Account suspended

wbhk

account_suspended

ZyINS POSTs this event when an account is suspended, preventing all credentials from authenticating; existing sessions are revoked within 24 hours, and the suspension is reversible. Use it to gate downstream access by disabling UI or revoking seats. Read the reason field in the payload to distinguish billing vs. policy suspension. Verify X-ZyINS-Signature in constant time before acting on the body. Delivery is at-least-once — deduplicate on the event's id field in the JSON body.

Payload

Outbound webhook event envelope per ADR-014. Every webhook
POST from ZyINS to your endpoint uses this shape. The data
property contains the event-specific payload.

string

required

Globally unique event ID (ULID with evt_ prefix).

object

string

enum

required

Resource type discriminator.

Allowed:

type

string

enum

required

Event type name in dotted resource.action format.
Consumers route on this field.

api_version

string

required

API version the event payload conforms to.

livemode

boolean

required

true for live mode, false for test mode.

created_at

date-time

required

When the event was emitted (RFC 3339 UTC).

data

object

required

Event-specific payload. Shape depends on the type
field. See individual event documentation.

Headers

X-ZyINS-Signature

string

required

Emission timestamp and HMAC-SHA256 digest combined as t=<unix_seconds>,v1=<hex_digest>. Recompute the HMAC over <t>.<raw_body> and compare the v1 field in constant time. The event id and type are in the JSON body, not in headers.

Response

200

Acknowledge receipt with HTTP 200 (empty body allowed).