License locked

wbhk

license_locked

ZyINS POSTs this event when a license becomes locked after abuse or admin action, signaling that downstream access should be suspended immediately. For voluntary product cancellations without a lock, listen for license.deactivated instead. Verify X-ZyINS-Signature in constant time and reject clock-skewed requests; never apply unsigned payloads. Delivery is at-least-once — deduplicate on the event's id field in the JSON body.

Payload

Outbound webhook event envelope per ADR-014. Every webhook
POST from ZyINS to your endpoint uses this shape. The data
property contains the event-specific payload.

string

required

Globally unique event ID (ULID with evt_ prefix).

object

string

enum

required

Resource type discriminator.

Allowed:

type

string

enum

required

Event type name in dotted resource.action format.
Consumers route on this field.

api_version

string

required

API version the event payload conforms to.

livemode

boolean

required

true for live mode, false for test mode.

created_at

date-time

required

When the event was emitted (RFC 3339 UTC).

data

object

required

Event-specific payload. Shape depends on the type
field. See individual event documentation.

Headers

X-ZyINS-Signature

string

required

Emission timestamp and HMAC-SHA256 digest combined as t=<unix_seconds>,v1=<hex_digest>. Recompute the HMAC over <t>.<raw_body> and compare the v1 field in constant time. The event id and type are in the JSON body, not in headers.

Response

200

Acknowledge receipt with HTTP 200 (empty body allowed).