License activated

wbhk

license_activated

ZyINS POSTs this event to your HTTPS endpoint when a license finishes activation. Use it to provision downstream CRM entries or entitlement systems the moment coverage becomes active. Respond with HTTP 200 within a few seconds to acknowledge receipt and stop retries. Verify X-ZyINS-Signature by parsing its t and v1 fields, recomputing HMAC-SHA256 over <t>.<raw_body> in constant time before mutating any state; reject requests whose t is more than 5 minutes from current UTC. Delivery is at-least-once — deduplicate on the event's id field in the JSON body.

Payload

Outbound webhook event envelope per ADR-014. Every webhook
POST from ZyINS to your endpoint uses this shape. The data
property contains the event-specific payload.

string

required

Globally unique event ID (ULID with evt_ prefix).

object

string

enum

required

Resource type discriminator.

Allowed:

type

string

enum

required

Event type name in dotted resource.action format.
Consumers route on this field.

api_version

string

required

API version the event payload conforms to.

livemode

boolean

required

true for live mode, false for test mode.

created_at

date-time

required

When the event was emitted (RFC 3339 UTC).

data

object

required

Event-specific payload. Shape depends on the type
field. See individual event documentation.

Headers

X-ZyINS-Signature

string

required

Emission timestamp and HMAC-SHA256 digest combined as t=<unix_seconds>,v1=<hex_digest>. Recompute the HMAC over <t>.<raw_body> and compare the v1 field in constant time. The event id and type are in the JSON body, not in headers.

Response

200

Acknowledge receipt with HTTP 200 (empty body allowed).