Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

OAuth 2.0 client credentials. Exchange the client id and secret Securitize issued you for a bearer token at the token URL, with grant_type=client_credentials; the token lasts 2 hours and goes in the Authorization: Bearer header of every request. No scope is needed.

Body

application/json

The body of every webhook, and the payload of every item in the event list. data is the full current state of the object, never a delta.

schemaVersion
string
required

The envelope's own version.

Example:

"1.0"

sourceEventId
string
required

One per event. The deduplication key, and the eventId of the event list. Not the svix-id header, which is the message id.

Example:

"evt_01K7Q3ZVC1J3K5M7P9R1T3V5X7"

eventType
string
required

What happened. What endpoint filters and the eventTypes query use.

Example:

"ca.action.created"

objectType
enum<string>
required
Available options:
TOKEN
objectId
string
required

The sourceCaId, restrictionId or tokenId of the object.

Example:

"ca_01K7Q3ZVB8M2N4P6R8T0V2X4Z6"

version
integer
required

The object's version this event publishes.

Required range: x >= 1
stream
object
required

The token stream the event was published on. The same corporate action is published once per token of its asset you hold.

sequence
integer
required

Strictly increasing within the stream. Gaps are normal: you only receive the events of your tokens.

Example:

148

occurredAt
string<date-time>
required

When the change was recorded.

publishedAt
string<date-time>
required

When the event was published.

environment
enum<string>
required
Available options:
sandbox,
production
changedFields
string[]
required

Dot paths that changed since the previous version; empty on a first version.

Example:
data
object
required

One CET token on one chain.

Response

200

Any 2xx within 10 seconds acknowledges the delivery. Anything else, or no answer, is retried with backoff for up to 72 hours.