API reference

The webhook event envelope

Every webhook shares one envelope shape. The outer object identifies the event (id, type, created), flags whether it is live or test (livemode), pins the payload schema (api_version) and carries the resource under data.object. Routing on type and reading data.object is all most handlers ever need.

2 min read

evt_…Event id prefix
data.objectWhere the resource lives
api_versionPins payload schema

Envelope fields

FieldTypeNotes
idstringUnique event id, evt_-prefixed. Use it to deduplicate.
typestringDotted event type, e.g. decision.completed. Route on this.
createdstringRFC 3339 UTC timestamp of when the event occurred.
livemodebooleantrue for production, false for sandbox events.
api_versionstringDate-versioned schema of data.object, e.g. 2026-07-01.
data.objectobjectThe resource the event is about, in the shape of its API representation.
data.previousobjectPresent on *.updated events: the changed fields’ prior values.

Example

{
  "id": "evt_7Q2M9X",
  "type": "decision.completed",
  "created": "2026-07-04T10:02:41Z",
  "livemode": true,
  "api_version": "2026-07-01",
  "data": {
    "object": {
      "id": "dec_5H2N8",
      "enquiry_id": "enq_9F3K2P",
      "outcome": "approved",
      "amount": 25000,
      "currency": "GBP",
      "term_months": 12
    }
  }
}

Versioning

api_version tells you which schema data.object follows. A new version never changes the meaning of an existing field; it only adds fields or introduces a new type. Pin your parser to the version you tested against and treat unknown fields as forward-compatible. See webhook API versioning.

Frequently asked questions

Is data.object always the full resource?

It is the resource in the same shape the corresponding read endpoint returns, snapshotted at the moment the event fired. If the resource changed again after the event, re-fetch it from the API for the current state.

When is data.previous populated?

Only on *.updated events. It contains just the fields that changed, with their values before the change — handy for computing diffs without a prior copy.

Should I trust livemode from the body?

Yes, but verify the signature first. A test-mode endpoint should reject livemode:true events and vice versa as a safety check.

Funding for UK limited companies

Credicorp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.