Webhooks

A webhook lets an application be notified when a user's access changes, so it can drop cached permissions or react in real time — instead of polling.

Registering

Register one per application (POST /api/webhooks) with the URL to POST to and, optionally, the event types to receive. An empty selection means all events.

const wh = await mgmt.webhooks.register({
  organizationId, applicationId, url: 'https://app.acme.com/hooks/latchvector',
});
// wh.secret is shown exactly once — store it now.

Events

Event	Fired when
role.assigned	A role is assigned to a user
role.revoked	A role is revoked from a user
role.permissions_changed	A role's permission set changes
user.disabled	A user is disabled
user.enabled	A user is re-enabled
user.erased	A user is erased (data erasure)

Verifying the signature

Every delivery is signed with the secret shown at registration. Verify it before trusting the payload — reject anything that doesn't match. Rotate the secret with POST /api/webhooks/{id}/rotate-secret (the old one stops working immediately).

Managing

• PUT /api/webhooks/{id} — change URL, events, or pause/resume (active).
• DELETE /api/webhooks/{id} — stop deliveries.

In the console, an application's webhook URL and on/paused state are shown right in the Applications table.