Account created

wbhk

account_created

ZyINS POSTs this event when a new acct_* record is provisioned. Use it to kick off onboarding emails, CRM inserts, or internal approval workflows. Treat signature verification failures as attacker traffic — respond 401 and do not process the JSON body. Delivery is at-least-once — deduplicate on the event's id field in the JSON body.

Payload

Outbound webhook event envelope per ADR-014. Every webhook
POST from ZyINS to your endpoint uses this shape. The data
property contains the event-specific payload.

string

required

Globally unique event ID (ULID with evt_ prefix).

object

string

enum

required

Resource type discriminator.

Allowed:

type

string

enum

required

Event type name in dotted resource.action format.
Consumers route on this field.

api_version

string

required

API version the event payload conforms to.

livemode

boolean

required

true for live mode, false for test mode.

created_at

date-time

required

When the event was emitted (RFC 3339 UTC).

data

object

required

Event-specific payload. Shape depends on the type
field. See individual event documentation.

Headers

X-ZyINS-Signature

string

required

Emission timestamp and HMAC-SHA256 digest combined as t=<unix_seconds>,v1=<hex_digest>. Recompute the HMAC over <t>.<raw_body> and compare the v1 field in constant time. The event id and type are in the JSON body, not in headers.

Response

200

Acknowledge receipt with HTTP 200 (empty body allowed).