Skip to main content
WEBHOOK

Headers

​
X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication. Dedup on the delivered event's id, not on this header.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

Body

application/json

A setup act was declined: the capability moved to REJECTED and cannot be used while that stands, and the remedy is to request a replacement capability rather than a correction. The account's identity and its other capabilities are unaffected. Fires once per capability transition, and however fast the settle came: the create response can already report the capability REJECTED when this event arrives.

data.capability names which capability moved.

​
object
string
required

The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.

Allowed value: "event"
Example:

"event"

​
id
string
required

Event identifier, the client's dedup key for this delivery.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"evt_5EdynMEiYSyiWAH9GpcbHp"

​
type
string
required

Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.

Allowed value: "accounts"
Example:

"accounts"

​
eventType
string
required

Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).

Allowed value: "common.account.capability_rejected"
Example:

"common.account.capability_rejected"

​
createdAt
string<date-time>
required

Event timestamp.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-06-04T10:30:00.000Z"

​
data
object
required

The Account resource plus event-only context, embedded as data on every common.account.capability_* webhook/event: the three settle events.

data.capability names the capability this event concerns and the status that cell moved from; its current status is read off data.capabilities[], alongside every other capability's. data.previousStatus carries the account's root standing, which a capability transition leaves unmoved, so it equals data.status. identity is not delivered to webhook endpoints; read it from GET /v3/common/accounts/{accountId}.

Response

200

Return any 2xx to acknowledge receipt of the event.