed value: "event"
Example:

"event"

​
id
string
required

Event identifier, the client's dedup key for this delivery.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"evt_5EdynMEiYSyiWAH9GpcbHp"

​
type
string
required

Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.

Allowed value: "accounts"
Example:

"accounts"

​
eventType
string
required

Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).

Allowed value: "common.account.capability_activated"
Example:

"common.account.capability_activated"

​
createdAt
string<date-time>
required

Event timestamp.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-06-04T10:30:00.000Z"

​
data
object
required

The Account resource plus event-only context, embedded as data on every common.account.capability_* webhook/event: the three settle events.

data.capability names the capability this event concerns and the status that cell moved from; its current status is read off data.capabilities[], alongside every other capability's. data.previousStatus carries the account's root standing, which a capability transition leaves unmoved, so it equals data.status. identity is not delivered to webhook endpoints; read it from GET /v3/common/accounts/{accountId}.

Response

200

Return any 2xx to acknowledge receipt of the event.