Account closed

wbhk

account_closed

ZyINS POSTs this event when an account is permanently closed. Closure is irreversible — all credentials are immediately revoked and data is scheduled for deletion per the retention policy in the data processing agreement. Use this event to trigger downstream cleanup: removing the account from your CRM, revoking seats, and archiving any data you need before the deletion date in the payload. Verify X-ZyINS-Signature in constant time before acting on the body. Delivery is at-least-once — deduplicate on the event's id field in the JSON body.

Payload

Outbound webhook event envelope per ADR-014. Every webhook
POST from ZyINS to your endpoint uses this shape. The data
property contains the event-specific payload.

string

required

Globally unique event ID (ULID with evt_ prefix).

object

string

enum

required

Resource type discriminator.

Allowed:

type

string

enum

required

Event type name in dotted resource.action format.
Consumers route on this field.

api_version

string

required

API version the event payload conforms to.

livemode

boolean

required

true for live mode, false for test mode.

created_at

date-time

required

When the event was emitted (RFC 3339 UTC).

data

object

required

Event-specific payload. Shape depends on the type
field. See individual event documentation.

Headers

X-ZyINS-Signature

string

required

Emission timestamp and HMAC-SHA256 digest combined as t=<unix_seconds>,v1=<hex_digest>. Recompute the HMAC over <t>.<raw_body> and compare the v1 field in constant time. The event id and type are in the JSON body, not in headers.

Response

200

Acknowledge receipt with HTTP 200 (empty body allowed).