{ "openapi": "3.1.0", "info": { "title": "OfficeHero Integrations API", "version": "2026-05-16", "summary": "Read and write your OfficeHero data from your own systems, and receive signed webhooks when it changes.", "description": "The Integrations API is OfficeHero's public, machine-to-machine REST API.\nEvery request is scoped to the one tenant the API key belongs to.\n\n- **Authenticate** with `Authorization: Bearer oh_live__`.\n Create a key in the Fleet, HR or Finance app under **Settings → API keys**\n and give it only the scopes your integration needs.\n ([Authentication](https://developers.officehero.io/docs/authentication),\n [Scopes](https://developers.officehero.io/docs/scopes))\n- **Pin a version** with the optional `OH-Version: 2026-05-16` header.\n ([Versioning](https://developers.officehero.io/docs/versioning))\n- **Page through lists** with `limit` and the opaque `cursor`.\n ([Pagination](https://developers.officehero.io/docs/pagination))\n- **Retry writes safely** with an `Idempotency-Key` header.\n ([Idempotency](https://developers.officehero.io/docs/idempotency))\n- **Handle errors** by their RFC 9457 `type` and the stable `detail_key`.\n ([Errors](https://developers.officehero.io/docs/errors))\n- **Receive events** by registering a webhook endpoint; every delivery is\n signed. ([Webhooks](https://developers.officehero.io/docs/webhooks))\n\nMoney is an integer amount in the currency's minor unit (`*_minor`) plus an\nISO 4217 `currency`. Timestamps (`*_at`) are RFC 3339 in UTC\n(`2026-09-14T08:30:00Z`); calendar dates (`*_date`) are `YYYY-MM-DD`.\n\n**Using \"Try it\" on developers.officehero.io:** requests go from your browser\nstraight to the API with the key you paste. The key is kept in memory for\nthis page only. Writes change real data, so use a dedicated key with only\nthe scopes you need and an expiry date.\n", "contact": { "name": "OfficeHero developer support", "email": "support@officehero.io", "url": "https://developers.officehero.io/support" }, "termsOfService": "https://officehero.io/terms-and-conditions/", "license": { "name": "Proprietary — use is governed by the OfficeHero terms of service", "url": "https://officehero.io/terms-and-conditions/" } }, "externalDocs": { "description": "Guides, webhooks, error reference and changelog", "url": "https://developers.officehero.io/docs" }, "servers": [ { "url": "https://api.officehero.io", "description": "Production" } ], "tags": [ { "name": "Invoices", "description": "Sales invoices. Read every invoice; create **draft** invoices, change a draft,\nand void an issued invoice. Issuing, sending and recording payments happen in\nthe Finance app.\n" }, { "name": "Payments", "description": "Payments received from customers and paid to suppliers." }, { "name": "Bills", "description": "Purchase invoices (bills) from suppliers." }, { "name": "Purchase orders", "description": "Purchase orders sent to suppliers." }, { "name": "Work orders", "description": "Fleet maintenance and repair work orders." }, { "name": "Vehicles", "description": "The fleet's vehicles." }, { "name": "Fuel logs", "description": "Fuel purchases recorded for vehicles (manual entries, fuel cards, imports, detected refuels)." }, { "name": "Employees", "description": "Employment records from the HR app." }, { "name": "Leave requests", "description": "Employee leave (absence) requests and their approval state." }, { "name": "Timesheets", "description": "Employee timesheets for a period, with their approval state." }, { "name": "Tickets", "description": "Customer and staff support tickets." }, { "name": "Documents", "description": "Files stored in the Documents area (metadata only — the API does not return file contents)." }, { "name": "Webhook endpoints", "description": "Register the HTTPS URLs OfficeHero sends signed event deliveries to. All\nwebhook-endpoint operations need the `int:webhooks:manage` scope.\nSee [Webhooks](https://developers.officehero.io/docs/webhooks).\n" }, { "name": "Webhook deliveries", "description": "Inspect delivery attempts for an endpoint and send them again." }, { "name": "Specification", "description": "This document, as JSON." } ], "x-tagGroups": [ { "name": "Finance", "tags": [ "Invoices", "Payments", "Bills", "Purchase orders" ] }, { "name": "Fleet", "tags": [ "Work orders", "Vehicles", "Fuel logs" ] }, { "name": "HR", "tags": [ "Employees", "Leave requests", "Timesheets" ] }, { "name": "Support", "tags": [ "Tickets" ] }, { "name": "Files", "tags": [ "Documents" ] }, { "name": "Webhooks", "tags": [ "Webhook endpoints", "Webhook deliveries" ] }, { "name": "Specification", "tags": [ "Specification" ] } ], "security": [ { "bearerApiKey": [] } ], "paths": { "/v1/openapi.json": { "get": { "operationId": "getOpenApiDocument", "tags": [ "Specification" ], "summary": "Download this specification", "description": "The OpenAPI 3.1 document for this API — the same file the developer portal\nrenders. No API key needed. Also published at\n`https://developers.officehero.io/openapi/integrations-api.json`.\n\nCacheable for 5 minutes, gzip-compressed when you accept it, and sent with\nan `ETag`: send it back in `If-None-Match` and an unchanged document is a\n`304` with no body.\n", "security": [], "responses": { "200": { "description": "The OpenAPI document.", "headers": { "ETag": { "description": "A strong validator of this version of the document.", "schema": { "type": "string" } }, "Cache-Control": { "description": "`public, max-age=300`.", "schema": { "type": "string" } }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "type": "object" } } } }, "304": { "description": "Not modified — your copy (its `ETag` in `If-None-Match`) is current.", "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } } } } }, "/v1/invoices": { "get": { "operationId": "listInvoices", "tags": [ "Invoices" ], "summary": "List invoices", "description": "Your sales invoices, drafts included — filter on `status` in your code.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fin.invoices:read` (a key with `int:fin.invoices:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.invoices:read" ] } ], "x-oh-scope": "int:fin.invoices:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of invoices.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvoicePage" }, "example": { "data": [ { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "partial", "currency": "EUR", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 50000, "balance_minor": 97500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-21T10:05:44Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2EyLTRiN2UtN2YzMC05YzJlLTZhOGQ0ZjFiMmMwMSIsInRzIjoiMjAyNi0wOS0xNFQwODozMDowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.invoices.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } }, "post": { "operationId": "createInvoice", "tags": [ "Invoices" ], "summary": "Create a draft invoice", "description": "Creates a **draft** sales invoice with its lines and returns it. The invoice\ngets its number when it is issued in the Finance app. Totals are computed\nfrom the lines. Fires `fin.invoice.created`.\n\n**Replace `customer_id` before you send the example**: it must be one of your\nFinance customers, and this API has no customers endpoint. Take it from an\nexisting invoice (`GET /v1/invoices`) or from the customer's page in the\nFinance app. A line's `product_id` and `tax_rate_id` work the same way, and\nare optional.\n\nA draft cannot be voided or deleted through the API: issue it, or delete it,\nin the Finance app.\n\nSend an `Idempotency-Key` so a retry after a timeout cannot create a second\ninvoice.\n\n**Scope:** `int:fin.invoices:write` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:fin.invoices:write" ] } ], "x-oh-scope": "int:fin.invoices:write", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvoiceCreate" } } } }, "responses": { "201": { "description": "The draft invoice.", "headers": { "Location": { "$ref": "#/components/headers/Location" }, "Idempotency-Replayed": { "$ref": "#/components/headers/IdempotencyReplayed" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Invoice" }, "example": { "id": "0199c3b0-2d41-7a65-8b90-1c2d3e4f5a02", "number": null, "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "draft", "currency": "EUR", "subtotal_minor": 50500, "tax_minor": 9090, "total_minor": 59590, "paid_minor": 0, "balance_minor": 59590, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": null, "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": null, "created_at": "2026-09-28T09:12:03Z", "updated_at": "2026-09-28T09:12:03Z" } } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "Nothing was created. `detail_key` says why:\n\n- `errors.integrations.invoices.invalid_body` — the body is not a JSON object;\n- `errors.integrations.invoices.required` — `customer_id`, `currency` or `lines` is missing (`field` names it);\n- `errors.integrations.invoices.line_invalid` — a line is not an object, or has a negative or non-numeric quantity, price or tax rate, or a `unit_price_minor` that is not a whole number;\n- `errors.integrations.invoices.validation_failed` — a member the body or a line does not take (`errors[].code` = `unknown_field`, `path` e.g. `issued_date` or `lines[0].colour`), `currency` is not three upper-case letters, a date is not `YYYY-MM-DD`, `due_date` is before `issue_date`, or `notes` is longer than 2,000 characters (`errors[]` lists each);\n- `errors.finance.validation.currency_not_enabled` — the currency is not switched on in your Finance settings;\n- `errors.common.validation.invalid_reference` — `customer_id`, a `product_id` or a `tax_rate_id` does not exist in your company;\n- `errors.integrations.invoices.create_failed` — another Finance rule refused it.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "invalid_reference": { "summary": "The customer does not exist in your company", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "That references something that doesn't exist, or that you can't see.", "detail_key": "errors.common.validation.invalid_reference" } }, "currency_not_enabled": { "summary": "The currency is switched off", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "That currency is not enabled for your organisation — enable it in currency settings or pick another.", "detail_key": "errors.finance.validation.currency_not_enabled", "field": "currency", "currency": "USD", "errors": [ { "path": "currency", "code": "not_enabled" } ] } }, "validation_failed": { "summary": "The due date is before the issue date", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The invoice failed validation.", "detail_key": "errors.integrations.invoices.validation_failed", "field": "due_date", "code": "invalid_format", "errors": [ { "path": "due_date", "code": "invalid_format", "message": "errors.finance.validation.due_date_before_issue_date" } ] } }, "required": { "summary": "A required field is missing", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "A required field is missing: currency.", "detail_key": "errors.integrations.invoices.required", "field": "currency", "errors": [ { "path": "currency", "code": "required", "message": "errors.common.validation.required" } ] } }, "line_invalid": { "summary": "A line is invalid", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "One or more invoice lines are invalid.", "detail_key": "errors.integrations.invoices.line_invalid" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/invoices/{id}": { "get": { "operationId": "getInvoice", "tags": [ "Invoices" ], "summary": "Retrieve an invoice", "description": "A sales invoice. Amounts are minor units of `currency`.\n\n**Scope:** `int:fin.invoices:read` (a key with `int:fin.invoices:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.invoices:read" ] } ], "x-oh-scope": "int:fin.invoices:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The invoice.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Invoice" }, "example": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "partial", "currency": "EUR", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 50000, "balance_minor": 97500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-21T10:05:44Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No invoice with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Invoice not found.", "detail_key": "errors.integrations.invoices.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } }, "patch": { "operationId": "updateInvoice", "tags": [ "Invoices" ], "summary": "Update a draft invoice", "description": "Changes header fields of a **draft** invoice. Send only the fields to change.\nLines cannot be changed through the API in this version. Fires\n`fin.invoice.updated`.\n\n**Scope:** `int:fin.invoices:write` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:fin.invoices:write" ] } ], "x-oh-scope": "int:fin.invoices:write", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvoiceUpdate" } } } }, "responses": { "200": { "description": "The updated invoice.", "headers": { "Idempotency-Replayed": { "$ref": "#/components/headers/IdempotencyReplayed" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Invoice" }, "example": { "id": "0199c3b0-2d41-7a65-8b90-1c2d3e4f5a02", "number": null, "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "draft", "currency": "EUR", "subtotal_minor": 50500, "tax_minor": 9090, "total_minor": 59590, "paid_minor": 0, "balance_minor": 59590, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": null, "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": null, "created_at": "2026-09-28T09:12:03Z", "updated_at": "2026-09-28T09:12:03Z" } } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "Nothing was changed. `no_writable_fields` (nothing to change),\n`validation_failed` (a field has the wrong format, an unknown key was sent, or\n`due_date` is before `issue_date` — see `errors`), `update_failed` (the\ninvoice is no longer a draft), `invalid_body` (not a JSON object),\n`errors.finance.validation.currency_not_enabled` (the currency is switched off\nin your Finance settings), `errors.common.validation.invalid_reference` (the\n`customer_id` does not exist in your company), or a malformed id in the path\n(`errors.common.validation.invalid_input`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "not_a_draft": { "summary": "The invoice is no longer a draft", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The invoice could not be updated.", "detail_key": "errors.integrations.invoices.update_failed" } }, "no_writable_fields": { "summary": "Nothing to change", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "No writable fields were provided.", "detail_key": "errors.integrations.invoices.no_writable_fields" } }, "unknown_field": { "summary": "A field that cannot be written", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The invoice failed validation.", "errors": [ { "path": "colour", "code": "unknown_field", "message": "errors.common.validation.unknown_field" } ], "field": "colour", "code": "unknown_field", "detail_key": "errors.integrations.invoices.validation_failed" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/invoices/{id}/void": { "post": { "operationId": "voidInvoice", "tags": [ "Invoices" ], "summary": "Void an invoice", "description": "Voids an **issued** invoice — status `issued` or `overdue`, with no payment\nrecorded — by posting a reversing credit note, and returns the invoice. The\nreason is kept in the audit trail. Fires `fin.invoice.voided`.\n\nA `draft` cannot be voided (there is nothing to reverse) and the API cannot\ndelete one: issue it, or delete it, in the Finance app. A `paid` or `void`\ninvoice cannot be voided either, and one with a recorded payment needs that\npayment refunded first.\n\n**Scope:** `int:fin.invoices:write` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:fin.invoices:write" ] } ], "x-oh-scope": "int:fin.invoices:write", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvoiceVoid" } } } }, "responses": { "200": { "description": "The voided invoice.", "headers": { "Idempotency-Replayed": { "$ref": "#/components/headers/IdempotencyReplayed" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Invoice" }, "example": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "void", "currency": "EUR", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 0, "balance_minor": 0, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": "2026-09-29T13:40:00Z", "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": null, "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-29T13:40:00Z" } } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The invoice cannot be voided. `errors.finance.validation.invalid_invoice_status_for_void`\n— its status is not `issued`, `partial` or `overdue` (a draft, a paid or an\nalready void invoice); `errors.integrations.invoices.void_failed` — another\nFinance rule refused it, e.g. a payment is recorded against it. A malformed id\nis `errors.common.validation.invalid_input`.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "wrong_status": { "summary": "A draft (or a paid invoice) cannot be voided", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "This invoice can no longer be voided in its current status", "detail_key": "errors.finance.validation.invalid_invoice_status_for_void" } }, "void_failed": { "summary": "Another Finance rule refused it", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The invoice could not be voided.", "detail_key": "errors.integrations.invoices.void_failed" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/payments": { "get": { "operationId": "listPayments", "tags": [ "Payments" ], "summary": "List payments", "description": "Your payments.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fin.payments:read` (a key with `int:fin.payments:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.payments:read" ] } ], "x-oh-scope": "int:fin.payments:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of payments.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaymentPage" }, "example": { "data": [ { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "in", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": null, "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2E1LTBmMWUtN2QyYy04YjNhLTQ5NTg2YTdiOGMwMyIsInRzIjoiMjAyNi0wOS0yMVQxMDowNTo0MC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.payments.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/payments/{id}": { "get": { "operationId": "getPayment", "tags": [ "Payments" ], "summary": "Retrieve a payment", "description": "A payment received from a customer or paid to a supplier.\n\n**Scope:** `int:fin.payments:read` (a key with `int:fin.payments:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.payments:read" ] } ], "x-oh-scope": "int:fin.payments:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The payment.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Payment" }, "example": { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "in", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": null, "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No payment with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Payment not found.", "detail_key": "errors.integrations.payments.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/bills": { "get": { "operationId": "listBills", "tags": [ "Bills" ], "summary": "List bills", "description": "Your bills.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fin.bills:read` (a key with `int:fin.bills:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.bills:read" ] } ], "x-oh-scope": "int:fin.bills:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of bills.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BillPage" }, "example": { "data": [ { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "posted", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": "2026-09-11T07:45:12Z", "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-11T07:45:12Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2E2LTFhMmItN2MzZC05ZTRmLTVhNmI3YzhkOWUwNCIsInRzIjoiMjAyNi0wOS0xMFQxNToyMDowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.bills.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/bills/{id}": { "get": { "operationId": "getBill", "tags": [ "Bills" ], "summary": "Retrieve a bill", "description": "A purchase invoice (bill) from a supplier.\n\n**Scope:** `int:fin.bills:read` (a key with `int:fin.bills:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.bills:read" ] } ], "x-oh-scope": "int:fin.bills:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The bill.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Bill" }, "example": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "posted", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": "2026-09-11T07:45:12Z", "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-11T07:45:12Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No bill with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Bill not found.", "detail_key": "errors.integrations.bills.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/purchase_orders": { "get": { "operationId": "listPurchaseOrders", "tags": [ "Purchase orders" ], "summary": "List purchase orders", "description": "Your purchase orders.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fin.purchase_orders:read` (a key with `int:fin.purchase_orders:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.purchase_orders:read" ] } ], "x-oh-scope": "int:fin.purchase_orders:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of purchase orders.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PurchaseOrderPage" }, "example": { "data": [ { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "sent", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": null, "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-08T11:00:05Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2E3LTJiM2MtN2Q0ZS04ZjVhLTZiN2M4ZDllMGYwNiIsInRzIjoiMjAyNi0wOS0wOFQxMDo0MTozMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.purchase_orders.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/purchase_orders/{id}": { "get": { "operationId": "getPurchaseOrder", "tags": [ "Purchase orders" ], "summary": "Retrieve a purchase order", "description": "A purchase order sent to a supplier.\n\n**Scope:** `int:fin.purchase_orders:read` (a key with `int:fin.purchase_orders:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fin.purchase_orders:read" ] } ], "x-oh-scope": "int:fin.purchase_orders:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The purchase order.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PurchaseOrder" }, "example": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "sent", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": null, "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-08T11:00:05Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No purchase order with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Purchase order not found.", "detail_key": "errors.integrations.purchase_orders.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/work_orders": { "get": { "operationId": "listWorkOrders", "tags": [ "Work orders" ], "summary": "List work orders", "description": "Your work orders.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fm.work_orders:read` (a key with `int:fm.work_orders:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.work_orders:read" ] } ], "x-oh-scope": "int:fm.work_orders:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of work orders.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkOrderPage" }, "example": { "data": [ { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "in_progress", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": "2026-09-15T07:10:00Z", "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-15T07:10:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2E4LTNjNGQtN2U1Zi05YTZiLTdjOGQ5ZTBmMWEwNyIsInRzIjoiMjAyNi0wOS0xMlQxNDowMjoxMS4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.work_orders.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/work_orders/{id}": { "get": { "operationId": "getWorkOrder", "tags": [ "Work orders" ], "summary": "Retrieve a work order", "description": "A maintenance or repair work order for a vehicle.\n\n**Scope:** `int:fm.work_orders:read` (a key with `int:fm.work_orders:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.work_orders:read" ] } ], "x-oh-scope": "int:fm.work_orders:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The work order.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkOrder" }, "example": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "in_progress", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": "2026-09-15T07:10:00Z", "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-15T07:10:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No work order with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Work order not found.", "detail_key": "errors.integrations.work_orders.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/vehicles": { "get": { "operationId": "listVehicles", "tags": [ "Vehicles" ], "summary": "List vehicles", "description": "Your vehicles.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fm.vehicles:read` (a key with `int:fm.vehicles:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.vehicles:read" ] } ], "x-oh-scope": "int:fm.vehicles:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of vehicles.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VehiclePage" }, "example": { "data": [ { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T07:10:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljMzgwLTRkNWUtN2Y2YS04YjdjLThkOWUwZjFhMmIwOCIsInRzIjoiMjAyNi0wMi0wM1QwOTowMDowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.vehicles.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/vehicles/{id}": { "get": { "operationId": "getVehicle", "tags": [ "Vehicles" ], "summary": "Retrieve a vehicle", "description": "A vehicle in your fleet.\n\n**Scope:** `int:fm.vehicles:read` (a key with `int:fm.vehicles:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.vehicles:read" ] } ], "x-oh-scope": "int:fm.vehicles:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The vehicle.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Vehicle" }, "example": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T07:10:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No vehicle with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Vehicle not found.", "detail_key": "errors.integrations.vehicles.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/fuel_logs": { "get": { "operationId": "listFuelLogs", "tags": [ "Fuel logs" ], "summary": "List fuel logs", "description": "Your fuel logs.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:fm.fuel_logs:read` (a key with `int:fm.fuel_logs:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.fuel_logs:read" ] } ], "x-oh-scope": "int:fm.fuel_logs:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of fuel logs.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FuelLogPage" }, "example": { "data": [ { "id": "0199c3a9-8b9c-7dae-8f0a-2b3c4d5e6f12", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "driver_id": "0199c384-9cad-7ebf-9a1b-3c4d5e6f7a13", "recorded_at": "2026-09-13T16:48:00Z", "fuel_type": "diesel", "volume_l": 312.5, "price_per_unit_minor": 142, "total_cost_minor": 44375, "currency": "EUR", "odometer_km": 283977, "location_lat": 41.9973, "location_lng": 21.428, "source": "card", "created_at": "2026-09-13T17:02:31Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2E5LThiOWMtN2RhZS04ZjBhLTJiM2M0ZDVlNmYxMiIsInRzIjoiMjAyNi0wOS0xM1QxNzowMjozMS4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.fuel_logs.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/fuel_logs/{id}": { "get": { "operationId": "getFuelLog", "tags": [ "Fuel logs" ], "summary": "Retrieve a fuel log", "description": "One fuel purchase for a vehicle.\n\n**Scope:** `int:fm.fuel_logs:read` (a key with `int:fm.fuel_logs:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:fm.fuel_logs:read" ] } ], "x-oh-scope": "int:fm.fuel_logs:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The fuel log.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FuelLog" }, "example": { "id": "0199c3a9-8b9c-7dae-8f0a-2b3c4d5e6f12", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "driver_id": "0199c384-9cad-7ebf-9a1b-3c4d5e6f7a13", "recorded_at": "2026-09-13T16:48:00Z", "fuel_type": "diesel", "volume_l": 312.5, "price_per_unit_minor": 142, "total_cost_minor": 44375, "currency": "EUR", "odometer_km": 283977, "location_lat": 41.9973, "location_lng": 21.428, "source": "card", "created_at": "2026-09-13T17:02:31Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No fuel log with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Fuel log not found.", "detail_key": "errors.integrations.fuel_logs.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/employees": { "get": { "operationId": "listEmployees", "tags": [ "Employees" ], "summary": "List employees", "description": "Your employees.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:hr.employees:read` (a key with `int:hr.employees:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.employees:read" ] } ], "x-oh-scope": "int:hr.employees:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of employees.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmployeePage" }, "example": { "data": [ { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "active", "hire_date": "2023-04-03", "termination_date": null, "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2026-08-30T12:00:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljMzg1LWFkYmUtN2ZjMC04YjJjLTRkNWU2ZjdhOGIxNCIsInRzIjoiMjAyMy0wMy0yN1QwODoxNTowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.employees.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/employees/{id}": { "get": { "operationId": "getEmployee", "tags": [ "Employees" ], "summary": "Retrieve an employee", "description": "An employment record. Personal data (name, email, department, job title)\nis NOT exposed by the Integrations API in this version: those fields are\nalways `null`.\n\n**Scope:** `int:hr.employees:read` (a key with `int:hr.employees:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.employees:read" ] } ], "x-oh-scope": "int:hr.employees:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The employee.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Employee" }, "example": { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "active", "hire_date": "2023-04-03", "termination_date": null, "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2026-08-30T12:00:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No employee with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Employee not found.", "detail_key": "errors.integrations.employees.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/leave_requests": { "get": { "operationId": "listLeaveRequests", "tags": [ "Leave requests" ], "summary": "List leave requests", "description": "Your leave requests.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:hr.leave_requests:read` (a key with `int:hr.leave_requests:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.leave_requests:read" ] } ], "x-oh-scope": "int:hr.leave_requests:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of leave requests.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LeaveRequestPage" }, "example": { "data": [ { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "approved", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": null, "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-22T09:30:00Z", "rejected_by": null, "rejected_at": null, "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2FhLWQwZTEtNzJmMy05ZTVmLTdhOGI5Y2FkYmUxNyIsInRzIjoiMjAyNi0wOS0yMFQxODowNDoxMi4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.leave_requests.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/leave_requests/{id}": { "get": { "operationId": "getLeaveRequest", "tags": [ "Leave requests" ], "summary": "Retrieve a leave request", "description": "A request for leave (absence) by an employee.\n\n**Scope:** `int:hr.leave_requests:read` (a key with `int:hr.leave_requests:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.leave_requests:read" ] } ], "x-oh-scope": "int:hr.leave_requests:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The leave request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LeaveRequest" }, "example": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "approved", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": null, "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-22T09:30:00Z", "rejected_by": null, "rejected_at": null, "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No leave request with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Leave request not found.", "detail_key": "errors.integrations.leave_requests.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/timesheets": { "get": { "operationId": "listTimesheets", "tags": [ "Timesheets" ], "summary": "List timesheets", "description": "Your timesheets.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:hr.timesheets:read` (a key with `int:hr.timesheets:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.timesheets:read" ] } ], "x-oh-scope": "int:hr.timesheets:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of timesheets.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TimesheetPage" }, "example": { "data": [ { "id": "0199c3ab-f203-7415-9071-9cadbecfd019", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "period_start": "2026-09-07", "period_end": "2026-09-13", "status": "approved", "total_hours": 41.5, "regular_hours": null, "overtime_hours": null, "submitted_at": "2026-09-13T16:00:00Z", "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-14T08:10:00Z", "created_at": "2026-09-07T06:00:00Z", "updated_at": "2026-09-14T08:10:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2FiLWYyMDMtNzQxNS05MDcxLTljYWRiZWNmZDAxOSIsInRzIjoiMjAyNi0wOS0wN1QwNjowMDowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.timesheets.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/timesheets/{id}": { "get": { "operationId": "getTimesheet", "tags": [ "Timesheets" ], "summary": "Retrieve a timesheet", "description": "An employee's timesheet for one period.\n\n**Scope:** `int:hr.timesheets:read` (a key with `int:hr.timesheets:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:hr.timesheets:read" ] } ], "x-oh-scope": "int:hr.timesheets:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The timesheet.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Timesheet" }, "example": { "id": "0199c3ab-f203-7415-9071-9cadbecfd019", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "period_start": "2026-09-07", "period_end": "2026-09-13", "status": "approved", "total_hours": 41.5, "regular_hours": null, "overtime_hours": null, "submitted_at": "2026-09-13T16:00:00Z", "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-14T08:10:00Z", "created_at": "2026-09-07T06:00:00Z", "updated_at": "2026-09-14T08:10:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No timesheet with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Timesheet not found.", "detail_key": "errors.integrations.timesheets.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/tickets": { "get": { "operationId": "listTickets", "tags": [ "Tickets" ], "summary": "List tickets", "description": "Your support tickets.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:support.tickets:read` (a key with `int:support.tickets:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:support.tickets:read" ] } ], "x-oh-scope": "int:support.tickets:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of tickets.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TicketPage" }, "example": { "data": [ { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "awaiting_staff", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-22T11:02:17Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-22T11:02:17Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2FjLTAzMTQtNzUyNi04MTgyLWFkYmVjZmQwZTEyMCIsInRzIjoiMjAyNi0wOS0yMlQwOToxMjo1NS4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.tickets.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/tickets/{id}": { "get": { "operationId": "getTicket", "tags": [ "Tickets" ], "summary": "Retrieve a ticket", "description": "A support ticket.\n\n**Scope:** `int:support.tickets:read` (a key with `int:support.tickets:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:support.tickets:read" ] } ], "x-oh-scope": "int:support.tickets:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The ticket.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Ticket" }, "example": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "awaiting_staff", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-22T11:02:17Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-22T11:02:17Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No ticket with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Ticket not found.", "detail_key": "errors.integrations.tickets.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/documents": { "get": { "operationId": "listDocuments", "tags": [ "Documents" ], "summary": "List documents", "description": "Your documents, in every status.\n\nOrdered by creation time, newest first. Page with `limit` (1–100, default 50) and the `next_cursor` of the previous page. There are no filters or sort options in this version.\n\n**Scope:** `int:files.documents:read` (a key with `int:files.documents:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:files.documents:read" ] } ], "x-oh-scope": "int:files.documents:read", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of documents.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DocumentPage" }, "example": { "data": [ { "id": "0199c3ad-4758-796a-85c6-e1f203142524", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "name": "SK-4821-AB-insurance-2026.pdf", "mime_type": "application/pdf", "size_bytes": 248311, "status": "ready", "folder_id": "0199c38c-5869-7a7b-96d7-f20314253625", "uploaded_by": "0199c38a-2536-7748-83a4-cfd0e1f20322", "uploaded_at": "2026-01-15T10:20:00Z", "shared_with": [], "shared_expires_at": "2026-12-31T23:59:59Z", "deleted_at": null, "created_at": "2026-01-15T10:20:00Z", "updated_at": "2026-03-02T08:00:00Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2FkLTQ3NTgtNzk2YS04NWM2LWUxZjIwMzE0MjUyNCIsInRzIjoiMjAyNi0wMS0xNVQxMDoyMDowMC4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.documents.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/documents/{id}": { "get": { "operationId": "getDocument", "tags": [ "Documents" ], "summary": "Retrieve a document", "description": "A file in Documents — its metadata, not its contents. The list includes\nfiles in every state, including `deleted`, `quarantined` and `infected`;\ncheck `status` before you act on one.\n\n**Scope:** `int:files.documents:read` (a key with `int:files.documents:write` or `int:*` also qualifies).", "security": [ { "bearerApiKey": [ "int:files.documents:read" ] } ], "x-oh-scope": "int:files.documents:read", "parameters": [ { "$ref": "#/components/parameters/Id" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The document.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Document" }, "example": { "id": "0199c3ad-4758-796a-85c6-e1f203142524", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "name": "SK-4821-AB-insurance-2026.pdf", "mime_type": "application/pdf", "size_bytes": 248311, "status": "ready", "folder_id": "0199c38c-5869-7a7b-96d7-f20314253625", "uploaded_by": "0199c38a-2536-7748-83a4-cfd0e1f20322", "uploaded_at": "2026-01-15T10:20:00Z", "shared_with": [], "shared_expires_at": "2026-12-31T23:59:59Z", "deleted_at": null, "created_at": "2026-01-15T10:20:00Z", "updated_at": "2026-03-02T08:00:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "description": "No document with this id in your tenant.\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Document not found.", "detail_key": "errors.integrations.documents.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/webhook_endpoints": { "get": { "operationId": "listWebhookEndpoints", "tags": [ "Webhook endpoints" ], "summary": "List webhook endpoints", "description": "The endpoints this API key owns (every endpoint of the company for a key with\n`int:*`), including deleted ones (`status: disabled`, `disabled_reason:\nuser_deleted`). Not paginated.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "Your endpoints.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointList" }, "example": { "data": [ { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "active", "consecutive_failures": 0, "last_success_at": "2026-09-21T10:05:47Z", "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-21T10:05:47Z" } ] } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "429": { "$ref": "#/components/responses/RateLimited" } } }, "post": { "operationId": "createWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Create a webhook endpoint", "description": "Registers a URL to receive the events you list. The response contains the\nsigning `secret` — the only time it is shown. Store it securely and use it to\n[verify every delivery](https://developers.officehero.io/docs/webhooks/signatures).\n\nThe endpoint belongs to the API key that creates it: only that key (or one with\n`int:*`) can see, change or delete it, and it receives only events that occur\nafter it was created. Every event type must be in the catalogue, and the key\nmust hold the read scope of its family — a webhook never shows a key more than\nits `GET`s could.\n\nThe example uses `receiver.example.invalid`, which is refused on purpose\n(`422 url_not_publicly_routable`), so trying it cannot register a live endpoint.\nPut your own receiver's URL there.\n\nA tenant can have 5 endpoints that are `active` or `paused`; another one\nanswers `429` (`quota_exceeded`) until you delete one (paused endpoints count). Ask\nsupport if you need more.\n\nEvents that carry personal data (marked **PII** in the\n[event catalogue](https://developers.officehero.io/docs/webhooks/events)) are\nonly delivered after OfficeHero enables personal data for the endpoint —\ncontact support.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointCreate" }, "example": { "name": "ERP sync", "url": "https://receiver.example.invalid/officehero-webhooks", "event_types": [ "fin.invoice.paid", "fin.invoice.voided" ] } } } }, "responses": { "201": { "description": "The new endpoint, with its secret.", "headers": { "Location": { "$ref": "#/components/headers/Location" }, "Idempotency-Replayed": { "$ref": "#/components/headers/IdempotencyReplayed" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointCreated" }, "example": { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "active", "consecutive_failures": 0, "last_success_at": null, "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-10-10T08:00:00Z", "updated_at": "2026-10-10T08:00:00Z", "secret": "whsec_Q2x9vKe0VZ3m1pL7Ty4uB8nRcD6fHsJgWa5oXqEiNkY" } } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "description": "The key lacks `int:webhooks:manage`, or the read scope of an event family it\nsubscribes to (`missing_scope` is the first, `missing_scopes` all of them).\n`[\"*\"]` and families without a read endpoint need `int:*`. Also the plan\nswitch (`feature_disabled`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/forbidden", "title": "Forbidden", "status": 403, "detail": "The API key does not have the scope required for this endpoint.", "detail_key": "errors.integrations.missing_scope", "missing_scope": "int:fin.payments:read", "missing_scopes": [ "int:fin.payments:read" ] } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "404": { "$ref": "#/components/responses/TenantNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "Nothing was created. `invalid_body` (not a JSON object, or an `event_types`\nentry that is not a string), `required` (`name` or `url` missing),\n`event_types_required`, `unknown_event_type` (listed in\n`unknown_event_types`), `url_not_publicly_routable` (the URL is not `https`, or\nresolves to a private, loopback, link-local or reserved address, or does not\nresolve), `invalid_pinned_version`, or `errors.common.validation.failed` with\nan `unknown_field` entry per member this operation does not take.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "url_not_publicly_routable": { "summary": "The URL is not a public HTTPS address", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The webhook URL must be publicly routable (no private, loopback, or link-local addresses).", "detail_key": "errors.integrations.webhooks.url_not_publicly_routable" } }, "unknown_event_type": { "summary": "An event type that is not in the catalogue", "value": { "type": "https://officehero.io/errors/validation", "title": "Validation failed", "status": 422, "detail": "One or more event types are not in the event catalog.", "detail_key": "errors.integrations.webhooks.unknown_event_type", "unknown_event_types": [ "fin.invoice.payed" ] } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "description": "The tenant already has the maximum number of active and paused endpoints\n(`quota_exceeded`, no `Retry-After`), or a rate limit was hit (with\n`Retry-After`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/rate-limited", "title": "Too many requests", "status": 429, "detail": "The webhook endpoint quota for this tenant has been reached.", "detail_key": "errors.integrations.webhooks.quota_exceeded" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } } } } }, "/v1/webhook_endpoints/{id}": { "get": { "operationId": "getWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Retrieve a webhook endpoint", "description": "**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" } ], "responses": { "200": { "description": "The endpoint.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpoint" }, "example": { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "active", "consecutive_failures": 0, "last_success_at": "2026-09-21T10:05:47Z", "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-21T10:05:47Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } }, "patch": { "operationId": "updateWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Update a webhook endpoint", "description": "Changes the name, URL, event types or pinned version. Send only what changes;\nany other member is refused. `event_types` follows the same catalogue and scope\nrules as on create. Changing `url` or `event_types` withdraws the endpoint's\npermission to receive personal data.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpointUpdate" }, "example": { "name": "ERP sync (production)" } } } }, "responses": { "200": { "description": "The updated endpoint.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpoint" }, "example": { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "active", "consecutive_failures": 0, "last_success_at": "2026-09-21T10:05:47Z", "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-21T10:05:47Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "description": "The key lacks `int:webhooks:manage`, or the read scope of an event family in the\nnew `event_types` (`missing_scope`, `missing_scopes`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/forbidden", "title": "Forbidden", "status": 403, "detail": "The API key does not have the scope required for this endpoint.", "detail_key": "errors.integrations.missing_scope", "missing_scope": "int:*", "missing_scopes": [ "int:*" ] } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "Nothing was changed. `invalid_body` (not a JSON object), `errors.common.validation.failed`\n(`unknown_field` per member this operation does not take), `event_types_required`\n(an empty list), `unknown_event_type`, `url_not_publicly_routable`,\n`invalid_pinned_version`, or a malformed id (`errors.common.validation.invalid_input`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "invalid_pinned_version": { "summary": "An OH-Version that does not exist", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pinned OH-Version is not a supported version.", "detail_key": "errors.integrations.webhooks.invalid_pinned_version" } }, "unknown_field": { "summary": "A member this operation does not take", "value": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "Some of the values you sent are not valid. Correct the fields marked with an error and send the form again.", "detail_key": "errors.common.validation.failed", "field": "colour", "code": "unknown_field", "errors": [ { "path": "colour", "code": "unknown_field", "message": "errors.common.validation.unknown_field" } ] } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } }, "delete": { "operationId": "deleteWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Delete a webhook endpoint", "description": "Stops all deliveries to the endpoint and frees its place in the quota. The\nendpoint is kept for its delivery history: it stays in the list with\n`status: disabled` and `disabled_reason: user_deleted`.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "204": { "description": "Deleted.", "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/webhook_endpoints/{id}/rotate_secret": { "post": { "operationId": "rotateWebhookEndpointSecret", "tags": [ "Webhook endpoints" ], "summary": "Rotate the signing secret", "description": "Issues a new signing secret and returns it — the only time it is shown.\n`X-OH-Signature` is signed with the new secret from the next delivery on, so\nput the new secret in your receiver straight away. Deliveries that fail\nverification in between are retried on the normal schedule. See\n[Rotating secrets](https://developers.officehero.io/docs/webhooks/rotation).\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "200": { "description": "The new secret.", "headers": { "Idempotency-Replayed": { "$ref": "#/components/headers/IdempotencyReplayed" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookSecretRotation" }, "example": { "secret": "whsec_N7bTr2KqW9eYxL4mHc8vUd1sPa6fGzJoQi3RkEn5Bw0", "secret_prefix": "whsec_N7bTr2", "secret_rotated_at": "2026-10-10T08:15:00Z" } } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/webhook_endpoints/{id}/pause": { "post": { "operationId": "pauseWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Pause a webhook endpoint", "description": "Stops deliveries until you resume it. Events that occur while it is paused are\nnot queued for it. Deliveries already queued or waiting for a retry are not\nheld either: when their attempt comes up they end `failed` with\n`error_class: endpoint_disabled`. After you resume, send them again with\n`POST …/deliveries/replay_failed`.\n\nAn endpoint already paused because its API key was revoked or expired keeps\nthat `disabled_reason`. Pausing an endpoint switched off after failures takes a\nplace in the quota again (`429` when it is full). A deleted endpoint is a `404`.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "200": { "description": "The paused endpoint.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpoint" }, "example": { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "paused", "consecutive_failures": 0, "last_success_at": "2026-09-21T10:05:47Z", "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-29T07:00:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "$ref": "#/components/responses/IdempotencyConflict" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "description": "Pausing an endpoint switched off after failures would exceed the endpoint\nquota (`quota_exceeded`, no `Retry-After`: delete another endpoint first), or\na rate limit was hit (with `Retry-After`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/rate-limited", "title": "Too many requests", "status": 429, "detail": "The webhook endpoint quota for this tenant has been reached.", "detail_key": "errors.integrations.webhooks.quota_exceeded" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } } } } }, "/v1/webhook_endpoints/{id}/resume": { "post": { "operationId": "resumeWebhookEndpoint", "tags": [ "Webhook endpoints" ], "summary": "Resume a webhook endpoint", "description": "Sets a paused endpoint, or one switched off automatically after failures, back\nto `active`. An endpoint switched off after failures takes a place in the\nquota again, so it is refused (`429`) when the quota is full. It is also\nrefused while the API key that owns it is revoked or expired (`409`\n`owner_key_inactive`): create a new endpoint with a live key instead. A\ndeleted endpoint does not come back: resuming it is a `404`.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "200": { "description": "The active endpoint.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookEndpoint" }, "example": { "id": "0199c3ae-697a-7b8c-87e8-031425364726", "name": "ERP sync", "url": "https://example.com/officehero-webhooks", "secret_prefix": "whsec_Q2x9vK", "event_types": [ "fin.invoice.paid", "fin.invoice.voided", "fin.payment.received" ], "pinned_version": "2026-05-16", "status": "active", "consecutive_failures": 0, "last_success_at": "2026-09-21T10:05:47Z", "last_failure_at": null, "disabled_reason": null, "api_key_id": "0199c38d-7a8b-7c9d-98f9-142536475827", "secret_rotated_at": null, "canonical_signing_enabled": true, "created_at": "2026-09-01T12:00:00Z", "updated_at": "2026-09-21T10:05:47Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "description": "The API key that owns the endpoint is revoked or has expired.\n\nAlso `…/errors/idempotency-conflict`: the `Idempotency-Key` was already used with a different body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "conflict": { "summary": "The operation conflicts with the current state", "value": { "type": "https://officehero.io/errors/conflict", "title": "Conflict", "status": 409, "detail": "This endpoint belongs to an API key that was revoked or has expired, so it cannot be resumed. Create a new endpoint with an active key.", "detail_key": "errors.integrations.webhooks.owner_key_inactive", "code": "owner_key_inactive" } }, "idempotency_conflict": { "summary": "Idempotency-Key reused with a different body", "value": { "type": "https://officehero.io/errors/idempotency-conflict", "title": "Idempotency-Key reused with a different request body", "status": 409, "detail": "errors.idempotency.body_mismatch" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "description": "Resuming an endpoint switched off after failures would exceed the endpoint quota\n(`quota_exceeded`, no `Retry-After`: delete another endpoint first), or a rate\nlimit was hit (with `Retry-After`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/rate-limited", "title": "Too many requests", "status": 429, "detail": "The webhook endpoint quota for this tenant has been reached.", "detail_key": "errors.integrations.webhooks.quota_exceeded" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } } } } }, "/v1/webhook_endpoints/{id}/deliveries": { "get": { "operationId": "listWebhookDeliveries", "tags": [ "Webhook deliveries" ], "summary": "List deliveries for an endpoint", "description": "Deliveries for one of your endpoints, newest first: one row per event sent to\nit (and one per replay), updated with each attempt. An endpoint that does not\nexist, or that another API key owns, is a `404`.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/Limit" }, { "$ref": "#/components/parameters/Cursor" } ], "responses": { "200": { "description": "A page of deliveries.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookDeliveryPage" }, "example": { "data": [ { "id": "0199c3af-8b9c-7dae-890a-253647586928", "endpoint_id": "0199c3ae-697a-7b8c-87e8-031425364726", "event_id": "0199c3a4-adbe-7fc0-8b2c-475869708b30", "attempt": 1, "max_attempts": 8, "status": "delivered", "response_status": 200, "response_ms": 87, "error_class": null, "error_detail": null, "delivered_at": "2026-09-21T10:05:47Z", "next_attempt_at": null, "replayed_from": null, "created_at": "2026-09-21T10:05:46Z" } ], "next_cursor": "eyJpZCI6IjAxOTljM2FmLThiOWMtN2RhZS04OTBhLTI1MzY0NzU4NjkyOCIsInRzIjoiMjAyNi0wOS0yMVQxMDowNTo0Ni4wMDAwMDArMDA6MDAifQ", "has_more": true } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "The `cursor` cannot be read. Start again without it.\n\nA malformed id in the path is `errors.common.validation.invalid_input`.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/RateLimited" } } } }, "/v1/webhook_endpoints/{id}/deliveries/{delivery_id}/replay": { "post": { "operationId": "replayWebhookDelivery", "tags": [ "Webhook deliveries" ], "summary": "Send a delivery again", "description": "Queues a new delivery of the same event with a fresh signature, to the\nendpoint's current URL and secret. The new delivery's `replayed_from` points at\nthe original. Your receiver gets the same envelope `id`, so make sure it\ntolerates duplicates.\n\nThe endpoint must be `active` (`409 endpoint_not_active` otherwise — resume it\nfirst). A delivery that carries personal data is refused (`403\npii_not_granted`) while the endpoint is not enabled for personal data. Limit:\n60 per minute per API key.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "$ref": "#/components/parameters/DeliveryId" }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "202": { "description": "The queued delivery.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WebhookDelivery" }, "example": { "id": "0199c3b1-9cad-7ebf-9a1b-364758697a29", "endpoint_id": "0199c3ae-697a-7b8c-87e8-031425364726", "event_id": "0199c3a4-adbe-7fc0-8b2c-475869708b30", "attempt": 0, "max_attempts": 8, "status": "pending", "response_status": null, "response_ms": null, "error_class": null, "error_detail": null, "delivered_at": null, "next_attempt_at": "2026-10-10T08:20:00Z", "replayed_from": "0199c3af-8b9c-7dae-890a-253647586928", "created_at": "2026-10-10T08:20:00Z" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "description": "The delivery carries personal data and the endpoint is not enabled for it\n(`pii_not_granted`), or the key lacks `int:webhooks:manage`.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/forbidden", "title": "Forbidden", "status": 403, "detail": "This delivery carries personal data and the endpoint is not approved to receive it. OfficeHero must enable the endpoint for personal data first — contact support.", "detail_key": "errors.integrations.deliveries.pii_not_granted" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "404": { "description": "No such endpoint for this key (`errors.integrations.webhooks.not_found`), or no\ndelivery with this id on this endpoint (`errors.integrations.deliveries.not_found`).\n\nThe same status with `detail_key: errors.common.tenant_not_found` means the API key's company is no longer active.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Delivery not found.", "detail_key": "errors.integrations.deliveries.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "409": { "description": "The endpoint is `paused` or `disabled`; a replay to it could only fail. Resume\nit first (`POST /v1/webhook_endpoints/{id}/resume`).\n\nAlso `…/errors/idempotency-conflict`: the `Idempotency-Key` was already used with a different body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "conflict": { "summary": "The operation conflicts with the current state", "value": { "type": "https://officehero.io/errors/conflict", "title": "Conflict", "status": 409, "detail": "Deliveries can only be replayed to an active endpoint. Resume the endpoint first.", "detail_key": "errors.integrations.deliveries.endpoint_not_active", "code": "endpoint_not_active" } }, "idempotency_conflict": { "summary": "Idempotency-Key reused with a different body", "value": { "type": "https://officehero.io/errors/idempotency-conflict", "title": "Idempotency-Key reused with a different request body", "status": 409, "detail": "errors.idempotency.body_mismatch" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "$ref": "#/components/responses/InvalidId" }, "429": { "$ref": "#/components/responses/ReplayRateLimited" } } } }, "/v1/webhook_endpoints/{id}/deliveries/replay_failed": { "post": { "operationId": "replayFailedWebhookDeliveries", "tags": [ "Webhook deliveries" ], "summary": "Send failed deliveries again", "description": "Queues a new delivery for every `failed` or `dead` delivery of the endpoint\ncreated since `since` (default: the last 24 hours), and returns how many were\nqueued. Each original is replayed at most once: replays and deliveries already\nreplayed are skipped, and so are deliveries with personal data while the\nendpoint is not enabled for it. At most 1,000 per call.\n\nThe endpoint must be `active` (`409 endpoint_not_active` otherwise — resume it\nfirst). Limit: 5 calls per minute and 30 per hour per API key.\n\n**Scope:** `int:webhooks:manage` (or `int:*`).", "security": [ { "bearerApiKey": [ "int:webhooks:manage" ] } ], "x-oh-scope": "int:webhooks:manage", "parameters": [ { "$ref": "#/components/parameters/EndpointId" }, { "name": "since", "in": "query", "required": false, "description": "RFC 3339 date-time, e.g. `2026-10-09T00:00:00Z`. Defaults to 24 hours ago.", "schema": { "type": "string", "format": "date-time" } }, { "$ref": "#/components/parameters/OhVersion" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "responses": { "202": { "description": "How many deliveries were queued.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ReplayFailedResult" }, "example": { "enqueued": 3 } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "400": { "$ref": "#/components/responses/UnsupportedVersion" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/WebhookEndpointNotFound" }, "409": { "description": "The endpoint is `paused` or `disabled`; a replay to it could only fail. Resume\nit first (`POST /v1/webhook_endpoints/{id}/resume`).\n\nAlso `…/errors/idempotency-conflict`: the `Idempotency-Key` was already used with a different body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "conflict": { "summary": "The operation conflicts with the current state", "value": { "type": "https://officehero.io/errors/conflict", "title": "Conflict", "status": 409, "detail": "Deliveries can only be replayed to an active endpoint. Resume the endpoint first.", "detail_key": "errors.integrations.deliveries.endpoint_not_active", "code": "endpoint_not_active" } }, "idempotency_conflict": { "summary": "Idempotency-Key reused with a different body", "value": { "type": "https://officehero.io/errors/idempotency-conflict", "title": "Idempotency-Key reused with a different request body", "status": 409, "detail": "errors.idempotency.body_mismatch" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "410": { "$ref": "#/components/responses/VersionSunset" }, "422": { "description": "`since` is not an RFC 3339 date-time (`invalid_since`; `yesterday` or a bare\ndate are refused too), or the id is malformed (`errors.common.validation.invalid_input`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The since parameter must be a valid ISO-8601 timestamp.", "detail_key": "errors.integrations.deliveries.invalid_since" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "429": { "$ref": "#/components/responses/ReplayRateLimited" } } } } }, "webhooks": { "compliance.ai_act.bias.evaluated": { "post": { "operationId": "eventComplianceAiActBiasEvaluated", "summary": "compliance.ai_act.bias.evaluated", "description": "A quarterly bias evaluation of a high-risk or limited-risk AI system found a demographic-parity result past the breach threshold (Regulation (EU) 2024/1689, Articles 10 and 15).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActBiasEvaluatedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.bias.evaluated" }, "data": { "$ref": "#/components/schemas/AiActBiasEvaluatedEventData" } } } ] }, "example": { "id": "evt_0199c313-7c2e-7d7d-99f7-5a6ba3068f7e", "type": "compliance.ai_act.bias.evaluated", "occurred_at": "2026-09-11T08:08:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "system_code": "credit-scoring-v2", "system_id": "0199c39f-fa02-7b3d-86d5-c5bf5950a3ea", "assessment_id": "0199c37f-fdcc-734d-bead-f4637d425bfd", "protected_attribute": "gender", "metric_name": "Northwind Transport", "metric_value": 0.42, "threshold": 0.42, "breach": false, "period_from": "2026-09-09", "period_to": "2026-09-22", "evaluated_at": "2026-09-06T12:10:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c32a-a059-7bd4-ae0c-dcb4d81a7c73" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.decision.overridden": { "post": { "operationId": "eventComplianceAiActDecisionOverridden", "summary": "compliance.ai_act.decision.overridden", "description": "A human-oversight reviewer overrode an AI-system decision.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDecisionEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.decision.overridden" }, "data": { "$ref": "#/components/schemas/AiActDecisionEventData" } } } ] }, "example": { "id": "evt_0199c3d2-62c6-7cd1-873b-07a1a19a747b", "type": "compliance.ai_act.decision.overridden", "occurred_at": "2026-09-19T06:40:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3bb-294b-7104-98e7-211ec4aa7c95", "system_id": "0199c3ca-dcdc-7362-9488-885aff2f79b7", "decision_kind": "credit_limit", "outcome": "approved", "human_oversight_exercised": true, "overridden_by": "0199c322-bbdf-7978-a468-5d5389b4e8df", "overridden_at": "2026-09-26T17:03:00Z", "recorded_at": "2026-09-03T10:16:00Z", "created_at": "2026-09-21T17:46:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c361-9e90-79d2-9c71-9c2849169000" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.decision.recorded": { "post": { "operationId": "eventComplianceAiActDecisionRecorded", "summary": "compliance.ai_act.decision.recorded", "description": "A high-risk AI system decision was logged in the register (Art. 26/86).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDecisionEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.decision.recorded" }, "data": { "$ref": "#/components/schemas/AiActDecisionEventData" } } } ] }, "example": { "id": "evt_0199c308-e12c-7263-a6e1-72d5acffbce3", "type": "compliance.ai_act.decision.recorded", "occurred_at": "2026-09-20T10:21:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c388-1afe-7028-bbd2-68f95c88b36b", "system_id": "0199c318-7397-76e8-8d38-1f65c5dbb398", "decision_kind": "credit_limit", "outcome": "approved", "human_oversight_exercised": true, "overridden_by": "0199c31a-e27f-7371-aae7-cde337ea2115", "overridden_at": "2026-09-04T17:31:00Z", "recorded_at": "2026-09-11T10:14:00Z", "created_at": "2026-09-06T09:53:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c35b-6218-7df7-abd0-c2fb5b88bd98" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.decision_chain.integrity_violation": { "post": { "operationId": "eventComplianceAiActDecisionChainIntegrityViolation", "summary": "compliance.ai_act.decision_chain.integrity_violation", "description": "The daily check of an AI system's decision log found a break in its hash chain: a missing entry, or a hash that does not match the entry before it (Regulation (EU) 2024/1689, Article 12). `data` gives what was checked, the number of gaps and their kinds (`chain_index_gap`, `prev_hash_mismatch`, `chain_hash_mismatch`).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDecisionChainIntegrityEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.decision_chain.integrity_violation" }, "data": { "$ref": "#/components/schemas/AiActDecisionChainIntegrityEventData" } } } ] }, "example": { "id": "evt_0199c302-6af3-7c0f-b440-8a13416224c5", "type": "compliance.ai_act.decision_chain.integrity_violation", "occurred_at": "2026-09-13T11:24:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "chainsChecked": 1, "rowsChecked": 1, "gapsCount": 3, "gapReasons": [ "missing_predecessor" ], "detectedAt": "2026-09-26T16:04:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b7-28e6-7f51-bbe4-1f8344599d33" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.dossier.artifact_regenerated": { "post": { "operationId": "eventComplianceAiActDossierArtifactRegenerated", "summary": "compliance.ai_act.dossier.artifact_regenerated", "description": "The three documents of an AI Act Annex IV conformity dossier (transparency disclosure, Annex IV technical documentation and declaration of conformity) were generated again on request.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDossierArtifactRegeneratedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.dossier.artifact_regenerated" }, "data": { "$ref": "#/components/schemas/AiActDossierArtifactRegeneratedEventData" } } } ] }, "example": { "id": "evt_0199c321-250d-7924-944e-137bf77c43b0", "type": "compliance.ai_act.dossier.artifact_regenerated", "occurred_at": "2026-09-21T14:31:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "assessment_id": "0199c348-f563-768d-947e-a453c02826cb", "regenerated_by_user_id": "0199c3ef-2dc9-7e68-aef8-556b364d07c1", "regenerated_at": "2026-09-12T08:02:00Z", "artifact_kinds": [ "technical_documentation" ] }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c358-e329-7ccf-912a-0c8bbdd486aa" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.dossier.completed": { "post": { "operationId": "eventComplianceAiActDossierCompleted", "summary": "compliance.ai_act.dossier.completed", "description": "An Annex-IV conformity dossier was marked complete (Art. 11).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDossierEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.dossier.completed" }, "data": { "$ref": "#/components/schemas/AiActDossierEventData" } } } ] }, "example": { "id": "evt_0199c30f-41bf-782e-829b-0784748f5964", "type": "compliance.ai_act.dossier.completed", "occurred_at": "2026-09-11T16:32:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c383-fce8-70c6-a124-b08121b67c73", "system_name": "Northwind Transport", "risk_tier": "high", "dossier_status": "submitted", "last_reviewed_at": "2026-09-14T16:53:00Z", "created_at": "2026-09-13T10:32:00Z", "updated_at": "2026-09-11T16:32:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c30e-c638-7ec8-8b7b-ef9df6dbd762" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.drift_detected": { "post": { "operationId": "eventComplianceAiActDriftDetected", "summary": "compliance.ai_act.drift_detected", "description": "An AI system's behaviour over the last 7 days drifted from its 30-day baseline (post-market monitoring, Regulation (EU) 2024/1689, Article 17).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActDriftEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.drift_detected" }, "data": { "$ref": "#/components/schemas/AiActDriftEventData" } } } ] }, "example": { "id": "evt_0199c396-6143-7df1-8507-53a8497af806", "type": "compliance.ai_act.drift_detected", "occurred_at": "2026-09-16T06:40:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "incident_id": "0199c3bc-0d02-7bba-ba11-22ec93545be8", "system_id": "0199c3db-bf40-72d7-8f2f-f427b2f87add", "current_period_from": "2026-09-24", "current_period_to": "2026-09-27", "baseline_period_from": "2026-09-14", "baseline_period_to": "2026-09-08", "current_decisions": 1, "baseline_decisions": 1, "current_avg_total_tokens": 0.42, "baseline_avg_total_tokens": 0.42, "current_p95_total_tokens": 3, "baseline_p95_total_tokens": 3, "anomaly_reasons": [ "approval_rate_shift" ], "detected_at": "2026-09-10T11:04:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c324-dda7-7651-8274-ca8bf3938e9e" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.incident.created": { "post": { "operationId": "eventComplianceAiActIncidentCreated", "summary": "compliance.ai_act.incident.created", "description": "A post-market monitoring incident was opened (Art. 73).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.incident.created" }, "data": { "$ref": "#/components/schemas/AiActIncidentEventData" } } } ] }, "example": { "id": "evt_0199c368-2cc3-7834-8994-36aec57b3dae", "type": "compliance.ai_act.incident.created", "occurred_at": "2026-09-16T16:22:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c37c-dc41-7fe8-b6cf-fe752fd24ace", "system_id": "0199c341-c21d-7235-9b00-03da78790668", "severity": "high", "category": "serious_incident", "status": "submitted", "detected_at": "2026-09-21T12:33:00Z", "resolved_at": "2026-09-04T14:01:00Z", "notified_body_reported_at": "2026-09-12T11:48:00Z", "created_at": "2026-09-23T09:56:00Z", "updated_at": "2026-09-16T16:22:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3dc-d76b-700c-9ffc-91238ef29e42" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.incident.resolved": { "post": { "operationId": "eventComplianceAiActIncidentResolved", "summary": "compliance.ai_act.incident.resolved", "description": "A post-market monitoring incident was closed.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.incident.resolved" }, "data": { "$ref": "#/components/schemas/AiActIncidentEventData" } } } ] }, "example": { "id": "evt_0199c320-46e2-73b3-ba24-607026ef76ab", "type": "compliance.ai_act.incident.resolved", "occurred_at": "2026-09-08T16:12:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c39d-db0e-751f-a7e3-29fc96b46ca9", "system_id": "0199c381-8f7a-73cf-bf23-5b7699591a6d", "severity": "high", "category": "serious_incident", "status": "submitted", "detected_at": "2026-09-22T15:48:00Z", "resolved_at": "2026-09-23T09:33:00Z", "notified_body_reported_at": "2026-09-28T16:45:00Z", "created_at": "2026-09-24T10:49:00Z", "updated_at": "2026-09-08T16:12:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c317-3061-7ced-9df6-876d04a4838f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.oversight_backlog_escalated": { "post": { "operationId": "eventComplianceAiActOversightBacklogEscalated", "summary": "compliance.ai_act.oversight_backlog_escalated", "description": "A high-risk AI system's queue of decisions awaiting human review grew past its escalation threshold, and the company's administrators were alerted (Regulation (EU) 2024/1689, Article 14).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActOversightBacklogEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.oversight_backlog_escalated" }, "data": { "$ref": "#/components/schemas/AiActOversightBacklogEventData" } } } ] }, "example": { "id": "evt_0199c3a3-2eaf-7f8b-a82d-351f75a5d4d8", "type": "compliance.ai_act.oversight_backlog_escalated", "occurred_at": "2026-09-22T10:21:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "system_id": "0199c349-0395-786e-8880-88312fbfe213", "system_name": "Northwind Transport", "overdue_count": 3, "threshold_count": 3, "sla_days": 5, "escalated_at": "2026-09-25T12:41:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3f8-4d0d-7dfe-abac-04c1c870d443" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.ai_act.system.registered": { "post": { "operationId": "eventComplianceAiActSystemRegistered", "summary": "compliance.ai_act.system.registered", "description": "An OfficeHero-shipped high-risk AI system was registered in the EU AI database (Regulation (EU) 2024/1689 Article 71).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `AiActSystemRegisteredEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.ai_act.system.registered" }, "data": { "$ref": "#/components/schemas/AiActSystemRegisteredEventData" } } } ] }, "example": { "id": "evt_0199c3c0-b8e1-7484-a686-40966e1abec1", "type": "compliance.ai_act.system.registered", "occurred_at": "2026-09-25T07:26:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "system_code": "credit-scoring-v2", "system_display_name": "Northwind Transport", "risk_class": "high_risk", "domain": "employment", "annex_iii_area": "employment_workers_management", "eu_registration_status": "submitted", "eu_registration_id": "0199c3c4-9cab-76ac-a6e1-afa0aab6f380", "endpoint": "https://ai.example.com/v1/score", "submitted_at": "2026-09-15T16:01:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c36a-fae9-7d43-8930-0cbbf256d6b1" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.document.inbound_received": { "post": { "operationId": "eventComplianceFrEinvoicingDocumentInboundReceived", "summary": "compliance.fr_einvoicing.document.inbound_received", "description": "A French e-invoice addressed to the company arrived from the public invoicing portal (PPF) and was recorded. Sent once per PPF reference: a document the portal delivers again does not send it twice.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `FrEinvoicingInboundReceivedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.document.inbound_received" }, "data": { "$ref": "#/components/schemas/FrEinvoicingInboundReceivedEventData" } } } ] }, "example": { "id": "evt_0199c3bc-4096-7d0a-a2a6-0d0c9ef3e740", "type": "compliance.fr_einvoicing.document.inbound_received", "occurred_at": "2026-09-07T11:22:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "document_id": "0199c341-c676-77ea-9139-bc51fa84ea46", "document_type": "invoice", "ppf_reference": "NR-2026-0042", "supplier_id": "0199c3f8-46dc-714c-beff-3bb0f97dd041", "supplier_name": "Northwind Transport", "total_minor": 125000, "currency": "EUR", "issue_date": "2026-09-01", "received_at": "2026-09-26T09:07:00Z", "delivery_channel": "peppol", "peer_pa_siren": "987654321" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c34a-a01c-7dec-99e6-2c7ee5f71744" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.ereporting.submitted": { "post": { "operationId": "eventComplianceFrEinvoicingEreportingSubmitted", "summary": "compliance.fr_einvoicing.ereporting.submitted", "description": "A French e-reporting declaration (B2C, intra-EU B2B or extra-EU transactions) was sent to the public invoicing portal (PPF) and reached a final state: `submitted` or `rejected`.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingEreportingSubmittedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.ereporting.submitted" }, "data": { "$ref": "#/components/schemas/FrEinvoicingEreportingSubmittedEventData" } } } ] }, "example": { "id": "evt_0199c352-d9db-7f03-8582-cdade93265ed", "type": "compliance.fr_einvoicing.ereporting.submitted", "occurred_at": "2026-09-10T13:18:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "submission_id": "0199c3ae-2e02-7ed1-a998-e2765568d9ea", "report_type": "transaction", "period_from": "2026-09-15", "period_to": "2026-09-05", "total_transactions": 3, "total_amount_minor": 125000, "currency": "EUR", "state": "submitted", "ppf_reference": "NR-2026-0042", "rejection_reason": "Synthetic example text.", "submitted_at": "2026-09-28T15:51:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c30c-402d-7fd1-8a28-7d0c30cb00c3" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.incident.opened": { "post": { "operationId": "eventComplianceFrEinvoicingIncidentOpened", "summary": "compliance.fr_einvoicing.incident.opened", "description": "A French e-invoicing incident was opened: an SLA breach, repeated rejections, a signing-key compromise, or one raised by hand.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.incident.opened" }, "data": { "$ref": "#/components/schemas/FrEinvoicingIncidentEventData" } } } ] }, "example": { "id": "evt_0199c310-80af-7fa2-9846-aace2997aa4b", "type": "compliance.fr_einvoicing.incident.opened", "occurred_at": "2026-09-17T08:28:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3e9-dfdc-7da7-bcce-a6c58bb9252c", "document_id": "0199c37c-a09b-7adb-b2a1-a8c4ba5b8b4f", "severity": "high", "category": "transmission_failure", "title": "Brake inspection overdue for SK 4821 AB", "detected_at": "2026-09-27T15:43:00Z", "acknowledged_at": "2026-09-04T13:38:00Z", "resolved_at": "2026-09-01T10:27:00Z", "regulator_notified_at": "2026-09-08T17:48:00Z", "regulator_reference": "NR-2026-0042", "created_at": "2026-09-27T13:58:00Z", "updated_at": "2026-09-17T08:28:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e5-b3c5-7280-a9f2-da6b56f09839" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.incident.regulator_notified": { "post": { "operationId": "eventComplianceFrEinvoicingIncidentRegulatorNotified", "summary": "compliance.fr_einvoicing.incident.regulator_notified", "description": "A French e-invoicing incident was reported to the tax authority (DGFiP) and the authority's case reference was recorded.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.incident.regulator_notified" }, "data": { "$ref": "#/components/schemas/FrEinvoicingIncidentEventData" } } } ] }, "example": { "id": "evt_0199c396-47fa-7d90-b9f8-e7225b694ce8", "type": "compliance.fr_einvoicing.incident.regulator_notified", "occurred_at": "2026-09-01T12:37:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c39c-7717-7969-8b76-4a19f0520c88", "document_id": "0199c3c3-cbcf-741f-ae34-2d9f678fbef8", "severity": "high", "category": "transmission_failure", "title": "Brake inspection overdue for SK 4821 AB", "detected_at": "2026-09-28T12:00:00Z", "acknowledged_at": "2026-09-09T11:57:00Z", "resolved_at": "2026-09-16T13:22:00Z", "regulator_notified_at": "2026-09-03T10:17:00Z", "regulator_reference": "NR-2026-0042", "created_at": "2026-09-27T14:42:00Z", "updated_at": "2026-09-01T12:37:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3c1-bca1-7108-bf62-1524ef6c6f9a" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.incident.resolved": { "post": { "operationId": "eventComplianceFrEinvoicingIncidentResolved", "summary": "compliance.fr_einvoicing.incident.resolved", "description": "A French e-invoicing incident was resolved.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.incident.resolved" }, "data": { "$ref": "#/components/schemas/FrEinvoicingIncidentEventData" } } } ] }, "example": { "id": "evt_0199c3d8-bcd6-774d-8951-2ae6f242ca43", "type": "compliance.fr_einvoicing.incident.resolved", "occurred_at": "2026-09-27T11:52:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c383-0a6d-71a4-8c42-55f11f3de474", "document_id": "0199c3e4-08de-7d42-acf5-3fd728947417", "severity": "high", "category": "transmission_failure", "title": "Brake inspection overdue for SK 4821 AB", "detected_at": "2026-09-18T11:26:00Z", "acknowledged_at": "2026-09-28T09:01:00Z", "resolved_at": "2026-09-20T08:11:00Z", "regulator_notified_at": "2026-09-20T10:23:00Z", "regulator_reference": "NR-2026-0042", "created_at": "2026-09-22T06:05:00Z", "updated_at": "2026-09-27T11:52:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c392-98aa-7e5f-b1b6-3511e347d898" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.mandate.reactivated": { "post": { "operationId": "eventComplianceFrEinvoicingMandateReactivated", "summary": "compliance.fr_einvoicing.mandate.reactivated", "description": "A suspended French e-invoicing mandate was reactivated: the company can issue e-invoices and submit e-reporting again.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingMandateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.mandate.reactivated" }, "data": { "$ref": "#/components/schemas/EinvoicingMandateEventData" } } } ] }, "example": { "id": "evt_0199c369-7834-79fa-9b72-7eb9a2e882d4", "type": "compliance.fr_einvoicing.mandate.reactivated", "occurred_at": "2026-09-19T09:31:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3f9-0512-71df-8346-a64fa509cda6", "tenant_customer_id": "0199c399-c792-7e27-b2f8-fa3619559155", "siren": "123456789", "jurisdiction": "https://files.example.com/c810edf572a8", "status": "submitted", "signed_at": "2026-09-27T08:17:00Z", "activated_at": "2026-09-24T10:21:00Z", "revoked_at": "2026-09-08T13:21:00Z", "provider_envelope_id": "0199c32f-915b-79ea-9aa1-3ee3298fac25", "created_at": "2026-09-28T12:35:00Z", "updated_at": "2026-09-19T09:31:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c34c-3ceb-7c80-b393-f448cac5c453" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.mandate.signed": { "post": { "operationId": "eventComplianceFrEinvoicingMandateSigned", "summary": "compliance.fr_einvoicing.mandate.signed", "description": "The company's legal signatory signed its French e-invoicing mandate electronically. The signed mandate is kept for the 10-year regulatory retention period.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingMandateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.mandate.signed" }, "data": { "$ref": "#/components/schemas/EinvoicingMandateEventData" } } } ] }, "example": { "id": "evt_0199c32a-3352-7c19-bed7-3ee2ab124da4", "type": "compliance.fr_einvoicing.mandate.signed", "occurred_at": "2026-09-20T09:59:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3d7-a18b-72fb-8ea5-f6737d84104f", "tenant_customer_id": "0199c3fd-c2d9-7ef0-87dd-d9538229f987", "siren": "123456789", "jurisdiction": "https://files.example.com/159d83e8f72e", "status": "submitted", "signed_at": "2026-09-18T12:58:00Z", "activated_at": "2026-09-17T09:42:00Z", "revoked_at": "2026-09-21T06:37:00Z", "provider_envelope_id": "0199c35c-9c97-78bf-938b-0d284e1faecf", "created_at": "2026-09-21T12:14:00Z", "updated_at": "2026-09-20T09:59:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c37a-362a-72c3-9f06-886eebd2e80c" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.outbound_delivery.attempted": { "post": { "operationId": "eventComplianceFrEinvoicingOutboundDeliveryAttempted", "summary": "compliance.fr_einvoicing.outbound_delivery.attempted", "description": "An attempt to deliver one of the company's French e-invoices (to the buyer's platform or to the public invoicing portal, PPF) finished. Sent for every attempt, whatever the outcome; `data` carries the attempt's state and HTTP status.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingOutboundDeliveryEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.outbound_delivery.attempted" }, "data": { "$ref": "#/components/schemas/FrEinvoicingOutboundDeliveryEventData" } } } ] }, "example": { "id": "evt_0199c366-e15c-77d8-80f9-c533228a6ffe", "type": "compliance.fr_einvoicing.outbound_delivery.attempted", "occurred_at": "2026-09-05T17:56:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "attempt_id": "0199c3b4-c8dd-7ff1-bd6a-2f157e39b732", "document_id": "0199c343-ad01-7590-8a69-83bafd5d7186", "attempt_n": 1, "target_kind": "peppol_participant", "target_identifier": "0225:123456789", "idempotency_key": "0199c3f4-42c4-7ebe-bd74-aeec05a20bc0", "state": "submitted", "failure_reason": "Synthetic example text.", "http_status": 200, "started_at": "2026-09-26T11:55:00Z", "completed_at": "2026-09-08T12:43:00Z", "next_retry_at": "2026-09-20T10:04:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c388-2989-7dc2-9c69-a2dc9637e1a4" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.outbound_delivery.permanently_failed": { "post": { "operationId": "eventComplianceFrEinvoicingOutboundDeliveryPermanentlyFailed", "summary": "compliance.fr_einvoicing.outbound_delivery.permanently_failed", "description": "Delivery of one of the company's French e-invoices was given up: every retry failed, and so did the fallback to the public invoicing portal (PPF) where it applies. Alert your finance team and show the failure on the invoice.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingOutboundDeliveryEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.outbound_delivery.permanently_failed" }, "data": { "$ref": "#/components/schemas/FrEinvoicingOutboundDeliveryEventData" } } } ] }, "example": { "id": "evt_0199c37b-ed7c-772b-97ad-745fc3b2368a", "type": "compliance.fr_einvoicing.outbound_delivery.permanently_failed", "occurred_at": "2026-09-23T13:32:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "attempt_id": "0199c381-cd24-703f-ae47-b4d4de550d60", "document_id": "0199c390-01b8-75bd-ae04-aa22c5b6ec86", "attempt_n": 1, "target_kind": "peppol_participant", "target_identifier": "0225:123456789", "idempotency_key": "0199c390-2205-7048-9b50-76591aab6b76", "state": "submitted", "failure_reason": "Synthetic example text.", "http_status": 200, "started_at": "2026-09-06T07:26:00Z", "completed_at": "2026-09-24T13:41:00Z", "next_retry_at": "2026-09-02T11:12:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3db-14a8-7f5f-993d-bfcc82ce5f54" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.fr_einvoicing.serious_incident.opened": { "post": { "operationId": "eventComplianceFrEinvoicingSeriousIncidentOpened", "summary": "compliance.fr_einvoicing.serious_incident.opened", "description": "A serious French e-invoicing incident (Article 72: signing-key compromise, data breach, public-portal outage or a cluster of rejections) was opened. It starts the 72-hour deadline for notifying the tax authority (DGFiP).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `FrEinvoicingIncidentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.fr_einvoicing.serious_incident.opened" }, "data": { "$ref": "#/components/schemas/FrEinvoicingIncidentEventData" } } } ] }, "example": { "id": "evt_0199c36a-e4e8-7603-9073-504d395ab1a9", "type": "compliance.fr_einvoicing.serious_incident.opened", "occurred_at": "2026-09-25T17:04:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ab-6abe-7222-b7a0-a9fa7337a5a4", "document_id": "0199c358-faef-7344-9dc0-6b8f62068d29", "severity": "high", "category": "transmission_failure", "title": "Brake inspection overdue for SK 4821 AB", "detected_at": "2026-09-20T12:15:00Z", "acknowledged_at": "2026-09-15T09:54:00Z", "resolved_at": "2026-09-06T14:24:00Z", "regulator_notified_at": "2026-09-17T06:23:00Z", "regulator_reference": "NR-2026-0042", "created_at": "2026-09-09T09:01:00Z", "updated_at": "2026-09-25T17:04:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3a4-77ff-70c5-9c11-ca1d42facf81" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.nis2.article21.attestation_changed": { "post": { "operationId": "eventComplianceNis2Article21AttestationChanged", "summary": "compliance.nis2.article21.attestation_changed", "description": "The attestation of a NIS2 Article 21(2) risk-management measure changed: `not_attested` → `attested` → `lapsed`, or withdrawn back to `not_attested`. Directive (EU) 2022/2555, Article 21.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `Nis2Article21AttestationChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.nis2.article21.attestation_changed" }, "data": { "$ref": "#/components/schemas/Nis2Article21AttestationChangedEventData" } } } ] }, "example": { "id": "evt_0199c3e4-fad3-7eeb-be19-82727af171d1", "type": "compliance.nis2.article21.attestation_changed", "occurred_at": "2026-09-20T11:11:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ff-91e5-7b3c-b510-c391d24e4ece", "measure_id": "0199c3f7-ba77-7072-8086-743a4d3ada23", "from_state": "detected", "to_state": "notified", "attested_at": "2026-09-24T11:58:00Z", "reason": "Synthetic example text.", "changed_by": "0199c3ee-9157-78f0-9072-879265f80f0e", "created_at": "2026-09-13T06:40:00Z", "updated_at": "2026-09-20T11:11:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c36e-d509-7382-a366-e8b1253613af" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.nis2.board.accountability_changed": { "post": { "operationId": "eventComplianceNis2BoardAccountabilityChanged", "summary": "compliance.nis2.board.accountability_changed", "description": "An entry in the company's NIS2 management-body accountability register changed: a board member, a training record (completed, exempted, cancelled or expired), a board decision or the annual attestation. Directive (EU) 2022/2555, Article 20.\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `Nis2BoardAccountabilityChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.nis2.board.accountability_changed" }, "data": { "$ref": "#/components/schemas/Nis2BoardAccountabilityChangedEventData" } } } ] }, "example": { "id": "evt_0199c329-0d01-797d-b70c-f10fa3968a27", "type": "compliance.nis2.board.accountability_changed", "occurred_at": "2026-09-06T08:16:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "entry_kind": "member", "entry_id": "0199c381-6f1c-7677-be0a-ad6d90065f31", "member_id": "0199c367-5256-70cd-bc6d-436e9af962d4", "topic": "incident_reporting", "from_state": "detected", "to_state": "notified", "severity": "high", "occurred_at": "2026-09-10T16:29:00Z", "previous": [], "actor_user_id": "0199c38b-1bf8-7839-9c60-b229b5816162", "occurred_event_at": "2026-09-06T17:38:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c37e-a1d7-7232-a9de-425bbd9be8eb" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.nis2.csirt.submission_state_changed": { "post": { "operationId": "eventComplianceNis2CsirtSubmissionStateChanged", "summary": "compliance.nis2.csirt.submission_state_changed", "description": "A submission of a NIS2 incident report to the national CSIRT changed state: accepted, a dry run, failed, waiting for a retry, or final after a retry. Directive (EU) 2022/2555, Articles 23, 13(3) and 14(4).\n\n**Not emitted yet.** It is in the catalogue and you can subscribe to it, but OfficeHero does not send it today. Introduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `Nis2CsirtSubmissionStateChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": false, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.nis2.csirt.submission_state_changed" }, "data": { "$ref": "#/components/schemas/Nis2CsirtSubmissionStateChangedEventData" } } } ] }, "example": { "id": "evt_0199c368-12f5-71bc-9940-fe01b8c43cfe", "type": "compliance.nis2.csirt.submission_state_changed", "occurred_at": "2026-09-04T12:37:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "notification_id": "0199c3dd-a026-7337-b6d3-2a319961773c", "incident_id": "0199c3da-c175-728e-808e-0fecbfcda8ac", "adapter_code": "de_bsi", "csirt_member_state": "DE", "notification_kind": "early_warning", "previous_status": "submitted", "new_status": "submitted", "csirt_reference": "NR-2026-0042", "error_message": "Synthetic example text.", "attempt_number": 1, "occurred_event_at": "2026-09-25T10:22:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3fb-ac78-7e7a-9677-8fef99882ba5" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.nis2.incident.state_changed": { "post": { "operationId": "eventComplianceNis2IncidentStateChanged", "summary": "compliance.nis2.incident.state_changed", "description": "A NIS2 incident moved to the next stage of its Article 23 reporting (`drafted` → `submitted_early_warning` → `detailed_notification_sent` → `final_report_sent` → `closed`). Directive (EU) 2022/2555, Article 23.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `Nis2IncidentStateChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.nis2.incident.state_changed" }, "data": { "$ref": "#/components/schemas/Nis2IncidentStateChangedEventData" } } } ] }, "example": { "id": "evt_0199c39b-8d40-7bb6-ab36-623974427381", "type": "compliance.nis2.incident.state_changed", "occurred_at": "2026-09-27T10:52:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c341-f897-7027-9ea0-6e390401fd3c", "severity": "high", "category": "availability", "from_state": "detected", "to_state": "notified", "discovered_at": "2026-09-14T17:34:00Z", "closed_at": "2026-09-15T16:16:00Z", "reason": "Synthetic example text.", "transitioned_by": "0199c3bb-7f74-7658-aec5-2ff094635a68", "created_at": "2026-09-15T08:26:00Z", "updated_at": "2026-09-27T10:52:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c341-c3c1-773d-bfb3-d257a3c58462" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.nis2.supply_chain.entry_state_changed": { "post": { "operationId": "eventComplianceNis2SupplyChainEntryStateChanged", "summary": "compliance.nis2.supply_chain.entry_state_changed", "description": "An entry in the company's NIS2 supply-chain register changed: a supplier's status, a recorded risk assessment, a missed review, or cross-border coordination with a national CSIRT. Directive (EU) 2022/2555, Articles 22, 13(3) and 14(4).\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `Nis2SupplyChainEntryStateChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.nis2.supply_chain.entry_state_changed" }, "data": { "$ref": "#/components/schemas/Nis2SupplyChainEntryStateChangedEventData" } } } ] }, "example": { "id": "evt_0199c3e0-d37f-7592-b049-bcb329a10311", "type": "compliance.nis2.supply_chain.entry_state_changed", "occurred_at": "2026-09-04T13:52:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "entry_kind": "supplier", "entry_id": "0199c375-7bba-781f-93f2-1127574730d6", "supplier_id": "0199c38a-b57d-7969-bb6f-4b34996c5a62", "assessment_id": "0199c3b4-12f7-73da-81c2-878d5750994d", "supplier_name": "Northwind Transport", "supplier_criticality": "high", "from_lifecycle_state": "onboarding", "to_lifecycle_state": "active", "severity": "high", "occurred_at": "2026-09-04T17:44:00Z", "previous": [], "actor_user_id": "0199c3a3-60af-77de-8fba-e289f4bea339", "occurred_event_at": "2026-09-04T17:31:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c311-15c1-7fd1-8d64-3a4d07beb151" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.assessment.closed": { "post": { "operationId": "eventCompliancePayTransparencyAssessmentClosed", "summary": "compliance.pay_transparency.assessment.closed", "description": "A joint pay assessment was closed with a gap-pct finding.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyAssessmentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.assessment.closed" }, "data": { "$ref": "#/components/schemas/PayTransparencyAssessmentEventData" } } } ] }, "example": { "id": "evt_0199c390-1aab-772d-bdd4-156c1150cddb", "type": "compliance.pay_transparency.assessment.closed", "occurred_at": "2026-09-25T09:37:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c36d-b782-70b9-a6f1-e5e3d7a92be7", "establishment_group_id": "0199c3c1-3ed3-7635-b9bb-ede38b0a83d4", "period_start": "2026-09-18", "period_end": "2026-09-02", "status": "submitted", "gap_pct": 0.42, "opened_at": "2026-09-04T11:01:00Z", "closed_at": "2026-09-28T16:48:00Z", "created_at": "2026-09-06T17:53:00Z", "updated_at": "2026-09-25T09:37:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3fa-9e7e-7e9a-a2f7-929f33ae43a4" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.assessment.opened": { "post": { "operationId": "eventCompliancePayTransparencyAssessmentOpened", "summary": "compliance.pay_transparency.assessment.opened", "description": "A joint pay assessment was opened for an establishment group.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyAssessmentEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.assessment.opened" }, "data": { "$ref": "#/components/schemas/PayTransparencyAssessmentEventData" } } } ] }, "example": { "id": "evt_0199c3b8-f8b4-7296-bed4-b7e7cdb13e25", "type": "compliance.pay_transparency.assessment.opened", "occurred_at": "2026-09-21T15:51:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c357-4206-7327-a237-a170ca641995", "establishment_group_id": "0199c315-f8c1-728b-b67b-054c0b8a1c6f", "period_start": "2026-09-10", "period_end": "2026-09-02", "status": "submitted", "gap_pct": 0.42, "opened_at": "2026-09-12T16:30:00Z", "closed_at": "2026-09-05T09:19:00Z", "created_at": "2026-09-21T14:11:00Z", "updated_at": "2026-09-21T15:51:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c383-a10b-7822-a74b-ef11d6a833ae" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.benchmark.published": { "post": { "operationId": "eventCompliancePayTransparencyBenchmarkPublished", "summary": "compliance.pay_transparency.benchmark.published", "description": "A new anonymised (k-anonymous) cross-company pay benchmark was published for a bucket (position, country, region and quarter) the company opted into (EU Pay Transparency Directive 2023/970).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyBenchmarkEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.benchmark.published" }, "data": { "$ref": "#/components/schemas/PayTransparencyBenchmarkEventData" } } } ] }, "example": { "id": "evt_0199c3e0-f6ef-7e81-b16b-e240c20de2ce", "type": "compliance.pay_transparency.benchmark.published", "occurred_at": "2026-09-28T16:51:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "position_canonical_id": "0199c338-46be-72a4-a71b-14cb2a9924a5", "country_code": "MK", "region": "MK-SK", "period_quarter": "2026-Q3", "sample_tenant_count": 3, "sample_employee_count": 3, "p25_eur": 0.42, "p50_eur": 0.42, "p75_eur": 0.42, "published_at": "2026-09-07T17:26:00Z", "dp_noise_epsilon": 21.428 }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3f9-5001-7ced-8e97-56cadd89c446" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.evidence_chain.integrity_violation": { "post": { "operationId": "eventCompliancePayTransparencyEvidenceChainIntegrityViolation", "summary": "compliance.pay_transparency.evidence_chain.integrity_violation", "description": "The daily check of the company's pay-transparency evidence chain found a record that no longer matches its stored anchor (EU Pay Transparency Directive 2023/970, Article 9).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyEvidenceChainIntegrityEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.evidence_chain.integrity_violation" }, "data": { "$ref": "#/components/schemas/PayTransparencyEvidenceChainIntegrityEventData" } } } ] }, "example": { "id": "evt_0199c3cc-e434-7354-ba52-87f14e0bd86e", "type": "compliance.pay_transparency.evidence_chain.integrity_violation", "occurred_at": "2026-09-02T14:04:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "anchor_id": "0199c395-e383-7339-b3c9-07259dcaee1a", "period_from": "2026-09-15", "period_to": "2026-09-13", "anchored_root": "5afd4096b6a01ba2eac2f180139fce6da3ae84904e9e6a08bf7a04ae111362d5", "current_merkle_root": "ff8c96f50268acc83868edd7e04b1cdb88f85e72d2785be53f9ecba191ebe219", "anchored_sample_count": 3, "current_sample_count": 3, "failure_reason": "Synthetic example text.", "detected_at": "2026-09-20T09:25:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c321-a78a-7d10-b691-0fddaf49305f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.regulator.audit_queried": { "post": { "operationId": "eventCompliancePayTransparencyRegulatorAuditQueried", "summary": "compliance.pay_transparency.regulator.audit_queried", "description": "A regulator read the company's pay-transparency evidence audit (EU Pay Transparency Directive 2023/970, Article 9).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyRegulatorAuditEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.regulator.audit_queried" }, "data": { "$ref": "#/components/schemas/PayTransparencyRegulatorAuditEventData" } } } ] }, "example": { "id": "evt_0199c315-9f44-75ea-8a16-c1ed4f11a900", "type": "compliance.pay_transparency.regulator.audit_queried", "occurred_at": "2026-09-28T11:22:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "actor_user_id": "0199c312-2727-7fb2-bdbb-a0a347e83eb4", "since_iso": "2026-09-21T15:30:00Z", "until_iso": "2026-09-26T15:24:00Z", "rows_returned": 1, "verified": true, "gap_count": 3, "queried_at": "2026-09-19T12:59:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b3-982b-75e6-b52e-acbeaf06cd20" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.report.published": { "post": { "operationId": "eventCompliancePayTransparencyReportPublished", "summary": "compliance.pay_transparency.report.published", "description": "A pay-transparency report for the company (for example Germany's EntgTranspG report or France's Index Égalité) was finalised and published as HTML, PDF and JSON-LD to tamper-proof storage (EU Pay Transparency Directive 2023/970, Article 9).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `PayTransparencyReportPublishedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.report.published" }, "data": { "$ref": "#/components/schemas/PayTransparencyReportPublishedEventData" } } } ] }, "example": { "id": "evt_0199c337-3602-7d82-aea5-422c574d24d8", "type": "compliance.pay_transparency.report.published", "occurred_at": "2026-09-18T17:44:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "report_id": "0199c343-1d44-7921-a636-23bc62172cf1", "country_code": "MK", "obligation_id": "0199c378-3737-7c40-9ee1-181588697840", "period_from": "2026-09-17", "period_to": "2026-09-15", "public_slug": "9f3c2a7e4b1d6058c3e2f1a0b9d8c7e6", "published_at": "2026-09-26T07:50:00Z", "dp_noise_epsilon": 21.428 }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3f7-9939-79e5-a96a-2f5170117103" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.rti.responded": { "post": { "operationId": "eventCompliancePayTransparencyRtiResponded", "summary": "compliance.pay_transparency.rti.responded", "description": "A right-to-information pay request was answered with the redacted band.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `PayInformationRequestEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.rti.responded" }, "data": { "$ref": "#/components/schemas/PayInformationRequestEventData" } } } ] }, "example": { "id": "evt_0199c307-b89a-7530-bdb5-0216edcaf959", "type": "compliance.pay_transparency.rti.responded", "occurred_at": "2026-09-10T13:17:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c300-b7fc-7723-8ee5-34fe7deab15c", "employee_id": "0199c351-4b31-70d6-838b-76e41470ebe0", "role_code": "driver", "status": "submitted", "submitted_at": "2026-09-16T06:13:00Z", "responded_at": "2026-09-02T10:30:00Z", "response_band_code": "band_c", "created_at": "2026-09-22T15:59:00Z", "updated_at": "2026-09-10T13:17:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c36d-6b75-7b4e-9197-07c9cfeca290" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.rti.submitted": { "post": { "operationId": "eventCompliancePayTransparencyRtiSubmitted", "summary": "compliance.pay_transparency.rti.submitted", "description": "An employee submitted a right-to-information pay request (Art. 7).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `PayInformationRequestEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.rti.submitted" }, "data": { "$ref": "#/components/schemas/PayInformationRequestEventData" } } } ] }, "example": { "id": "evt_0199c34a-0f69-7e96-abe5-6f22f2eef38a", "type": "compliance.pay_transparency.rti.submitted", "occurred_at": "2026-09-05T13:21:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c309-9bd9-7646-9c9c-e21315ee1ff4", "employee_id": "0199c3af-0974-7435-a3a1-ba5f7a5fec21", "role_code": "driver", "status": "submitted", "submitted_at": "2026-09-21T12:31:00Z", "responded_at": "2026-09-27T15:19:00Z", "response_band_code": "band_c", "created_at": "2026-09-04T15:26:00Z", "updated_at": "2026-09-05T13:21:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c362-055d-7b69-aa56-5eeb48309987" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.uk_gpgr.status_changed": { "post": { "operationId": "eventCompliancePayTransparencyUkGpgrStatusChanged", "summary": "compliance.pay_transparency.uk_gpgr.status_changed", "description": "A UK gender pay gap report filed on gov.uk reached a final status, `accepted` or `rejected` (checked daily).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkGpgrStatusChangedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.uk_gpgr.status_changed" }, "data": { "$ref": "#/components/schemas/UkGpgrStatusChangedEventData" } } } ] }, "example": { "id": "evt_0199c35a-4580-7d82-a9a2-9766d8d02e43", "type": "compliance.pay_transparency.uk_gpgr.status_changed", "occurred_at": "2026-09-14T16:28:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "submission_id": "0199c35e-537c-702e-8b66-887c35663141", "reporting_year": 2026, "submission_reference": "NR-2026-0042", "previous_status": "submitted", "new_status": "submitted", "environment": "production", "government_receipt": "GPG-2026-004217", "message": "Synthetic example text.", "observed_at": "2026-09-06T14:37:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3a6-d435-7f55-8274-0efec9ae32cc" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.pay_transparency.uk_gpgr.submitted": { "post": { "operationId": "eventCompliancePayTransparencyUkGpgrSubmitted", "summary": "compliance.pay_transparency.uk_gpgr.submitted", "description": "A UK gender pay gap report was filed on gov.uk and acknowledged with a tracking reference (Equality Act 2010 (Gender Pay Gap Information) Regulations 2017).\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkGpgrSubmittedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.pay_transparency.uk_gpgr.submitted" }, "data": { "$ref": "#/components/schemas/UkGpgrSubmittedEventData" } } } ] }, "example": { "id": "evt_0199c32f-9065-7242-a9aa-f95b2e47d690", "type": "compliance.pay_transparency.uk_gpgr.submitted", "occurred_at": "2026-09-27T16:22:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "submission_id": "0199c3e6-97e7-78b6-8cb4-56a285c29b79", "reporting_year": 2026, "employer_size": "250-499", "submission_reference": "NR-2026-0042", "environment": "production", "submitted_at": "2026-09-28T15:36:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e4-35db-73a1-aa93-0fd5585eb177" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.oauth_granted": { "post": { "operationId": "eventComplianceUkMtdItsaOauthGranted", "summary": "compliance.uk_mtd.itsa.oauth_granted", "description": "A taxpayer completed HMRC's consent flow and a UK Making Tax Digital (ITSA) authorisation was granted. The taxpayer is identified by `taxpayer_id`; the National Insurance number is never sent.\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkMtdItsaOauthGrantStateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.oauth_granted" }, "data": { "$ref": "#/components/schemas/UkMtdItsaOauthGrantStateEventData" } } } ] }, "example": { "id": "evt_0199c378-6074-7dbd-b351-f04df84e8c3c", "type": "compliance.uk_mtd.itsa.oauth_granted", "occurred_at": "2026-09-03T17:35:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "grant_id": "0199c3d8-1da9-7207-a3fa-0b805fb19d62", "taxpayer_id": "0199c36b-bf8a-7f3b-b984-b7528f5a48b8", "environment": "sandbox", "transition": "granted", "previous_status": "submitted", "new_status": "submitted", "scopes": [ "int:fin.invoices:read" ], "expires_at": "2026-09-14T06:19:00Z", "failure_reason": "Synthetic example text.", "attempt_number": 1, "occurred_event_at": "2026-09-05T15:25:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d5-cf59-7c2b-878b-a9c141819be6" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.oauth_refresh_failed": { "post": { "operationId": "eventComplianceUkMtdItsaOauthRefreshFailed", "summary": "compliance.uk_mtd.itsa.oauth_refresh_failed", "description": "A UK Making Tax Digital (ITSA) authorisation could not be renewed five times in a row and is now `failed`. Sent once, when it fails, not for every attempt. The taxpayer is identified by `taxpayer_id`; the National Insurance number is never sent.\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkMtdItsaOauthGrantStateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.oauth_refresh_failed" }, "data": { "$ref": "#/components/schemas/UkMtdItsaOauthGrantStateEventData" } } } ] }, "example": { "id": "evt_0199c3b6-ee64-7bcb-a1f8-24b86666be90", "type": "compliance.uk_mtd.itsa.oauth_refresh_failed", "occurred_at": "2026-09-17T13:35:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "grant_id": "0199c3df-75c1-7406-886b-4132015c22e8", "taxpayer_id": "0199c3a3-e46c-7a43-a4de-520ed3ef9ed2", "environment": "sandbox", "transition": "granted", "previous_status": "submitted", "new_status": "submitted", "scopes": [ "int:fin.invoices:read" ], "expires_at": "2026-09-23T17:31:00Z", "failure_reason": "Synthetic example text.", "attempt_number": 1, "occurred_event_at": "2026-09-22T10:25:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3be-27b6-7ed8-9863-8dbe0fbc505f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.oauth_refreshed": { "post": { "operationId": "eventComplianceUkMtdItsaOauthRefreshed", "summary": "compliance.uk_mtd.itsa.oauth_refreshed", "description": "A UK Making Tax Digital (ITSA) authorisation was renewed with HMRC (on its schedule, or when it was about to be used). The taxpayer is identified by `taxpayer_id`; the National Insurance number is never sent.\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkMtdItsaOauthGrantStateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.oauth_refreshed" }, "data": { "$ref": "#/components/schemas/UkMtdItsaOauthGrantStateEventData" } } } ] }, "example": { "id": "evt_0199c350-a3d7-7427-8770-a20b749c4c27", "type": "compliance.uk_mtd.itsa.oauth_refreshed", "occurred_at": "2026-09-02T17:28:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "grant_id": "0199c3a7-179f-71d3-91e0-9f17f12da57d", "taxpayer_id": "0199c32a-6e7c-7ef5-bf28-a77f3ad73fd4", "environment": "sandbox", "transition": "granted", "previous_status": "submitted", "new_status": "submitted", "scopes": [ "int:fin.invoices:read" ], "expires_at": "2026-09-21T06:25:00Z", "failure_reason": "Synthetic example text.", "attempt_number": 1, "occurred_event_at": "2026-09-21T10:50:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c361-65a4-7740-a156-542530c4ba17" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.oauth_revoked": { "post": { "operationId": "eventComplianceUkMtdItsaOauthRevoked", "summary": "compliance.uk_mtd.itsa.oauth_revoked", "description": "A UK Making Tax Digital (ITSA) authorisation was revoked in OfficeHero. The taxpayer is identified by `taxpayer_id`; the National Insurance number is never sent.\n\nIntroduced in `2026-05-21`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `UkMtdItsaOauthGrantStateEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-21", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.oauth_revoked" }, "data": { "$ref": "#/components/schemas/UkMtdItsaOauthGrantStateEventData" } } } ] }, "example": { "id": "evt_0199c345-1212-7d85-aa65-86e860f0d0e6", "type": "compliance.uk_mtd.itsa.oauth_revoked", "occurred_at": "2026-09-13T16:45:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "grant_id": "0199c38b-1c73-7000-b920-d0734d98a748", "taxpayer_id": "0199c30f-87f7-7b87-ae0f-b5a35adef884", "environment": "sandbox", "transition": "granted", "previous_status": "submitted", "new_status": "submitted", "scopes": [ "int:fin.invoices:read" ], "expires_at": "2026-09-23T16:48:00Z", "failure_reason": "Synthetic example text.", "attempt_number": 1, "occurred_event_at": "2026-09-16T16:14:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3c9-59f0-722b-9fa6-a515942f0005" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.penalty_received": { "post": { "operationId": "eventComplianceUkMtdItsaPenaltyReceived", "summary": "compliance.uk_mtd.itsa.penalty_received", "description": "HMRC issued a Making Tax Digital (ITSA) penalty (Finance Act 2021, Schedules 24–26) and it was recorded against a taxpayer and period; `data` says whether it was matched to one of the company's submissions.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `UkMtdItsaPenaltyReceivedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.penalty_received" }, "data": { "$ref": "#/components/schemas/UkMtdItsaPenaltyReceivedEventData" } } } ] }, "example": { "id": "evt_0199c35d-063c-76eb-83a6-baa26cf44485", "type": "compliance.uk_mtd.itsa.penalty_received", "occurred_at": "2026-09-26T06:34:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "replayId": "0199c3a4-c243-79aa-9c3a-d7116fd627d8", "nino": "QQ123456C", "taxYear": "2025-26", "periodKey": "25A1", "hmrcPenaltyReference": "NR-2026-0042", "penaltyKind": "late_submission", "amountMinor": 125000, "linkedSubmissionId": "0199c38c-d6d3-7de2-a43a-c9b2d8ae081f", "replayStatus": "submitted" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c324-fdbe-7bcf-a5ea-0fb040536563" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.uk_mtd.itsa.submission_accepted": { "post": { "operationId": "eventComplianceUkMtdItsaSubmissionAccepted", "summary": "compliance.uk_mtd.itsa.submission_accepted", "description": "HMRC accepted a Making Tax Digital (ITSA) submission (a quarterly update or a final declaration). `data` carries the HMRC receipt id and whether it was a sandbox (practice) or a production filing.\n\nIntroduced in `2026-05-20`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `UkMtdItsaSubmissionAcceptedEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-20", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.uk_mtd.itsa.submission_accepted" }, "data": { "$ref": "#/components/schemas/UkMtdItsaSubmissionAcceptedEventData" } } } ] }, "example": { "id": "evt_0199c3ef-36d5-72e6-81c4-a138bbb4c0fc", "type": "compliance.uk_mtd.itsa.submission_accepted", "occurred_at": "2026-09-16T15:43:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "submissionId": "0199c344-dee1-76d3-8e9a-f1c054738740", "nino": "QQ123456C", "taxYear": "2025-26", "periodKey": "25A1", "submissionKind": "quarterly_update", "hmrcReceiptId": "0199c3e0-4829-7bd5-9852-4b25121e402b", "hmrcEnvironment": "production" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3a6-6da5-7725-be39-4101bb719658" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.whistleblowing.handler_training_due": { "post": { "operationId": "eventComplianceWhistleblowingHandlerTrainingDue", "summary": "compliance.whistleblowing.handler_training_due", "description": "A whistleblowing handler is due (or overdue) for periodic confidentiality training (Directive 2019/1937 Art. 9(1)(c)).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `WhistleblowingHandlerTrainingEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.whistleblowing.handler_training_due" }, "data": { "$ref": "#/components/schemas/WhistleblowingHandlerTrainingEventData" } } } ] }, "example": { "id": "evt_0199c346-be30-74c8-bf5a-0d9f47c39628", "type": "compliance.whistleblowing.handler_training_due", "occurred_at": "2026-09-03T16:17:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "handler_user_id": "0199c33a-d873-7856-aa0a-55d4477d738c", "role": "handler", "last_trained_at": "2026-09-14T08:55:00Z", "days_since_training": 5, "reminder_threshold_days": 5, "detected_at": "2026-09-28T06:15:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e2-6653-73ea-a7cb-80ea297b7ae0" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.whistleblowing.report.acknowledged": { "post": { "operationId": "eventComplianceWhistleblowingReportAcknowledged", "summary": "compliance.whistleblowing.report.acknowledged", "description": "A whistleblowing report was acknowledged to the reporter (Art. 9 §1(b)).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `WhistleblowingReportEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.whistleblowing.report.acknowledged" }, "data": { "$ref": "#/components/schemas/WhistleblowingReportEventData" } } } ] }, "example": { "id": "evt_0199c303-5ae0-7dc3-9644-a8a111416948", "type": "compliance.whistleblowing.report.acknowledged", "occurred_at": "2026-09-22T06:56:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c361-0c48-72d3-9999-d7d7404a0d68", "anonymous": true, "reporter_employee_id": "0199c39a-2245-76d1-bae1-de3fe54b466b", "channel": "api", "category": "financial_misconduct", "status": "submitted", "received_at": "2026-09-22T06:01:00Z", "acknowledged_at": "2026-09-26T08:08:00Z", "sla_breached_at": "2026-09-25T11:43:00Z", "handler_employee_ids": [ "0199c322-7143-7b41-b03b-1027a7094bc3" ], "created_at": "2026-09-25T11:13:00Z", "updated_at": "2026-09-22T06:56:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c348-af80-7c48-9d27-042a7d9c033f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.whistleblowing.report.handler_assigned": { "post": { "operationId": "eventComplianceWhistleblowingReportHandlerAssigned", "summary": "compliance.whistleblowing.report.handler_assigned", "description": "A handler cohort was assigned to a whistleblowing report.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `WhistleblowingReportEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.whistleblowing.report.handler_assigned" }, "data": { "$ref": "#/components/schemas/WhistleblowingReportEventData" } } } ] }, "example": { "id": "evt_0199c3a5-68d2-7c57-92cc-02bd7e1c55d2", "type": "compliance.whistleblowing.report.handler_assigned", "occurred_at": "2026-09-09T17:14:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c300-288c-7881-a3cc-8f1a8de4d698", "anonymous": true, "reporter_employee_id": "0199c3c6-1bc1-7294-a15e-d6c644b581c0", "channel": "api", "category": "financial_misconduct", "status": "submitted", "received_at": "2026-09-28T16:36:00Z", "acknowledged_at": "2026-09-08T07:29:00Z", "sla_breached_at": "2026-09-07T06:36:00Z", "handler_employee_ids": [ "0199c374-a2b3-7293-9238-76c7c95350f4" ], "created_at": "2026-09-12T09:16:00Z", "updated_at": "2026-09-09T17:14:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b7-606f-78bc-9130-5cd0e6a376ac" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.whistleblowing.report.received": { "post": { "operationId": "eventComplianceWhistleblowingReportReceived", "summary": "compliance.whistleblowing.report.received", "description": "A whistleblowing report was received via intake.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `WhistleblowingReportEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.whistleblowing.report.received" }, "data": { "$ref": "#/components/schemas/WhistleblowingReportEventData" } } } ] }, "example": { "id": "evt_0199c3fe-388a-709a-8758-27b7defce3a2", "type": "compliance.whistleblowing.report.received", "occurred_at": "2026-09-02T06:38:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c30a-ff2b-78a2-9866-207734951a0c", "anonymous": true, "reporter_employee_id": "0199c34f-a3fd-76d6-befb-8777652a6d6f", "channel": "api", "category": "financial_misconduct", "status": "submitted", "received_at": "2026-09-14T13:14:00Z", "acknowledged_at": "2026-09-10T14:27:00Z", "sla_breached_at": "2026-09-27T16:47:00Z", "handler_employee_ids": [ "0199c300-053d-7f6e-b3f7-689e0794b1ed" ], "created_at": "2026-09-08T17:43:00Z", "updated_at": "2026-09-02T06:38:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c306-2391-7b04-a1cc-6c53ad0747fc" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "compliance.whistleblowing.report.sla_breached": { "post": { "operationId": "eventComplianceWhistleblowingReportSlaBreached", "summary": "compliance.whistleblowing.report.sla_breached", "description": "A whistleblowing report breached its statutory response SLA.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `WhistleblowingReportEventData` (below).", "x-oh-domain": "compliance", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "compliance.whistleblowing.report.sla_breached" }, "data": { "$ref": "#/components/schemas/WhistleblowingReportEventData" } } } ] }, "example": { "id": "evt_0199c3c5-91ec-7f72-b124-873650edb389", "type": "compliance.whistleblowing.report.sla_breached", "occurred_at": "2026-09-02T12:44:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c39a-2400-75e5-9549-a42163a6909e", "anonymous": true, "reporter_employee_id": "0199c325-861e-7a54-b30c-4dc255d1d581", "channel": "api", "category": "financial_misconduct", "status": "submitted", "received_at": "2026-09-24T15:51:00Z", "acknowledged_at": "2026-09-27T09:27:00Z", "sla_breached_at": "2026-09-26T15:18:00Z", "handler_employee_ids": [ "0199c318-9fd2-7722-9509-6cb3ec17312b" ], "created_at": "2026-09-17T16:10:00Z", "updated_at": "2026-09-02T12:44:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c39b-a1df-76c0-83c7-7d8c6f4481e2" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "files.document.deleted": { "post": { "operationId": "eventFilesDocumentDeleted", "summary": "files.document.deleted", "description": "A document was soft-deleted.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:files.documents:read` as well as `int:webhooks:manage`.\n\n`data` is a `DocumentEventData` (below).", "x-oh-domain": "files", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:files.documents:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "files.document.deleted" }, "data": { "$ref": "#/components/schemas/DocumentEventData" } } } ] }, "example": { "id": "evt_0199c3a6-4bd8-7426-82a9-6cf90fb2cb4d", "type": "files.document.deleted", "occurred_at": "2026-09-30T12:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ad-4758-796a-85c6-e1f203142524", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "name": "SK-4821-AB-insurance-2026.pdf", "mime_type": "application/pdf", "size_bytes": 248311, "status": "deleted", "folder_id": "0199c38c-5869-7a7b-96d7-f20314253625", "uploaded_by": "0199c38a-2536-7748-83a4-cfd0e1f20322", "uploaded_at": "2026-01-15T10:20:00Z", "shared_with": [], "shared_expires_at": null, "deleted_at": "2026-09-30T12:00:00Z", "created_at": "2026-01-15T10:20:00Z", "updated_at": "2026-09-30T12:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c338-adce-7d51-a0b1-c0ef41921aa2" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "files.document.shared": { "post": { "operationId": "eventFilesDocumentShared", "summary": "files.document.shared", "description": "A document was shared with an internal or external recipient.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:files.documents:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `DocumentShareEventData` (below).", "x-oh-domain": "files", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:files.documents:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "files.document.shared" }, "data": { "$ref": "#/components/schemas/DocumentShareEventData" } } } ] }, "example": { "id": "evt_0199c395-8ad6-708a-81b0-0c07cb86546d", "type": "files.document.shared", "occurred_at": "2026-09-26T11:52:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "share_id": "0199c38d-e77d-71a5-b508-ac75e0cc6727", "document_id": "0199c33e-9941-7c46-ba9a-4548cf459831", "shared_by": "0199c345-1acf-7a68-9c4a-4f3235f20125", "recipients": [ "ana.petrovska@example.com" ], "scopes": [ "int:fin.invoices:read" ], "expires_at": "2026-09-07T15:17:00Z", "created_at": "2026-09-09T07:14:00Z", "document": { "id": "0199c3a1-0642-77d2-8a59-f43bed2bf507", "name": "Northwind Transport", "mime_type": "application/pdf" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3bf-98b9-7427-9cbd-e23fcd9c47d1" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "files.document.uploaded": { "post": { "operationId": "eventFilesDocumentUploaded", "summary": "files.document.uploaded", "description": "A document was uploaded.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:files.documents:read` as well as `int:webhooks:manage`.\n\n`data` is a `DocumentEventData` (below).", "x-oh-domain": "files", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:files.documents:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "files.document.uploaded" }, "data": { "$ref": "#/components/schemas/DocumentEventData" } } } ] }, "example": { "id": "evt_0199c35a-ba11-7452-9bc2-1f9d25b61b73", "type": "files.document.uploaded", "occurred_at": "2026-03-02T08:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ad-4758-796a-85c6-e1f203142524", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "name": "SK-4821-AB-insurance-2026.pdf", "mime_type": "application/pdf", "size_bytes": 248311, "status": "ready", "folder_id": "0199c38c-5869-7a7b-96d7-f20314253625", "uploaded_by": "0199c38a-2536-7748-83a4-cfd0e1f20322", "uploaded_at": "2026-01-15T10:20:00Z", "shared_with": [], "shared_expires_at": null, "deleted_at": null, "created_at": "2026-01-15T10:20:00Z", "updated_at": "2026-03-02T08:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c32d-3bb8-7d50-b0f2-8995fb1e562e" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "files.esign.completed": { "post": { "operationId": "eventFilesEsignCompleted", "summary": "files.esign.completed", "description": "A document e-signature was completed by all signers.\n\nIntroduced in `2026-05-28`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `ESignCallbackEventData` (below).", "x-oh-domain": "files", "x-oh-introduced": "2026-05-28", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "files.esign.completed" }, "data": { "$ref": "#/components/schemas/ESignCallbackEventData" } } } ] }, "example": { "id": "evt_0199c340-a0ae-773a-9f70-14496e1af831", "type": "files.esign.completed", "occurred_at": "2026-09-09T07:03:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "provider": "dropbox_sign", "provider_ref": "sig-req-0042", "state": "submitted", "completed_at": "2026-09-14T08:52:00Z", "origin_domain": "sign.example.com", "origin_row_id": "0199c3e7-c321-7ef9-8ac0-dceef7e42cc3", "occurred_at": "2026-09-04T17:29:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c360-a8a6-7f89-9e95-975e5e8aadc3" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "files.esign.declined": { "post": { "operationId": "eventFilesEsignDeclined", "summary": "files.esign.declined", "description": "A document e-signature request was declined, expired, or errored.\n\nIntroduced in `2026-05-28`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `ESignCallbackEventData` (below).", "x-oh-domain": "files", "x-oh-introduced": "2026-05-28", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "files.esign.declined" }, "data": { "$ref": "#/components/schemas/ESignCallbackEventData" } } } ] }, "example": { "id": "evt_0199c313-e5c6-73e5-a34a-162c46b1f9fd", "type": "files.esign.declined", "occurred_at": "2026-09-04T09:41:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "provider": "dropbox_sign", "provider_ref": "sig-req-0042", "state": "submitted", "completed_at": "2026-09-17T06:25:00Z", "origin_domain": "sign.example.com", "origin_row_id": "0199c38c-6c2e-7255-b74b-2cdf1365c686", "occurred_at": "2026-09-10T07:13:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c313-95af-738e-a61b-43421c8687b1" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.bill.approved": { "post": { "operationId": "eventFinBillApproved", "summary": "fin.bill.approved", "description": "A supplier bill was approved for payment.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.bills:read` as well as `int:webhooks:manage`.\n\n`data` is a `BillEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.bills:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.bill.approved" }, "data": { "$ref": "#/components/schemas/BillEventData" } } } ] }, "example": { "id": "evt_0199c3ac-60f2-7915-929d-f6092fff7b01", "type": "fin.bill.approved", "occurred_at": "2026-09-11T07:45:12Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "posted", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": "2026-09-11T07:45:12Z", "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-11T07:45:12Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b9-23fe-76b0-a9a6-6ee9277f865f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.bill.created": { "post": { "operationId": "eventFinBillCreated", "summary": "fin.bill.created", "description": "A supplier bill was recorded.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.bills:read` as well as `int:webhooks:manage`.\n\n`data` is a `BillEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.bills:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.bill.created" }, "data": { "$ref": "#/components/schemas/BillEventData" } } } ] }, "example": { "id": "evt_0199c3ef-d50b-72c5-8c69-74c326beb6c9", "type": "fin.bill.created", "occurred_at": "2026-09-10T15:20:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "draft", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": null, "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-10T15:20:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3c7-3d2a-7208-aeb0-0fd1ad3d2d2d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.bill.paid": { "post": { "operationId": "eventFinBillPaid", "summary": "fin.bill.paid", "description": "A supplier bill was fully paid.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.bills:read` as well as `int:webhooks:manage`.\n\n`data` is a `BillEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.bills:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.bill.paid" }, "data": { "$ref": "#/components/schemas/BillEventData" } } } ] }, "example": { "id": "evt_0199c37e-4e68-73ba-b6dc-442736847a12", "type": "fin.bill.paid", "occurred_at": "2026-10-08T10:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "paid", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 101480, "balance_minor": 0, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": "2026-09-11T07:45:12Z", "paid_at": "2026-10-08T10:00:00Z", "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-10-08T10:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e6-52dc-7941-9e3a-eddf21620ebb" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.bill.updated": { "post": { "operationId": "eventFinBillUpdated", "summary": "fin.bill.updated", "description": "A draft supplier bill was modified post-creation (lines, totals, metadata).\n\nIntroduced in `2026-08-18`. Subscribing needs a key with `int:fin.bills:read` as well as `int:webhooks:manage`.\n\n`data` is a `BillEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-08-18", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.bills:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.bill.updated" }, "data": { "$ref": "#/components/schemas/BillEventData" } } } ] }, "example": { "id": "evt_0199c3a4-5454-73fa-8572-2601ba82ece4", "type": "fin.bill.updated", "occurred_at": "2026-09-10T16:02:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "draft", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-17", "approved_at": null, "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-10T16:02:00Z", "previous": { "due_date": "2026-10-10", "updated_at": "2026-09-10T15:20:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c36c-221b-7a92-8f74-6099b94f9b5b" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.datev.export.completed": { "post": { "operationId": "eventFinDatevExportCompleted", "summary": "fin.datev.export.completed", "description": "A DATEV FIBU (financial accounting) export finished. It waits for someone in the company to confirm it was imported into DATEV; `data` identifies the export, its period, file and row count.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `DatevExportCompletedEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.datev.export.completed" }, "data": { "$ref": "#/components/schemas/DatevExportCompletedEventData" } } } ] }, "example": { "id": "evt_0199c3d2-1980-78b3-9247-3d72d1c8e066", "type": "fin.datev.export.completed", "occurred_at": "2026-09-07T14:45:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "exportRunId": "0199c37f-0d9c-7426-bfda-b713865a693c", "periodFrom": "2026-09-01", "periodTo": "2026-09-13", "variant": "buchungsstapel", "fileId": "0199c3c3-f4d9-717b-b5df-c3f4c0814fd5", "rowCount": 3, "periodLockId": "0199c3ac-f451-7d1e-8394-de25e62b06e9" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3c7-f550-7486-97a4-ac9008bc7b63" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.document.accepted": { "post": { "operationId": "eventFinEinvoicingDocumentAccepted", "summary": "fin.einvoicing.document.accepted", "description": "An e-invoicing document was accepted by the partner network.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingDocumentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.document.accepted" }, "data": { "$ref": "#/components/schemas/EinvoicingDocumentEventData" } } } ] }, "example": { "id": "evt_0199c35b-5e11-74ad-a0bd-4565d42de54a", "type": "fin.einvoicing.document.accepted", "occurred_at": "2026-09-12T13:18:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c37c-cf5b-7961-8b26-ada2e9e1ebc4", "invoice_id": "0199c345-1a13-79ec-a524-cd4e178042cd", "route": "peppol", "direction": "outbound", "status": "submitted", "partner_document_id": "0199c39b-bad5-779b-8c2c-0ea369b7daac", "issued_at": "2026-09-08T11:07:00Z", "transmitted_at": "2026-09-12T13:44:00Z", "acknowledged_at": "2026-09-07T09:20:00Z", "rejected_at": "2026-09-17T13:21:00Z", "created_at": "2026-09-15T12:53:00Z", "updated_at": "2026-09-12T13:18:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c350-bd77-73f9-8b05-767a53d21bf4" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.document.issued": { "post": { "operationId": "eventFinEinvoicingDocumentIssued", "summary": "fin.einvoicing.document.issued", "description": "An e-invoicing document was issued (FR PA, Peppol, SdI, etc.).\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingDocumentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.document.issued" }, "data": { "$ref": "#/components/schemas/EinvoicingDocumentEventData" } } } ] }, "example": { "id": "evt_0199c381-9a57-73a6-95f0-e5addeb2a423", "type": "fin.einvoicing.document.issued", "occurred_at": "2026-09-16T11:24:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c34d-0528-7621-b5bb-09eda4ff0569", "invoice_id": "0199c301-cba4-7bc7-be02-95b7a45f9216", "route": "peppol", "direction": "outbound", "status": "submitted", "partner_document_id": "0199c348-03bd-701e-9477-2c76714a92b7", "issued_at": "2026-09-22T09:02:00Z", "transmitted_at": "2026-09-16T13:33:00Z", "acknowledged_at": "2026-09-04T14:00:00Z", "rejected_at": "2026-09-01T09:52:00Z", "created_at": "2026-09-01T07:42:00Z", "updated_at": "2026-09-16T11:24:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e9-9dd7-70f7-8b90-5576d851cda2" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.document.rejected": { "post": { "operationId": "eventFinEinvoicingDocumentRejected", "summary": "fin.einvoicing.document.rejected", "description": "An e-invoicing document was rejected by the partner network.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingDocumentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.document.rejected" }, "data": { "$ref": "#/components/schemas/EinvoicingDocumentEventData" } } } ] }, "example": { "id": "evt_0199c321-63ba-7135-a168-19cf01971b62", "type": "fin.einvoicing.document.rejected", "occurred_at": "2026-09-11T17:49:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c355-ad71-7c2c-9517-778767cd3e6e", "invoice_id": "0199c3da-b8a8-78dc-b528-f07d07088604", "route": "peppol", "direction": "outbound", "status": "submitted", "partner_document_id": "0199c317-c2ab-7d46-b374-a44604b57be8", "issued_at": "2026-09-01T12:17:00Z", "transmitted_at": "2026-09-15T16:26:00Z", "acknowledged_at": "2026-09-14T07:07:00Z", "rejected_at": "2026-09-16T11:30:00Z", "created_at": "2026-09-08T13:10:00Z", "updated_at": "2026-09-11T17:49:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c335-974e-7026-966e-6a032c0fa73d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.document.transmitted": { "post": { "operationId": "eventFinEinvoicingDocumentTransmitted", "summary": "fin.einvoicing.document.transmitted", "description": "An e-invoicing document was transmitted to its partner network.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingDocumentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.document.transmitted" }, "data": { "$ref": "#/components/schemas/EinvoicingDocumentEventData" } } } ] }, "example": { "id": "evt_0199c32c-138f-73b2-9dec-e77952d69b61", "type": "fin.einvoicing.document.transmitted", "occurred_at": "2026-09-20T09:27:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ed-6827-7c0a-b8f9-39492daa49ba", "invoice_id": "0199c3cf-6e51-7d14-a9c6-17a47b46b9f0", "route": "peppol", "direction": "outbound", "status": "submitted", "partner_document_id": "0199c37b-5ce5-7fcf-aa03-163653557621", "issued_at": "2026-09-17T17:54:00Z", "transmitted_at": "2026-09-05T12:08:00Z", "acknowledged_at": "2026-09-01T13:02:00Z", "rejected_at": "2026-09-17T13:43:00Z", "created_at": "2026-09-11T07:05:00Z", "updated_at": "2026-09-20T09:27:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c398-33ad-705a-99c8-42a74f42a800" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.mandate.activated": { "post": { "operationId": "eventFinEinvoicingMandateActivated", "summary": "fin.einvoicing.mandate.activated", "description": "A signed e-invoicing mandate became active for issuance / receipt.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingMandateEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.mandate.activated" }, "data": { "$ref": "#/components/schemas/EinvoicingMandateEventData" } } } ] }, "example": { "id": "evt_0199c3cb-b9cb-7cff-919f-6523c035b467", "type": "fin.einvoicing.mandate.activated", "occurred_at": "2026-09-03T11:43:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3e7-e929-7dce-b152-5db66e9260b4", "tenant_customer_id": "0199c38e-c1bc-7a49-89f2-1485341bcf46", "siren": "123456789", "jurisdiction": "https://files.example.com/d7471c8a9f6a", "status": "submitted", "signed_at": "2026-09-01T16:28:00Z", "activated_at": "2026-09-12T08:38:00Z", "revoked_at": "2026-09-04T10:02:00Z", "provider_envelope_id": "0199c31c-ea85-75d5-8b92-149280f1d10a", "created_at": "2026-09-13T09:51:00Z", "updated_at": "2026-09-03T11:43:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b6-6974-7308-81e5-ddf3195af126" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.mandate.created": { "post": { "operationId": "eventFinEinvoicingMandateCreated", "summary": "fin.einvoicing.mandate.created", "description": "A draft e-invoicing mandate was created and awaits signature.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingMandateEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.mandate.created" }, "data": { "$ref": "#/components/schemas/EinvoicingMandateEventData" } } } ] }, "example": { "id": "evt_0199c389-40d6-7ade-b06c-9058faf48300", "type": "fin.einvoicing.mandate.created", "occurred_at": "2026-09-25T15:36:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c30b-1f75-71f2-a656-c6ee68134c42", "tenant_customer_id": "0199c363-b798-7a3c-b11f-e182287902cf", "siren": "123456789", "jurisdiction": "https://files.example.com/4596d09d02a8", "status": "submitted", "signed_at": "2026-09-23T14:37:00Z", "activated_at": "2026-09-02T12:15:00Z", "revoked_at": "2026-09-15T07:51:00Z", "provider_envelope_id": "0199c340-75c0-7b32-88c0-5805f5b55c18", "created_at": "2026-09-23T08:21:00Z", "updated_at": "2026-09-25T15:36:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3ab-6a78-74f7-9cfc-fde906a1b0c1" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.einvoicing.mandate.revoked": { "post": { "operationId": "eventFinEinvoicingMandateRevoked", "summary": "fin.einvoicing.mandate.revoked", "description": "An e-invoicing mandate was revoked by the tenant.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer.\n\n`data` is a `EinvoicingMandateEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-19", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.einvoicing.mandate.revoked" }, "data": { "$ref": "#/components/schemas/EinvoicingMandateEventData" } } } ] }, "example": { "id": "evt_0199c391-481f-72dc-80b7-ddcd6d83c8c7", "type": "fin.einvoicing.mandate.revoked", "occurred_at": "2026-09-15T07:36:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3dd-5776-73ae-8da7-fbc83051bef9", "tenant_customer_id": "0199c3bd-f1f7-70fc-9848-ca7c58984c17", "siren": "123456789", "jurisdiction": "https://files.example.com/3332000c2906", "status": "submitted", "signed_at": "2026-09-18T08:13:00Z", "activated_at": "2026-09-23T13:13:00Z", "revoked_at": "2026-09-23T17:56:00Z", "provider_envelope_id": "0199c3dc-5b8c-7014-bde8-dd5bdea816c9", "created_at": "2026-09-09T06:37:00Z", "updated_at": "2026-09-15T07:36:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c31f-4f35-7a57-a848-c14bd0756602" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.created": { "post": { "operationId": "eventFinInvoiceCreated", "summary": "fin.invoice.created", "description": "Sales invoice draft was created.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.created" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c37b-d97d-7e97-a7b9-eaa23c48a4c4", "type": "fin.invoice.created", "occurred_at": "2026-09-14T08:30:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": null, "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "draft", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 0, "balance_minor": 147500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": null, "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-14T08:30:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c32d-2001-78c6-a882-79a259562109" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.overdue": { "post": { "operationId": "eventFinInvoiceOverdue", "summary": "fin.invoice.overdue", "description": "Sales invoice crossed its due date without full settlement.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.overdue" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c31f-9364-7f6e-9178-ab18887faffe", "type": "fin.invoice.overdue", "occurred_at": "2026-10-15T00:05:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "overdue", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 50000, "balance_minor": 97500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-10-15T00:05:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c331-1429-7de9-8617-8fb93a5f94ff" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.paid": { "post": { "operationId": "eventFinInvoicePaid", "summary": "fin.invoice.paid", "description": "Sales invoice was settled in full.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.paid" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c321-00d8-7466-bc7f-2fd21c4f12af", "type": "fin.invoice.paid", "occurred_at": "2026-10-02T09:14:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "paid", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 147500, "balance_minor": 0, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-10-02T09:14:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d3-df89-7e1e-bab1-6f8b3531ef61" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.sent": { "post": { "operationId": "eventFinInvoiceSent", "summary": "fin.invoice.sent", "description": "Sales invoice was emailed/transmitted to the customer.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.sent" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c3bd-eb3b-76a3-9b29-dd683eb9f1c1", "type": "fin.invoice.sent", "occurred_at": "2026-09-14T08:32:10Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "issued", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 0, "balance_minor": 147500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-14T08:32:10Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c30d-6b60-705a-9f25-fc5c935d885a" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.updated": { "post": { "operationId": "eventFinInvoiceUpdated", "summary": "fin.invoice.updated", "description": "Sales invoice was modified post-creation (lines, totals, metadata).\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.updated" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c3d6-cf20-7423-8782-3537aa0adee3", "type": "fin.invoice.updated", "occurred_at": "2026-09-14T08:31:12Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": null, "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "draft", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 0, "balance_minor": 147500, "issue_date": "2026-09-14", "due_date": "2026-10-30", "issued_at": null, "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-14T08:31:12Z", "previous": { "due_date": "2026-10-14", "updated_at": "2026-09-14T08:30:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c35a-c378-7146-97b5-86cdb620a643" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.invoice.voided": { "post": { "operationId": "eventFinInvoiceVoided", "summary": "fin.invoice.voided", "description": "Sales invoice was voided (reversed via credit note).\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.invoices:read` as well as `int:webhooks:manage`.\n\n`data` is a `InvoiceEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.invoices:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.invoice.voided" }, "data": { "$ref": "#/components/schemas/InvoiceEventData" } } } ] }, "example": { "id": "evt_0199c364-697d-7de7-aec4-dd1bfd924b81", "type": "fin.invoice.voided", "occurred_at": "2026-09-29T13:40:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "status": "void", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 0, "balance_minor": 0, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": "2026-09-29T13:40:00Z", "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-29T13:40:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c321-da82-7860-9222-da14360cbb6d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.payment.failed": { "post": { "operationId": "eventFinPaymentFailed", "summary": "fin.payment.failed", "description": "A payment attempt failed.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.payments:read` as well as `int:webhooks:manage`.\n\n`data` is a `PaymentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.payments:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.payment.failed" }, "data": { "$ref": "#/components/schemas/PaymentEventData" } } } ] }, "example": { "id": "evt_0199c3d8-5fb2-7068-bda9-58260994c0e4", "type": "fin.payment.failed", "occurred_at": "2026-09-21T10:05:40Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "in", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": "Card declined by issuer", "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c309-4484-76bf-badf-3b4bfe5a8f77" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.payment.received": { "post": { "operationId": "eventFinPaymentReceived", "summary": "fin.payment.received", "description": "A payment was received against an invoice or bill.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.payments:read` as well as `int:webhooks:manage`.\n\n`data` is a `PaymentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.payments:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.payment.received" }, "data": { "$ref": "#/components/schemas/PaymentEventData" } } } ] }, "example": { "id": "evt_0199c385-9d58-783d-a0c9-8b65189c9769", "type": "fin.payment.received", "occurred_at": "2026-09-21T10:05:40Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "in", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": null, "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c309-5219-70f5-bb1b-509063c2e5bb" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.payment.refunded": { "post": { "operationId": "eventFinPaymentRefunded", "summary": "fin.payment.refunded", "description": "A payment was refunded.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.payments:read` as well as `int:webhooks:manage`.\n\n`data` is a `PaymentEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.payments:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.payment.refunded" }, "data": { "$ref": "#/components/schemas/PaymentEventData" } } } ] }, "example": { "id": "evt_0199c33f-c841-72e9-bf0d-17723f8fffbf", "type": "fin.payment.refunded", "occurred_at": "2026-09-21T10:05:40Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": null, "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "refund", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": null, "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c346-4c69-7497-9a0b-7e0c6e725443" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.purchase_order.approved": { "post": { "operationId": "eventFinPurchaseOrderApproved", "summary": "fin.purchase_order.approved", "description": "A purchase order was approved and sent.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.purchase_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `PurchaseOrderEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.purchase_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.purchase_order.approved" }, "data": { "$ref": "#/components/schemas/PurchaseOrderEventData" } } } ] }, "example": { "id": "evt_0199c3f5-c51f-7142-991c-67def70c4c86", "type": "fin.purchase_order.approved", "occurred_at": "2026-09-08T11:00:05Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "sent", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": null, "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-08T11:00:05Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c393-2ef8-7849-a44a-7172963d9df1" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.purchase_order.closed": { "post": { "operationId": "eventFinPurchaseOrderClosed", "summary": "fin.purchase_order.closed", "description": "A purchase order was closed.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.purchase_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `PurchaseOrderEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.purchase_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.purchase_order.closed" }, "data": { "$ref": "#/components/schemas/PurchaseOrderEventData" } } } ] }, "example": { "id": "evt_0199c31b-a41b-7556-a7ef-0da4d53b5ff1", "type": "fin.purchase_order.closed", "occurred_at": "2026-09-30T08:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "closed", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": "2026-09-24T13:30:00Z", "closed_at": "2026-09-30T08:00:00Z", "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-30T08:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c31a-acb2-7b53-8730-808db31f3693" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.purchase_order.created": { "post": { "operationId": "eventFinPurchaseOrderCreated", "summary": "fin.purchase_order.created", "description": "A purchase order was drafted.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.purchase_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `PurchaseOrderEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.purchase_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.purchase_order.created" }, "data": { "$ref": "#/components/schemas/PurchaseOrderEventData" } } } ] }, "example": { "id": "evt_0199c3b1-87ad-7d86-802d-62f579c75a7d", "type": "fin.purchase_order.created", "occurred_at": "2026-09-08T10:41:30Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "draft", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": null, "received_at": null, "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-08T10:41:30Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b0-a0aa-7751-be29-4ee632e5c9c5" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fin.purchase_order.received": { "post": { "operationId": "eventFinPurchaseOrderReceived", "summary": "fin.purchase_order.received", "description": "A goods-receipt closed (fully or partially) the PO.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fin.purchase_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `PurchaseOrderEventData` (below).", "x-oh-domain": "fin", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fin.purchase_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fin.purchase_order.received" }, "data": { "$ref": "#/components/schemas/PurchaseOrderEventData" } } } ] }, "example": { "id": "evt_0199c3e2-f89a-788d-9a9c-dd413bc756c8", "type": "fin.purchase_order.received", "occurred_at": "2026-09-24T13:30:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "received", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": "2026-09-24T13:30:00Z", "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-24T13:30:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c37a-f361-7611-b0f8-3de6a91e2f1d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.dashcam.safety_event.detected": { "post": { "operationId": "eventFmDashcamSafetyEventDetected", "summary": "fm.dashcam.safety_event.detected", "description": "An AI dashcam safety event was ingested via a vendor webhook.\n\nIntroduced in `2026-05-23`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `DashcamSafetyEventEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-23", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.dashcam.safety_event.detected" }, "data": { "$ref": "#/components/schemas/DashcamSafetyEventEventData" } } } ] }, "example": { "id": "evt_0199c38f-47d4-7fc9-910b-1af4652dbb46", "type": "fm.dashcam.safety_event.detected", "occurred_at": "2026-09-12T12:01:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c37e-593f-785d-8742-fcfc778e3b27", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "device_id": "0199c3a1-4800-7205-94c3-37612fc72a5d", "trip_id": "0199c3cf-f5c7-7071-870f-ed7c868a6a7a", "driver_id": "0199c33b-2617-7aba-9deb-b8029e7f334e", "provider": "samsara", "provider_event_id": "0199c363-8194-7f12-a4d6-9c115791c41c", "event_kind": "harsh_braking", "severity": 1, "occurred_at": "2026-09-15T09:59:00Z", "location_lat": 41.9973, "location_lon": 21.428, "review_state": "pending_review", "created_at": "2026-09-19T15:09:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c365-9bf8-7286-a456-92ff5ed42606" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.fuel_log.recorded": { "post": { "operationId": "eventFmFuelLogRecorded", "summary": "fm.fuel_log.recorded", "description": "A fuel transaction was recorded for a vehicle.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.fuel_logs:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `FuelLogEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:fm.fuel_logs:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.fuel_log.recorded" }, "data": { "$ref": "#/components/schemas/FuelLogEventData" } } } ] }, "example": { "id": "evt_0199c385-89df-7544-a80b-0b8fa62f9857", "type": "fm.fuel_log.recorded", "occurred_at": "2026-09-21T16:10:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a9-8b9c-7dae-8f0a-2b3c4d5e6f12", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "driver_id": "0199c384-9cad-7ebf-9a1b-3c4d5e6f7a13", "recorded_at": "2026-09-13T16:48:00Z", "fuel_type": "diesel", "volume_l": 312.5, "price_per_unit_minor": 142, "total_cost_minor": 44375, "currency": "EUR", "odometer_km": 283977, "location_lat": 41.9973, "location_lng": 21.428, "source": "card", "created_at": "2026-09-13T17:02:31Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b3-8826-7804-8c40-be527eec25e0" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.osnma.verification_failed": { "post": { "operationId": "eventFmTachographOsnmaVerificationFailed", "summary": "fm.tachograph.osnma.verification_failed", "description": "Galileo OSNMA verification of a DTCO 4.1a GNSS record failed — possible GNSS spoof.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographViolationEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.osnma.verification_failed" }, "data": { "$ref": "#/components/schemas/TachographViolationEventData" } } } ] }, "example": { "id": "evt_0199c38d-24ad-716e-8931-dfb847e4cd03", "type": "fm.tachograph.osnma.verification_failed", "occurred_at": "2026-09-14T13:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c38a-2220-7788-b27f-32299eb41bae", "upload_id": "0199c358-ba87-7707-b5fc-6a386713fc4b", "driver_employee_id": "0199c35a-98e7-73c1-bfe1-4330d6d2ecfe", "vehicle_id": "0199c375-0e63-79d0-93f8-12e401237886", "rule_code": "osnma_signature_invalid", "severity": "high", "detected_at": "2026-09-05T08:20:00Z", "window_start": "2026-09-16 12:07:00+00", "window_end": "2026-09-19 09:46:00+00", "overage_seconds": 45, "created_at": "2026-09-05T11:12:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3a4-678d-7086-b39d-996df1cf73c3" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.threshold.exceeded": { "post": { "operationId": "eventFmTachographThresholdExceeded", "summary": "fm.tachograph.threshold.exceeded", "description": "An operational tachograph alert threshold tripped for a driver.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographThresholdEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.threshold.exceeded" }, "data": { "$ref": "#/components/schemas/TachographThresholdEventData" } } } ] }, "example": { "id": "evt_0199c36e-c0ae-7819-a667-35b50fa8eed7", "type": "fm.tachograph.threshold.exceeded", "occurred_at": "2026-09-23T15:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3db-cc71-7f24-b51a-a580333bbad8", "threshold_code": "weekly_driving_time", "driver_employee_id": "0199c3d4-f032-7b1f-94f6-1b76766ddc30", "vehicle_id": "0199c3a6-2cd0-7d48-a796-30d0e31dce52", "severity": "high", "exceeded_at": "2026-09-01T11:51:00Z", "observed_value": 0.42, "threshold_value": 0.42, "created_at": "2026-09-16T17:19:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c32b-d835-74ad-90ba-263130d15efd" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.upload.lcv_received": { "post": { "operationId": "eventFmTachographUploadLcvReceived", "summary": "fm.tachograph.upload.lcv_received", "description": "A DTCO 4.1a (LCV cohort) tachograph upload was received.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographUploadEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.upload.lcv_received" }, "data": { "$ref": "#/components/schemas/TachographUploadEventData" } } } ] }, "example": { "id": "evt_0199c347-b508-770c-9c3d-747a5516fa6b", "type": "fm.tachograph.upload.lcv_received", "occurred_at": "2026-09-02T06:02:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c394-1438-7ebd-8728-d8e1e9ce3e37", "source_kind": "driver_card", "driver_employee_id": "0199c37e-487c-7605-8141-2d1ad69fa1e0", "vehicle_id": "0199c342-4d77-7a44-8800-c98bcb7cb32e", "file_name": "Northwind Transport", "file_size_bytes": 248311, "status": "submitted", "activity_start": "2026-09-11 10:00:00+00", "activity_end": "2026-09-27 09:02:00+00", "violation_count": 3, "uploaded_at": "2026-09-07T17:45:00Z", "processed_at": "2026-09-09T14:09:00Z", "created_at": "2026-09-21T09:55:00Z", "updated_at": "2026-09-02T06:02:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c338-13da-7e75-b022-1c1d56a3e9ff" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.upload.processed": { "post": { "operationId": "eventFmTachographUploadProcessed", "summary": "fm.tachograph.upload.processed", "description": "A tachograph file finished processing; activities and violations were derived.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographUploadEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.upload.processed" }, "data": { "$ref": "#/components/schemas/TachographUploadEventData" } } } ] }, "example": { "id": "evt_0199c3d2-2a4f-771b-8d80-9a339b20e5b5", "type": "fm.tachograph.upload.processed", "occurred_at": "2026-09-24T17:42:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c385-bba7-7ac2-82ea-a7bb8487f8f4", "source_kind": "driver_card", "driver_employee_id": "0199c372-7e25-7800-94a8-caeefe548c9d", "vehicle_id": "0199c314-ec75-7217-9352-1a66a803106d", "file_name": "Northwind Transport", "file_size_bytes": 248311, "status": "submitted", "activity_start": "2026-09-08 11:05:00+00", "activity_end": "2026-09-14 12:26:00+00", "violation_count": 3, "uploaded_at": "2026-09-27T11:14:00Z", "processed_at": "2026-09-01T12:46:00Z", "created_at": "2026-09-10T10:25:00Z", "updated_at": "2026-09-24T17:42:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c37b-9378-76d5-be49-c62fcda1929d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.upload.received": { "post": { "operationId": "eventFmTachographUploadReceived", "summary": "fm.tachograph.upload.received", "description": "A tachograph file was uploaded for processing.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographUploadEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.upload.received" }, "data": { "$ref": "#/components/schemas/TachographUploadEventData" } } } ] }, "example": { "id": "evt_0199c30a-a628-700c-8f57-ad2717cdd48f", "type": "fm.tachograph.upload.received", "occurred_at": "2026-09-28T10:51:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ff-2ab3-743d-b6c6-5729860c770a", "source_kind": "driver_card", "driver_employee_id": "0199c355-67fb-7724-9d54-4c2931e311ee", "vehicle_id": "0199c37b-1d58-7ac6-92ac-846810a97678", "file_name": "Northwind Transport", "file_size_bytes": 248311, "status": "submitted", "activity_start": "2026-09-25 07:01:00+00", "activity_end": "2026-09-09 13:20:00+00", "violation_count": 3, "uploaded_at": "2026-09-06T08:00:00Z", "processed_at": "2026-09-10T14:58:00Z", "created_at": "2026-09-08T08:27:00Z", "updated_at": "2026-09-28T10:51:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c36e-c284-78e4-a495-303528cc389b" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.tachograph.violation.detected": { "post": { "operationId": "eventFmTachographViolationDetected", "summary": "fm.tachograph.violation.detected", "description": "A drive-rest rule violation was detected from a tachograph upload.\n\nIntroduced in `2026-05-19`. Subscribing needs a key with `int:*` (no narrower read scope covers this family), which **Settings → API keys** does not offer. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TachographViolationEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-19", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:*", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.tachograph.violation.detected" }, "data": { "$ref": "#/components/schemas/TachographViolationEventData" } } } ] }, "example": { "id": "evt_0199c325-64bd-765c-955f-62fedc6e042b", "type": "fm.tachograph.violation.detected", "occurred_at": "2026-09-18T07:27:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3fb-d6c5-7f1a-b58e-a67f797fd2af", "upload_id": "0199c327-a34e-71f0-985f-e1a0a63d90a9", "driver_employee_id": "0199c3c5-648d-7840-a10b-6ed3993048d7", "vehicle_id": "0199c35b-cb3b-75af-b7ab-fce285af1243", "rule_code": "osnma_signature_invalid", "severity": "high", "detected_at": "2026-09-13T13:03:00Z", "window_start": "2026-09-08 07:06:00+00", "window_end": "2026-09-23 13:44:00+00", "overage_seconds": 45, "created_at": "2026-09-10T10:48:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c31d-946b-73b2-b23e-30d0c1826171" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.vehicle.back_in_service": { "post": { "operationId": "eventFmVehicleBackInService", "summary": "fm.vehicle.back_in_service", "description": "A vehicle was returned to active service.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.vehicles:read` as well as `int:webhooks:manage`.\n\n`data` is a `VehicleEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.vehicles:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.vehicle.back_in_service" }, "data": { "$ref": "#/components/schemas/VehicleEventData" } } } ] }, "example": { "id": "evt_0199c39c-336a-7e8c-b257-1111416a578e", "type": "fm.vehicle.back_in_service", "occurred_at": "2026-09-15T16:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T16:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d8-c2c0-77a7-8285-f1304ddca2ef" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.vehicle.created": { "post": { "operationId": "eventFmVehicleCreated", "summary": "fm.vehicle.created", "description": "A vehicle was added to the fleet.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.vehicles:read` as well as `int:webhooks:manage`.\n\n`data` is a `VehicleEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.vehicles:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.vehicle.created" }, "data": { "$ref": "#/components/schemas/VehicleEventData" } } } ] }, "example": { "id": "evt_0199c3e3-175f-7a40-95ca-33bc861c9e81", "type": "fm.vehicle.created", "occurred_at": "2026-02-03T09:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 283500, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-02-03T09:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c310-78ec-725d-af07-b360dc0cfef9" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.vehicle.out_of_service": { "post": { "operationId": "eventFmVehicleOutOfService", "summary": "fm.vehicle.out_of_service", "description": "A vehicle was marked out of service.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.vehicles:read` as well as `int:webhooks:manage`.\n\n`data` is a `VehicleEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.vehicles:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.vehicle.out_of_service" }, "data": { "$ref": "#/components/schemas/VehicleEventData" } } } ] }, "example": { "id": "evt_0199c3ca-4e8c-7db0-bf96-58acd609ec00", "type": "fm.vehicle.out_of_service", "occurred_at": "2026-09-15T07:10:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "maintenance", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T07:10:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c398-4745-74d1-8a2f-94a3195f033a" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.vehicle.updated": { "post": { "operationId": "eventFmVehicleUpdated", "summary": "fm.vehicle.updated", "description": "A vehicle was modified.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.vehicles:read` as well as `int:webhooks:manage`.\n\n`data` is a `VehicleEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.vehicles:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.vehicle.updated" }, "data": { "$ref": "#/components/schemas/VehicleEventData" } } } ] }, "example": { "id": "evt_0199c309-f044-77f7-9295-14c59cd497cf", "type": "fm.vehicle.updated", "occurred_at": "2026-09-15T07:10:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T07:10:00Z", "previous": { "odometer_km": 283977, "updated_at": "2026-09-13T17:02:31Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3aa-3477-7d96-978f-095b87bc92ef" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.work_order.assigned": { "post": { "operationId": "eventFmWorkOrderAssigned", "summary": "fm.work_order.assigned", "description": "A work order was assigned to a user or vendor.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.work_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `WorkOrderEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.work_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.work_order.assigned" }, "data": { "$ref": "#/components/schemas/WorkOrderEventData" } } } ] }, "example": { "id": "evt_0199c30e-c7e4-789b-a796-b598512371ce", "type": "fm.work_order.assigned", "occurred_at": "2026-09-13T09:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "assigned", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": null, "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-13T09:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c398-a327-7a64-9a73-197d301aa9af" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.work_order.cancelled": { "post": { "operationId": "eventFmWorkOrderCancelled", "summary": "fm.work_order.cancelled", "description": "A work order was cancelled.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.work_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `WorkOrderEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.work_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.work_order.cancelled" }, "data": { "$ref": "#/components/schemas/WorkOrderEventData" } } } ] }, "example": { "id": "evt_0199c319-c289-7dd5-9185-e9876807e261", "type": "fm.work_order.cancelled", "occurred_at": "2026-09-14T11:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "cancelled", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": null, "completed_at": null, "cancelled_at": "2026-09-14T11:00:00Z", "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-14T11:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3be-ed87-774c-82a8-3923871994bd" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.work_order.completed": { "post": { "operationId": "eventFmWorkOrderCompleted", "summary": "fm.work_order.completed", "description": "A work order was completed.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.work_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `WorkOrderEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.work_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.work_order.completed" }, "data": { "$ref": "#/components/schemas/WorkOrderEventData" } } } ] }, "example": { "id": "evt_0199c37c-fd78-71ab-b7a7-ebc01183a1cf", "type": "fm.work_order.completed", "occurred_at": "2026-09-15T15:45:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "completed", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": null, "completed_at": "2026-09-15T15:45:00Z", "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-15T15:45:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c383-9548-7fe4-9072-22afadb21073" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.work_order.created": { "post": { "operationId": "eventFmWorkOrderCreated", "summary": "fm.work_order.created", "description": "A work order was created.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.work_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `WorkOrderEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.work_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.work_order.created" }, "data": { "$ref": "#/components/schemas/WorkOrderEventData" } } } ] }, "example": { "id": "evt_0199c366-29f8-76fa-b62a-4f0b2cda3aa7", "type": "fm.work_order.created", "occurred_at": "2026-09-12T14:02:11Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": null, "status": "scheduled", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": null, "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-12T14:02:11Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c382-cac2-7c24-b3c9-2af1e3644f5f" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "fm.work_order.started": { "post": { "operationId": "eventFmWorkOrderStarted", "summary": "fm.work_order.started", "description": "Work began on a work order.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:fm.work_orders:read` as well as `int:webhooks:manage`.\n\n`data` is a `WorkOrderEventData` (below).", "x-oh-domain": "fm", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:fm.work_orders:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "fm.work_order.started" }, "data": { "$ref": "#/components/schemas/WorkOrderEventData" } } } ] }, "example": { "id": "evt_0199c379-3189-73ab-bbc2-4f33694721a8", "type": "fm.work_order.started", "occurred_at": "2026-09-15T07:10:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "in_progress", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": "2026-09-15T07:10:00Z", "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-15T07:10:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3ac-855e-70ad-b83d-a2199d30e67c" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.employee.created": { "post": { "operationId": "eventHrEmployeeCreated", "summary": "hr.employee.created", "description": "An employee record was created.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.employees:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `EmployeeEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.employees:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.employee.created" }, "data": { "$ref": "#/components/schemas/EmployeeEventData" } } } ] }, "example": { "id": "evt_0199c3c6-2856-76b0-a800-98eb884623bc", "type": "hr.employee.created", "occurred_at": "2023-03-27T08:15:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "active", "hire_date": "2023-04-03", "termination_date": null, "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2023-03-27T08:15:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3ec-400c-7520-8cab-979a6bf40334" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.employee.terminated": { "post": { "operationId": "eventHrEmployeeTerminated", "summary": "hr.employee.terminated", "description": "An employee was terminated.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.employees:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `EmployeeEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.employees:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.employee.terminated" }, "data": { "$ref": "#/components/schemas/EmployeeEventData" } } } ] }, "example": { "id": "evt_0199c3bf-7de1-7216-9ea6-50ff07251e96", "type": "hr.employee.terminated", "occurred_at": "2026-08-30T12:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "terminated", "hire_date": "2023-04-03", "termination_date": "2026-10-31", "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2026-08-30T12:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c398-72e8-7a85-b952-a24eccae63ee" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.employee.updated": { "post": { "operationId": "eventHrEmployeeUpdated", "summary": "hr.employee.updated", "description": "An employee record was modified.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.employees:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `EmployeeEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.employees:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.employee.updated" }, "data": { "$ref": "#/components/schemas/EmployeeEventData" } } } ] }, "example": { "id": "evt_0199c30e-05d3-7397-bbb1-7bac859fbcb6", "type": "hr.employee.updated", "occurred_at": "2026-08-30T12:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "active", "hire_date": "2023-04-03", "termination_date": null, "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2026-08-30T12:00:00Z", "previous": { "manager_id": null, "updated_at": "2026-05-04T08:00:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c363-fa84-729e-801e-7d8ada723457" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.leave_request.approved": { "post": { "operationId": "eventHrLeaveRequestApproved", "summary": "hr.leave_request.approved", "description": "A leave request was approved.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.leave_requests:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `LeaveRequestEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.leave_requests:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.leave_request.approved" }, "data": { "$ref": "#/components/schemas/LeaveRequestEventData" } } } ] }, "example": { "id": "evt_0199c34d-e8df-7488-8028-39a23ad1d42e", "type": "hr.leave_request.approved", "occurred_at": "2026-09-22T09:30:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "approved", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": "Family holiday", "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-22T09:30:00Z", "rejected_by": null, "rejected_at": null, "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3e9-2b16-7676-bc8d-2279cd4f3669" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.leave_request.cancelled": { "post": { "operationId": "eventHrLeaveRequestCancelled", "summary": "hr.leave_request.cancelled", "description": "A leave request was cancelled.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.leave_requests:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `LeaveRequestEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.leave_requests:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.leave_request.cancelled" }, "data": { "$ref": "#/components/schemas/LeaveRequestEventData" } } } ] }, "example": { "id": "evt_0199c386-fce8-7d89-b096-c22a53141fc6", "type": "hr.leave_request.cancelled", "occurred_at": "2026-09-22T09:30:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "cancelled", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": "Family holiday", "approved_by": null, "approved_at": null, "rejected_by": null, "rejected_at": null, "cancelled_at": "2026-09-23T07:00:00Z", "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c32e-a96a-7c18-b1cd-bc32013c1a0a" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.leave_request.rejected": { "post": { "operationId": "eventHrLeaveRequestRejected", "summary": "hr.leave_request.rejected", "description": "A leave request was rejected.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.leave_requests:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `LeaveRequestEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.leave_requests:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.leave_request.rejected" }, "data": { "$ref": "#/components/schemas/LeaveRequestEventData" } } } ] }, "example": { "id": "evt_0199c3ed-cbed-7010-97e2-0a9a277eb24e", "type": "hr.leave_request.rejected", "occurred_at": "2026-09-22T09:30:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "rejected", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": "Family holiday", "approved_by": null, "approved_at": null, "rejected_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "rejected_at": "2026-09-22T09:30:00Z", "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3eb-8b90-7172-bfee-05f5997ae323" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.leave_request.submitted": { "post": { "operationId": "eventHrLeaveRequestSubmitted", "summary": "hr.leave_request.submitted", "description": "A leave request was submitted by an employee.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.leave_requests:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `LeaveRequestEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.leave_requests:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.leave_request.submitted" }, "data": { "$ref": "#/components/schemas/LeaveRequestEventData" } } } ] }, "example": { "id": "evt_0199c3ad-952f-7fc5-a7a9-ed9935f0bb75", "type": "hr.leave_request.submitted", "occurred_at": "2026-09-20T18:04:12Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "pending", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": "Family holiday", "approved_by": null, "approved_at": null, "rejected_by": null, "rejected_at": null, "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-20T18:04:12Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c323-04c1-79b7-9742-98409068ed95" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.timesheet.approved": { "post": { "operationId": "eventHrTimesheetApproved", "summary": "hr.timesheet.approved", "description": "A timesheet was approved.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.timesheets:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TimesheetEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.timesheets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.timesheet.approved" }, "data": { "$ref": "#/components/schemas/TimesheetEventData" } } } ] }, "example": { "id": "evt_0199c37b-9724-7574-8644-a2bcaa1cb0ba", "type": "hr.timesheet.approved", "occurred_at": "2026-09-14T08:10:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ab-f203-7415-9071-9cadbecfd019", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "period_start": "2026-09-07", "period_end": "2026-09-13", "status": "approved", "total_hours": 41.5, "regular_hours": null, "overtime_hours": null, "submitted_at": "2026-09-13T16:00:00Z", "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-14T08:10:00Z", "created_at": "2026-09-07T06:00:00Z", "updated_at": "2026-09-14T08:10:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c373-6cec-76f9-91aa-b1680974770d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "hr.timesheet.submitted": { "post": { "operationId": "eventHrTimesheetSubmitted", "summary": "hr.timesheet.submitted", "description": "A timesheet was submitted for approval.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:hr.timesheets:read` as well as `int:webhooks:manage`. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `TimesheetEventData` (below).", "x-oh-domain": "hr", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:hr.timesheets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "hr.timesheet.submitted" }, "data": { "$ref": "#/components/schemas/TimesheetEventData" } } } ] }, "example": { "id": "evt_0199c3fa-6bca-7e8a-9d65-7e67b30397dd", "type": "hr.timesheet.submitted", "occurred_at": "2026-09-13T16:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ab-f203-7415-9071-9cadbecfd019", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "period_start": "2026-09-07", "period_end": "2026-09-13", "status": "submitted", "total_hours": 41.5, "regular_hours": null, "overtime_hours": null, "submitted_at": "2026-09-13T16:00:00Z", "approved_by": null, "approved_at": null, "created_at": "2026-09-07T06:00:00Z", "updated_at": "2026-09-13T16:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c319-ec87-76d5-b971-65bcd856bab3" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "identity.user.created": { "post": { "operationId": "eventIdentityUserCreated", "summary": "identity.user.created", "description": "A user account was created.\n\n**Not emitted yet.** It is in the catalogue and you can subscribe to it, but OfficeHero does not send it today. Introduced in `2026-05-16`. Subscribing needs `int:identity.users:read`, which **Settings → API keys** does not offer; a key with `int:*` covers it. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `UserEventData` (below).", "x-oh-domain": "identity", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": false, "x-oh-scope": "int:identity.users:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "identity.user.created" }, "data": { "$ref": "#/components/schemas/UserEventData" } } } ] }, "example": { "id": "evt_0199c3cc-bff1-7897-9d7c-437959896f95", "type": "identity.user.created", "occurred_at": "2026-09-07T09:34:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3b3-0919-7918-b142-5dd3f007e6ba", "email": "ana.petrovska@example.com", "first_name": "Ana", "last_name": "Petrovska", "status": "submitted", "created_at": "2026-09-28T17:52:00Z", "deactivated_at": "2026-09-21T10:38:00Z", "deleted_reason": "Synthetic example text.", "membership": { "id": "0199c37c-8e6d-778d-b5b4-0d442ecd5efb", "primary_role": "tenant_admin", "status": "submitted", "joined_at": "2026-09-11T11:44:00Z", "revoked_at": "2026-09-26T12:29:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d4-3a8c-7543-a09d-ab8551aa91d8" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "identity.user.deactivated": { "post": { "operationId": "eventIdentityUserDeactivated", "summary": "identity.user.deactivated", "description": "A user account was deactivated (soft-delete).\n\n**Not emitted yet.** It is in the catalogue and you can subscribe to it, but OfficeHero does not send it today. Introduced in `2026-05-16`. Subscribing needs `int:identity.users:read`, which **Settings → API keys** does not offer; a key with `int:*` covers it. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `UserEventData` (below).", "x-oh-domain": "identity", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": false, "x-oh-scope": "int:identity.users:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "identity.user.deactivated" }, "data": { "$ref": "#/components/schemas/UserEventData" } } } ] }, "example": { "id": "evt_0199c347-53d8-7f8d-a797-96f6e46abfb0", "type": "identity.user.deactivated", "occurred_at": "2026-09-18T15:44:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3f7-dbe6-73ee-a99e-5929bd70d3a9", "email": "ana.petrovska@example.com", "first_name": "Ana", "last_name": "Petrovska", "status": "submitted", "created_at": "2026-09-21T14:09:00Z", "deactivated_at": "2026-09-24T06:14:00Z", "deleted_reason": "Synthetic example text.", "membership": { "id": "0199c3f7-e1ea-7046-9ec0-75d6ff75e9f9", "primary_role": "tenant_admin", "status": "submitted", "joined_at": "2026-09-17T11:28:00Z", "revoked_at": "2026-09-05T11:13:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c35a-8116-7ed3-b310-cea924931c3d" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "identity.user.reactivated": { "post": { "operationId": "eventIdentityUserReactivated", "summary": "identity.user.reactivated", "description": "A previously deactivated user account was reactivated.\n\n**Not emitted yet.** It is in the catalogue and you can subscribe to it, but OfficeHero does not send it today. Introduced in `2026-05-16`. Subscribing needs `int:identity.users:read`, which **Settings → API keys** does not offer; a key with `int:*` covers it. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `UserEventData` (below).", "x-oh-domain": "identity", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": false, "x-oh-scope": "int:identity.users:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "identity.user.reactivated" }, "data": { "$ref": "#/components/schemas/UserEventData" } } } ] }, "example": { "id": "evt_0199c37d-09f1-74d2-9e1d-3b100e21b2d1", "type": "identity.user.reactivated", "occurred_at": "2026-09-16T15:41:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c396-b5ed-7002-b9ae-dcaf5b7b1845", "email": "ana.petrovska@example.com", "first_name": "Ana", "last_name": "Petrovska", "status": "submitted", "created_at": "2026-09-22T15:59:00Z", "deactivated_at": "2026-09-10T06:58:00Z", "deleted_reason": "Synthetic example text.", "membership": { "id": "0199c313-bed9-70ca-9406-d9dc7a0ee345", "primary_role": "tenant_admin", "status": "submitted", "joined_at": "2026-09-09T13:20:00Z", "revoked_at": "2026-09-17T10:29:00Z" } }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d3-4a87-7a37-8516-45d5cf60f575" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "messaging.message.sent": { "post": { "operationId": "eventMessagingMessageSent", "summary": "messaging.message.sent", "description": "A message was sent in a conversation.\n\nIntroduced in `2026-05-16`. Subscribing needs `int:messaging.messages:read`, which **Settings → API keys** does not offer; a key with `int:*` covers it. **Carries personal data (PII).** Delivered only to endpoints OfficeHero has enabled for personal data — contact support.\n\n`data` is a `MessageEventData` (below).", "x-oh-domain": "messaging", "x-oh-introduced": "2026-05-16", "x-oh-pii": true, "x-oh-emitted": true, "x-oh-scope": "int:messaging.messages:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "messaging.message.sent" }, "data": { "$ref": "#/components/schemas/MessageEventData" } } } ] }, "example": { "id": "evt_0199c3c2-e861-7446-a025-5ffaed0978ef", "type": "messaging.message.sent", "occurred_at": "2026-09-17T13:11:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c39d-fead-71c6-b585-6652c46513db", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "conversation_id": "0199c38d-0fcd-7b25-8ad2-6c044bb3b288", "sender_id": "0199c3f2-97ee-713c-9550-5611064caa5e", "body": "Synthetic example text.", "parent_message_id": "0199c373-b8c6-7d6e-9ac0-db634650077e", "sent_at": "2026-09-21T10:07:00Z", "type": "text" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3b6-1c8e-7211-b712-26dc3549b6a9" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "support.ticket.closed": { "post": { "operationId": "eventSupportTicketClosed", "summary": "support.ticket.closed", "description": "A support ticket was closed.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:support.tickets:read` as well as `int:webhooks:manage`.\n\n`data` is a `TicketEventData` (below).", "x-oh-domain": "support", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:support.tickets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "support.ticket.closed" }, "data": { "$ref": "#/components/schemas/TicketEventData" } } } ] }, "example": { "id": "evt_0199c3bd-4955-7edf-8f67-8f6e7fc83b20", "type": "support.ticket.closed", "occurred_at": "2026-09-30T10:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "closed", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": "2026-09-23T10:00:00Z", "closed_at": "2026-09-30T10:00:00Z", "last_activity_at": "2026-09-30T10:00:00Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-30T10:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c3d6-dfa4-7968-a244-07997d88ad04" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "support.ticket.created": { "post": { "operationId": "eventSupportTicketCreated", "summary": "support.ticket.created", "description": "A support ticket was created.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:support.tickets:read` as well as `int:webhooks:manage`.\n\n`data` is a `TicketEventData` (below).", "x-oh-domain": "support", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:support.tickets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "support.ticket.created" }, "data": { "$ref": "#/components/schemas/TicketEventData" } } } ] }, "example": { "id": "evt_0199c366-b018-7b55-9d7e-a4e564687491", "type": "support.ticket.created", "occurred_at": "2026-09-22T09:12:55Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "open", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": null, "first_response_at": null, "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-22T09:12:55Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-22T09:12:55Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c306-48b3-7a3d-b883-3ad9e36a395a" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "support.ticket.reopened": { "post": { "operationId": "eventSupportTicketReopened", "summary": "support.ticket.reopened", "description": "A previously resolved/closed ticket was reopened.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:support.tickets:read` as well as `int:webhooks:manage`.\n\n`data` is a `TicketEventData` (below).", "x-oh-domain": "support", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:support.tickets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "support.ticket.reopened" }, "data": { "$ref": "#/components/schemas/TicketEventData" } } } ] }, "example": { "id": "evt_0199c301-6e48-793d-be2e-c6bc66f62495", "type": "support.ticket.reopened", "occurred_at": "2026-09-24T08:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "open", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-24T08:00:00Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-24T08:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c334-65ae-7afb-b3cd-3b6100cff8d5" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "support.ticket.replied": { "post": { "operationId": "eventSupportTicketReplied", "summary": "support.ticket.replied", "description": "A reply the customer can see was added to a support ticket (internal notes do not send this event).\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:support.tickets:read` as well as `int:webhooks:manage`.\n\n`data` is a `TicketEventData` (below).", "x-oh-domain": "support", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:support.tickets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "support.ticket.replied" }, "data": { "$ref": "#/components/schemas/TicketEventData" } } } ] }, "example": { "id": "evt_0199c340-eb86-7910-9ded-ee9d87c209de", "type": "support.ticket.replied", "occurred_at": "2026-09-22T11:02:17Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "awaiting_staff", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-22T11:02:17Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-22T11:02:17Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c360-5a7c-71de-9c5e-1098595cbb2c" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } }, "support.ticket.resolved": { "post": { "operationId": "eventSupportTicketResolved", "summary": "support.ticket.resolved", "description": "A support ticket was resolved.\n\nIntroduced in `2026-05-16`. Subscribing needs a key with `int:support.tickets:read` as well as `int:webhooks:manage`.\n\n`data` is a `TicketEventData` (below).", "x-oh-domain": "support", "x-oh-introduced": "2026-05-16", "x-oh-pii": false, "x-oh-emitted": true, "x-oh-scope": "int:support.tickets:read", "security": [], "parameters": [ { "$ref": "#/components/parameters/WebhookSignature" }, { "$ref": "#/components/parameters/WebhookSignatureAlgorithm" }, { "$ref": "#/components/parameters/WebhookSignatureLegacy" }, { "$ref": "#/components/parameters/WebhookSignatureDeprecationDate" }, { "$ref": "#/components/parameters/WebhookEventId" }, { "$ref": "#/components/parameters/WebhookEventType" }, { "$ref": "#/components/parameters/WebhookEventAttempt" }, { "$ref": "#/components/parameters/WebhookEndpointIdHeader" }, { "$ref": "#/components/parameters/WebhookVersion" }, { "$ref": "#/components/parameters/WebhookIdempotencyKey" }, { "$ref": "#/components/parameters/WebhookUserAgent" } ], "requestBody": { "required": true, "description": "The event envelope. Verify `X-OH-Signature` against the raw body before parsing it.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/EventEnvelope" }, { "type": "object", "properties": { "type": { "const": "support.ticket.resolved" }, "data": { "$ref": "#/components/schemas/TicketEventData" } } } ] }, "example": { "id": "evt_0199c3fa-2751-71bc-a74b-07cb1a60b25e", "type": "support.ticket.resolved", "occurred_at": "2026-09-23T10:00:00Z", "tenant": { "id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "slug": "northwind-transport" }, "schema_version": "2026-05-16", "data": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "resolved", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": "2026-09-23T10:00:00Z", "closed_at": null, "last_activity_at": "2026-09-23T10:00:00Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-23T10:00:00Z" }, "metadata": { "request_id": null, "actor": { "type": "user", "id": "0199c33f-1693-72ba-a11c-f22d1d153c81" } } } } } }, "responses": { "2XX": { "description": "Received. Answer within 15 seconds and do the work afterwards; the body is ignored." }, "410": { "description": "Gone: this delivery is not retried. Three `410`s disable the endpoint." }, "default": { "description": "Any other status, a redirect or a timeout is retried after 1 m, 5 m, 15 m, 1 h, 3 h, 6 h and 12 h (±20 %) — 8 attempts in all — and then marked `dead`. A `429` is retried after its `Retry-After` (up to an hour) without using up an attempt." } } } } }, "components": { "securitySchemes": { "bearerApiKey": { "type": "http", "scheme": "bearer", "bearerFormat": "oh_live__", "description": "An API key created in the Fleet, HR or Finance app under **Settings → API keys**\n(requires the `identity.api_keys.admin` permission — tenant owners and admins).\nThe full key is shown once, when it is created: `oh_live_` + a 12-character\nprefix + `_` + a 43-character secret. Send it on every request:\n\n```\nAuthorization: Bearer oh_live_AbCdEf123456_…\n```\n\nThe key decides the tenant and the scopes. A missing, malformed, unknown,\nexpired or revoked key always gets the same `401`.\n" } }, "parameters": { "Cursor": { "name": "cursor", "in": "query", "required": false, "description": "The `next_cursor` from the previous page. Treat it as opaque. Omit it for\nthe first page. An unreadable cursor is a `422`.\n", "schema": { "type": "string" } }, "DeliveryId": { "name": "delivery_id", "in": "path", "required": true, "description": "The delivery id (a UUID) from the deliveries list.", "schema": { "type": "string", "format": "uuid" } }, "EndpointId": { "name": "id", "in": "path", "required": true, "description": "The webhook endpoint id (a UUID).", "schema": { "type": "string", "format": "uuid" } }, "Id": { "name": "id", "in": "path", "required": true, "description": "The resource id (a UUID). A malformed id is a `422`.", "schema": { "type": "string", "format": "uuid" } }, "IdempotencyKey": { "name": "Idempotency-Key", "in": "header", "required": false, "description": "A unique value you generate (a UUID is ideal) so a retried write runs at\nmost once. For 24 hours, a request with the same key, method and path from\nthe same API key gets the stored response back, with `Idempotency-Replayed: true`,\ninstead of running again. Responses with a status from 200 to 499 are stored,\nexcept a `422` for a reference to a record that does not exist\n(`invalid_reference`) or a value that is not an id (`invalid_input`); a 5xx is\nnot stored either. Those run again when you retry with the same key. The same\nkey with a different body is a `409`. Without the header a write simply runs.\n", "schema": { "type": "string", "minLength": 1, "maxLength": 255 } }, "Limit": { "name": "limit", "in": "query", "required": false, "description": "Page size. Values below 1 count as 1 and values above 100 as 100.", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 50 } }, "OhVersion": { "name": "OH-Version", "in": "header", "required": false, "description": "The API version to use, as a date. Optional: without it you get the oldest\nversion that is not deprecated. The only version today is `2026-05-16`.\nA malformed or unknown value is a `400`; a version past its sunset date is\na `410`.\n", "schema": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$", "enum": [ "2026-05-16" ], "default": "2026-05-16" }, "example": "2026-05-16" }, "WebhookEndpointIdHeader": { "name": "OH-Endpoint-Id", "in": "header", "required": true, "description": "Your endpoint, `whe_` + its id.", "schema": { "type": "string" }, "example": "whe_0199c3ae-697a-7b8c-87e8-031425364726" }, "WebhookEventAttempt": { "name": "OH-Event-Attempt", "in": "header", "required": true, "description": "Which attempt this is, starting at 1.", "schema": { "type": "string" }, "example": "1" }, "WebhookEventId": { "name": "OH-Event-Id", "in": "header", "required": true, "description": "The event id, `evt_` + UUID — the same as the envelope `id`. Deduplicate on it.", "schema": { "type": "string" }, "example": "evt_0199c3a4-adbe-7fc0-8b2c-475869708b30" }, "WebhookEventType": { "name": "OH-Event-Type", "in": "header", "required": true, "description": "The event type, as in the envelope.", "schema": { "type": "string" }, "example": "fin.invoice.paid" }, "WebhookIdempotencyKey": { "name": "Idempotency-Key", "in": "header", "required": true, "description": "Same value as `OH-Event-Id`, for receivers that already deduplicate on this header.", "schema": { "type": "string" }, "example": "evt_0199c3a4-adbe-7fc0-8b2c-475869708b30" }, "WebhookSignature": { "name": "X-OH-Signature", "in": "header", "required": true, "description": "`t=,v1=` of `.`, keyed with your endpoint secret (`whsec_…`). Reject a delivery whose `t` is more than 300 seconds from your clock. [Verifying signatures](https://developers.officehero.io/docs/webhooks/signatures).", "schema": { "type": "string" }, "example": "t=1760083200,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd" }, "WebhookSignatureAlgorithm": { "name": "X-OH-Signature-Algorithm", "in": "header", "required": true, "description": "Always `HMAC-SHA256-RAW` — the algorithm of `X-OH-Signature`.", "schema": { "type": "string", "enum": [ "HMAC-SHA256-RAW" ] } }, "WebhookSignatureDeprecationDate": { "name": "X-OH-Signature-Deprecation-Date", "in": "header", "required": true, "description": "When `X-OH-Signature-Legacy` stops being sent.", "schema": { "type": "string", "format": "date" }, "example": "2026-12-17" }, "WebhookSignatureLegacy": { "name": "X-OH-Signature-Legacy", "in": "header", "required": false, "description": "The pre-2026 signature (keyed with the SHA-256 of the secret). Sent until the date in `X-OH-Signature-Deprecation-Date`. New receivers ignore it.", "schema": { "type": "string" } }, "WebhookUserAgent": { "name": "User-Agent", "in": "header", "required": true, "description": "Always `OfficeHero-Webhooks/1.0`.", "schema": { "type": "string", "enum": [ "OfficeHero-Webhooks/1.0" ] } }, "WebhookVersion": { "name": "OH-Version", "in": "header", "required": true, "description": "The endpoint's `pinned_version`.", "schema": { "type": "string" }, "example": "2026-05-16" } }, "headers": { "IdempotencyReplayed": { "description": "`true` when this is the stored response of an earlier request with the same `Idempotency-Key`.", "schema": { "type": "string", "enum": [ "true" ] } }, "Location": { "description": "The URL of the resource that was created.", "schema": { "type": "string" } }, "RetryAfter": { "description": "Seconds to wait before retrying.", "schema": { "type": "integer" }, "example": 60 }, "XRateLimitBucket": { "description": "The replay limit that was hit: `integrations-replay-minute` (single replays,\n60 a minute), `integrations-replay-failed-minute` (5 a minute) or\n`integrations-replay-failed-hour` (30 an hour). Sent instead of\n`X-RateLimit-Subject` by these limits.\n", "schema": { "type": "string", "enum": [ "integrations-replay-minute", "integrations-replay-failed-minute", "integrations-replay-failed-hour" ] }, "example": "integrations-replay-failed-minute" }, "XRateLimitLimit": { "description": "The request budget (requests per minute) that was exceeded.", "schema": { "type": "integer" }, "example": 3000 }, "XRateLimitSubject": { "description": "What the budget applies to — `user:apikey:` for the per-key limit, or `ip:
` for the per-IP limit.", "schema": { "type": "string" }, "example": "user:apikey:0199c38d-7a8b-7c9d-98f9-142536475827" }, "XTraceId": { "description": "Trace id for this request, on every response — errors included. Quote it\nwhen you contact support.\n", "schema": { "type": "string", "pattern": "^[0-9a-f]{32}$" }, "example": "4bf92f3577b34da6a3ce929d0e0e4736" } }, "responses": { "Forbidden": { "description": "The API key is valid but lacks the scope this operation needs (`missing_scope`\nnames it), or the Integrations API is switched off for the key's company\n(`type` …/errors/feature_disabled, `flag_code: integrations.api.enabled`).\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "examples": { "missing_scope": { "summary": "The key lacks a scope", "value": { "type": "https://officehero.io/errors/forbidden", "title": "Forbidden", "status": 403, "detail": "The API key does not have the scope required for this endpoint.", "detail_key": "errors.integrations.missing_scope", "missing_scope": "int:fin.invoices:read" } }, "feature_disabled": { "summary": "The API is switched off for this company", "value": { "type": "https://officehero.io/errors/feature_disabled", "title": "Feature disabled", "status": 403, "detail": "This feature is not enabled for your organization.", "detail_key": "errors.platform.feature_flag.disabled", "flag_code": "integrations.api.enabled" } } } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "IdempotencyConflict": { "description": "The `Idempotency-Key` was already used with a different request body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/idempotency-conflict", "title": "Idempotency-Key reused with a different request body", "status": 409, "detail": "errors.idempotency.body_mismatch" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "InvalidCursor": { "description": "The `cursor` cannot be read. Start again without it.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "The pagination cursor is invalid or malformed.", "detail_key": "errors.integrations.invoices.invalid_cursor" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "InvalidId": { "description": "An id in the path is not a UUID. Nothing was read or changed. (Some operations\nlist further `422` causes; this one applies to every operation with an id.)\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 422, "detail": "That request wasn't valid — check the values you sent and try again.", "detail_key": "errors.common.validation.invalid_input" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "NotFound": { "description": "No resource with this id exists in your tenant. The same status, with\n`detail_key: errors.common.tenant_not_found`, means the API key's company is\nno longer active.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Invoice not found.", "detail_key": "errors.integrations.invoices.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "RateLimited": { "description": "Too many requests. Wait `Retry-After` seconds. Limits are per API key and,\nseparately, per client IP (Rate limits, in the guides).\n", "headers": { "Retry-After": { "$ref": "#/components/headers/RetryAfter" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/XRateLimitLimit" }, "X-RateLimit-Subject": { "$ref": "#/components/headers/XRateLimitSubject" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/rate-limited", "title": "Too many requests", "status": 429, "detail": "Too many requests — try again in 60 seconds", "retry_after_s": 60, "code": "rate_limited" } } } }, "ReplayRateLimited": { "description": "A replay limit for this API key was hit (`X-RateLimit-Bucket` names it, and\n`X-RateLimit-Limit` gives its size). `Retry-After` counts down to the end of\nthat limit's window, so it is anything up to 60 seconds (3,600 for the hourly\n`replay_failed` limit). The per-key and per-IP limits of every operation apply\ntoo; they answer with `X-RateLimit-Subject` instead of `X-RateLimit-Bucket` and\n`Retry-After: 60` (Rate limits, in the guides).\n", "headers": { "Retry-After": { "$ref": "#/components/headers/RetryAfter" }, "X-RateLimit-Limit": { "$ref": "#/components/headers/XRateLimitLimit" }, "X-RateLimit-Bucket": { "$ref": "#/components/headers/XRateLimitBucket" }, "x-trace-id": { "$ref": "#/components/headers/XTraceId" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/rate-limited", "title": "Too many requests", "status": 429, "detail": "Too many requests — try again in 52 seconds", "retry_after_s": 52, "code": "rate_limited" } } } }, "TenantNotFound": { "description": "The API key's company is no longer active (`errors.common.tenant_not_found`).\nEvery operation answers this way for such a key; a new key will not help.\nContact support.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Tenant not found", "detail_key": "errors.common.tenant_not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "Unauthorized": { "description": "No API key, or a key that is malformed, unknown, expired or revoked. The\nresponse is identical in every case, so it cannot be used to probe keys.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/unauthorized", "title": "Unauthorized", "status": 401, "detail": "Authentication required. Provide a valid API key.", "detail_key": "errors.integrations.unauthorized" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "UnsupportedVersion": { "description": "The `OH-Version` header is malformed or names a version that does not exist.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/validation", "title": "Invalid request", "status": 400, "detail": "The requested OH-Version is not supported.", "detail_key": "errors.integrations.unsupported_version" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "VersionSunset": { "description": "The requested `OH-Version` has passed its sunset date.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/gone", "title": "API version sunset", "status": 410, "detail": "The requested OH-Version has been sunset. Migrate to a supported version.", "detail_key": "errors.integrations.version_sunset" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } }, "WebhookEndpointNotFound": { "description": "No webhook endpoint with this id in your tenant, or it belongs to another API\nkey (an endpoint is managed by the key that created it). The two answers are\nidentical on purpose. The same status, with\n`detail_key: errors.common.tenant_not_found`, means the API key's company is\nno longer active.\n", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" }, "example": { "type": "https://officehero.io/errors/not-found", "title": "Not found", "status": 404, "detail": "Webhook endpoint not found.", "detail_key": "errors.integrations.webhooks.not_found", "code": "not_found" } } }, "headers": { "x-trace-id": { "$ref": "#/components/headers/XTraceId" } } } }, "schemas": { "AiActBiasEvaluatedEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.bias.evaluated`.", "properties": { "system_code": { "type": "string" }, "system_id": { "type": "string", "description": "Id of the system." }, "assessment_id": { "type": "string", "description": "Id of the assessment." }, "protected_attribute": { "type": "string" }, "metric_name": { "type": "string", "description": "A name, for display." }, "metric_value": { "type": "number" }, "threshold": { "type": "number" }, "breach": { "type": "boolean" }, "period_from": { "type": "string", "format": "date", "description": "Period from, `YYYY-MM-DD`." }, "period_to": { "type": "string", "format": "date", "description": "Period to, `YYYY-MM-DD`." }, "evaluated_at": { "type": "string", "format": "date-time", "description": "When evaluated — RFC 3339, UTC." } }, "required": [ "system_code", "system_id", "assessment_id", "protected_attribute", "metric_name", "metric_value", "threshold", "breach", "period_from", "period_to", "evaluated_at" ] }, "AiActDecisionChainIntegrityEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.decision_chain.integrity_violation`. **Its keys are camelCase**, an exception to the snake_case convention of every other payload; they are sent exactly as shown.", "properties": { "chainsChecked": { "type": "integer", "description": "A count." }, "rowsChecked": { "type": "integer", "description": "A count." }, "gapsCount": { "type": "integer", "description": "A count." }, "gapReasons": { "type": "array", "items": { "type": "string" } }, "detectedAt": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." } }, "required": [ "chainsChecked", "rowsChecked", "gapsCount", "gapReasons", "detectedAt" ] }, "AiActDecisionEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.decision.overridden`, `compliance.ai_act.decision.recorded`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "system_id": { "type": "string", "description": "Id of the system." }, "decision_kind": { "type": "string" }, "outcome": { "type": "string" }, "human_oversight_exercised": { "type": "boolean" }, "overridden_by": { "type": [ "string", "null" ], "description": "Id of the user who overridden it." }, "overridden_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When overridden — RFC 3339, UTC." }, "recorded_at": { "type": "string", "format": "date-time", "description": "When recorded — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." } }, "required": [ "id", "system_id", "decision_kind", "outcome", "human_oversight_exercised", "overridden_by", "overridden_at", "recorded_at", "created_at" ] }, "AiActDossierArtifactRegeneratedEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.dossier.artifact_regenerated`.", "properties": { "assessment_id": { "type": "string", "description": "Id of the assessment." }, "regenerated_by_user_id": { "type": "string", "description": "Id of the regenerated by user." }, "regenerated_at": { "type": "string", "format": "date-time", "description": "When regenerated — RFC 3339, UTC." }, "artifact_kinds": { "type": "array", "items": { "type": "string" } } }, "required": [ "assessment_id", "regenerated_by_user_id", "regenerated_at", "artifact_kinds" ] }, "AiActDossierEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.dossier.completed`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "system_name": { "type": "string", "description": "A name, for display." }, "risk_tier": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "dossier_status": { "type": "string" }, "last_reviewed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When last reviewed — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "system_name", "risk_tier", "dossier_status", "last_reviewed_at", "created_at", "updated_at" ] }, "AiActDriftEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.drift_detected`.", "properties": { "incident_id": { "type": "string", "description": "Id of the incident." }, "system_id": { "type": "string", "description": "Id of the system." }, "current_period_from": { "type": "string", "format": "date", "description": "Current period from, `YYYY-MM-DD`." }, "current_period_to": { "type": "string", "format": "date", "description": "Current period to, `YYYY-MM-DD`." }, "baseline_period_from": { "type": "string", "format": "date", "description": "Baseline period from, `YYYY-MM-DD`." }, "baseline_period_to": { "type": "string", "format": "date", "description": "Baseline period to, `YYYY-MM-DD`." }, "current_decisions": { "type": "integer" }, "baseline_decisions": { "type": "integer" }, "current_avg_total_tokens": { "type": [ "number", "null" ] }, "baseline_avg_total_tokens": { "type": [ "number", "null" ] }, "current_p95_total_tokens": { "type": "integer" }, "baseline_p95_total_tokens": { "type": "integer" }, "anomaly_reasons": { "type": "array", "items": { "type": "string" } }, "detected_at": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." } }, "required": [ "incident_id", "system_id", "current_period_from", "current_period_to", "baseline_period_from", "baseline_period_to", "current_decisions", "baseline_decisions", "current_avg_total_tokens", "baseline_avg_total_tokens", "current_p95_total_tokens", "baseline_p95_total_tokens", "anomaly_reasons", "detected_at" ] }, "AiActIncidentEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.incident.created`, `compliance.ai_act.incident.resolved`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "system_id": { "type": "string", "description": "Id of the system." }, "severity": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "category": { "type": "string", "description": "The category the record was filed under in OfficeHero." }, "status": { "type": "string", "description": "The record's status after the change." }, "detected_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When detected — RFC 3339, UTC." }, "resolved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When resolved — RFC 3339, UTC." }, "notified_body_reported_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When notified body reported — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "system_id", "severity", "category", "status", "detected_at", "resolved_at", "notified_body_reported_at", "created_at", "updated_at" ] }, "AiActOversightBacklogEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.oversight_backlog_escalated`.", "properties": { "system_id": { "type": "string", "description": "Id of the system." }, "system_name": { "type": "string", "description": "A name, for display." }, "overdue_count": { "type": "integer", "description": "A count." }, "threshold_count": { "type": "integer", "description": "A count." }, "sla_days": { "type": "integer", "description": "A number of days." }, "escalated_at": { "type": "string", "format": "date-time", "description": "When escalated — RFC 3339, UTC." } }, "required": [ "system_id", "system_name", "overdue_count", "threshold_count", "sla_days", "escalated_at" ] }, "AiActSystemRegisteredEventData": { "type": "object", "description": "The `data` of `compliance.ai_act.system.registered`.", "properties": { "system_code": { "type": "string" }, "system_display_name": { "type": "string", "description": "A name, for display." }, "risk_class": { "type": "string" }, "domain": { "type": "string" }, "annex_iii_area": { "type": [ "string", "null" ] }, "eu_registration_status": { "type": "string" }, "eu_registration_id": { "type": [ "string", "null" ], "description": "Id of the eu registration." }, "endpoint": { "type": "string", "description": "An absolute URL.", "format": "uri" }, "submitted_at": { "type": "string", "format": "date-time", "description": "When submitted — RFC 3339, UTC." } }, "required": [ "system_code", "system_display_name", "risk_class", "domain", "annex_iii_area", "eu_registration_status", "eu_registration_id", "endpoint", "submitted_at" ] }, "Bill": { "type": "object", "description": "A purchase invoice (bill) from a supplier.", "required": [ "id", "tenant_id", "number", "supplier_id", "status", "currency", "subtotal_minor", "tax_minor", "total_minor", "paid_minor", "balance_minor", "issue_date", "due_date", "approved_at", "paid_at", "created_at", "updated_at" ], "properties": { "id": { "description": "Bill id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "number": { "description": "The supplier's invoice number as recorded.", "type": [ "string", "null" ] }, "supplier_id": { "description": "The supplier (a Finance trading partner).", "type": "string", "format": "uuid" }, "status": { "description": "`draft`, `posted` (booked), `partial` (part-paid), `paid` or `void`.", "type": "string", "enum": [ "draft", "posted", "partial", "paid", "void" ] }, "currency": { "description": "ISO 4217 currency code.", "type": "string", "pattern": "^[A-Z]{3}$" }, "subtotal_minor": { "description": "Amount before tax, in minor units.", "type": "integer" }, "tax_minor": { "description": "Tax, in minor units.", "type": "integer" }, "total_minor": { "description": "`subtotal_minor` + `tax_minor`.", "type": "integer" }, "paid_minor": { "description": "Amount paid so far.", "type": "integer" }, "balance_minor": { "description": "Amount still owed.", "type": "integer" }, "issue_date": { "description": "The supplier's invoice date.", "type": [ "string", "null" ], "format": "date" }, "due_date": { "description": "Payment due date.", "type": [ "string", "null" ], "format": "date" }, "approved_at": { "description": "When the bill was posted to the ledger.", "type": [ "string", "null" ], "format": "date-time" }, "paid_at": { "description": "When the bill was last updated while `paid` — effectively when it was settled. `null` until then.", "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "description": "When the bill was recorded.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the bill last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a6-1a2b-7c3d-9e4f-5a6b7c8d9e04", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "BALK-77120", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "posted", "currency": "EUR", "subtotal_minor": 86000, "tax_minor": 15480, "total_minor": 101480, "paid_minor": 0, "balance_minor": 101480, "issue_date": "2026-09-10", "due_date": "2026-10-10", "approved_at": "2026-09-11T07:45:12Z", "paid_at": null, "created_at": "2026-09-10T15:20:00Z", "updated_at": "2026-09-11T07:45:12Z" } }, "BillEventData": { "type": "object", "description": "The `data` of `fin.bill.approved`, `fin.bill.created`, `fin.bill.paid`, `fin.bill.updated`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "supplier_id": { "type": "string", "description": "Id of the supplier.", "format": "uuid" }, "status": { "type": "string", "description": "The record's status after the change." }, "currency": { "type": "string", "description": "ISO 4217 currency code." }, "subtotal_minor": { "type": "integer", "description": "Subtotal in minor units of `currency` (cents for EUR)." }, "tax_minor": { "type": "integer", "description": "Tax in minor units of `currency` (cents for EUR)." }, "total_minor": { "type": "integer", "description": "Total in minor units of `currency` (cents for EUR)." }, "paid_minor": { "type": "integer", "description": "Paid in minor units of `currency` (cents for EUR)." }, "balance_minor": { "type": "integer", "description": "Balance in minor units of `currency` (cents for EUR)." }, "issue_date": { "type": [ "string", "null" ], "format": "date", "description": "Issue date, `YYYY-MM-DD`." }, "due_date": { "type": [ "string", "null" ], "format": "date", "description": "Due date, `YYYY-MM-DD`." }, "approved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When approved — RFC 3339, UTC." }, "paid_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When paid — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "number", "supplier_id", "status", "currency", "subtotal_minor", "tax_minor", "total_minor", "paid_minor", "balance_minor", "issue_date", "due_date", "approved_at", "paid_at", "created_at", "updated_at" ] }, "BillPage": { "type": "object", "description": "One page of bills, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Bill" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "DashcamSafetyEventEventData": { "type": "object", "description": "The `data` of `fm.dashcam.safety_event.detected`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "device_id": { "type": "string", "description": "Id of the device." }, "trip_id": { "type": [ "string", "null" ], "description": "Id of the trip." }, "driver_id": { "type": [ "string", "null" ], "description": "Id of the driver." }, "provider": { "type": "string" }, "provider_event_id": { "type": "string", "description": "Id of the provider event." }, "event_kind": { "type": "string" }, "severity": { "type": "integer", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "occurred_at": { "type": "string", "format": "date-time", "description": "When occurred — RFC 3339, UTC." }, "location_lat": { "type": [ "number", "null" ], "description": "Latitude in decimal degrees (WGS 84)." }, "location_lon": { "type": [ "number", "null" ], "description": "Longitude in decimal degrees (WGS 84)." }, "review_state": { "type": "string" }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." } }, "required": [ "id", "tenant_id", "device_id", "trip_id", "driver_id", "provider", "provider_event_id", "event_kind", "severity", "occurred_at", "location_lat", "location_lon", "review_state", "created_at" ] }, "DatevExportCompletedEventData": { "type": "object", "description": "The `data` of `fin.datev.export.completed`. **Its keys are camelCase**, an exception to the snake_case convention of every other payload; they are sent exactly as shown.", "properties": { "exportRunId": { "type": "string", "description": "Id of the export run." }, "periodFrom": { "type": "string" }, "periodTo": { "type": "string" }, "variant": { "type": "string" }, "fileId": { "type": "string", "description": "Id of the file." }, "rowCount": { "type": "integer", "description": "A count." }, "periodLockId": { "type": "string", "description": "Id of the period lock." } }, "required": [ "exportRunId", "periodFrom", "periodTo", "variant", "fileId", "rowCount", "periodLockId" ] }, "Document": { "type": "object", "description": "A file in Documents — its metadata, not its contents. The list includes\nfiles in every state, including `deleted`, `quarantined` and `infected`;\ncheck `status` before you act on one.", "required": [ "id", "tenant_id", "name", "mime_type", "size_bytes", "status", "folder_id", "uploaded_by", "uploaded_at", "shared_with", "shared_expires_at", "deleted_at", "created_at", "updated_at" ], "properties": { "id": { "description": "Document id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "name": { "description": "File name.", "type": "string" }, "mime_type": { "description": "Media type, e.g. `application/pdf`.", "type": [ "string", "null" ] }, "size_bytes": { "description": "Size in bytes.", "type": "integer" }, "status": { "description": "Upload and malware-scan state: `pending` and `uploading` (not stored yet),\n`scanning`, `clean` or `ready` (safe to use), `infected` or `quarantined`\n(blocked), `deleted`.", "type": "string", "enum": [ "pending", "uploading", "scanning", "clean", "ready", "infected", "quarantined", "deleted" ] }, "folder_id": { "description": "The folder it is in.", "type": [ "string", "null" ], "format": "uuid" }, "uploaded_by": { "description": "The user who uploaded it.", "type": [ "string", "null" ], "format": "uuid" }, "uploaded_at": { "description": "When it was uploaded.", "type": [ "string", "null" ], "format": "date-time" }, "shared_with": { "description": "Always `[]` in this version — who a document is shared with is personal data\nand is not exposed here. The `files.document.shared` webhook carries the\nrecipients of each new share, to endpoints enabled for personal data.", "type": "array", "items": { "type": "string" } }, "shared_expires_at": { "description": "When sharing ends. `null` when it is not shared, or when any active share never expires.", "type": [ "string", "null" ], "format": "date-time" }, "deleted_at": { "description": "When it was deleted, if it was.", "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "description": "When the record was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the record last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3ad-4758-796a-85c6-e1f203142524", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "name": "SK-4821-AB-insurance-2026.pdf", "mime_type": "application/pdf", "size_bytes": 248311, "status": "ready", "folder_id": "0199c38c-5869-7a7b-96d7-f20314253625", "uploaded_by": "0199c38a-2536-7748-83a4-cfd0e1f20322", "uploaded_at": "2026-01-15T10:20:00Z", "shared_with": [], "shared_expires_at": "2026-12-31T23:59:59Z", "deleted_at": null, "created_at": "2026-01-15T10:20:00Z", "updated_at": "2026-03-02T08:00:00Z" } }, "DocumentEventData": { "type": "object", "description": "The `data` of `files.document.deleted`, `files.document.uploaded`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "name": { "type": "string", "description": "A name, for display." }, "mime_type": { "type": [ "string", "null" ], "description": "The media type of the file, e.g. `application/pdf`." }, "size_bytes": { "type": "integer", "description": "A size in bytes." }, "status": { "type": "string", "description": "The record's status after the change." }, "folder_id": { "type": [ "string", "null" ], "description": "Id of the folder." }, "uploaded_by": { "type": [ "string", "null" ], "description": "Id of the user who uploaded it." }, "uploaded_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When uploaded — RFC 3339, UTC." }, "shared_with": { "type": "array", "items": { "type": "string" } }, "shared_expires_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When shared expires — RFC 3339, UTC." }, "deleted_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When deleted — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "name", "mime_type", "size_bytes", "status", "folder_id", "uploaded_by", "uploaded_at", "shared_with", "shared_expires_at", "deleted_at", "created_at", "updated_at" ] }, "DocumentPage": { "type": "object", "description": "One page of documents, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Document" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "DocumentShareEventData": { "type": "object", "description": "The `data` of `files.document.shared`.", "properties": { "share_id": { "type": "string", "description": "Id of the share." }, "document_id": { "type": "string", "description": "Id of the document.", "format": "uuid" }, "shared_by": { "type": "string", "description": "Id of the user who shared it." }, "recipients": { "type": "array", "items": { "type": "string" } }, "scopes": { "type": "array", "items": { "type": "string" } }, "expires_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When expires — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "document": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "mime_type": { "type": [ "string", "null" ] } }, "required": [ "id", "name", "mime_type" ] } }, "required": [ "share_id", "document_id", "shared_by", "recipients", "scopes", "expires_at", "created_at", "document" ] }, "ESignCallbackEventData": { "type": "object", "description": "The `data` of `files.esign.completed`, `files.esign.declined`.", "properties": { "provider": { "type": "string" }, "provider_ref": { "type": "string" }, "state": { "type": "string", "description": "The record's status after the change." }, "completed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When completed — RFC 3339, UTC." }, "origin_domain": { "type": "string" }, "origin_row_id": { "type": "string", "description": "Id of the origin row." }, "occurred_at": { "type": "string", "format": "date-time", "description": "When occurred — RFC 3339, UTC." } }, "required": [ "provider", "provider_ref", "state", "completed_at", "origin_domain", "origin_row_id", "occurred_at" ] }, "EinvoicingDocumentEventData": { "type": "object", "description": "The `data` of `fin.einvoicing.document.accepted`, `fin.einvoicing.document.issued`, `fin.einvoicing.document.rejected`, `fin.einvoicing.document.transmitted`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "invoice_id": { "type": "string", "description": "Id of the invoice.", "format": "uuid" }, "route": { "type": "string" }, "direction": { "type": "string" }, "status": { "type": "string", "description": "The record's status after the change." }, "partner_document_id": { "type": [ "string", "null" ], "description": "Id of the partner document." }, "issued_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When issued — RFC 3339, UTC." }, "transmitted_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When transmitted — RFC 3339, UTC." }, "acknowledged_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When acknowledged — RFC 3339, UTC." }, "rejected_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When rejected — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "invoice_id", "route", "direction", "status", "partner_document_id", "issued_at", "transmitted_at", "acknowledged_at", "rejected_at", "created_at", "updated_at" ] }, "EinvoicingMandateEventData": { "type": "object", "description": "The `data` of `compliance.fr_einvoicing.mandate.reactivated`, `compliance.fr_einvoicing.mandate.signed`, `fin.einvoicing.mandate.activated`, `fin.einvoicing.mandate.created`, `fin.einvoicing.mandate.revoked`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_customer_id": { "type": "string", "description": "Id of the tenant customer." }, "siren": { "type": "string" }, "jurisdiction": { "type": "string" }, "status": { "type": "string", "description": "The record's status after the change." }, "signed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When signed — RFC 3339, UTC." }, "activated_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When activated — RFC 3339, UTC." }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When revoked — RFC 3339, UTC." }, "provider_envelope_id": { "type": [ "string", "null" ], "description": "Id of the provider envelope." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "tenant_customer_id", "siren", "jurisdiction", "status", "signed_at", "activated_at", "revoked_at", "provider_envelope_id", "created_at", "updated_at" ] }, "Employee": { "type": "object", "description": "An employment record. Personal data (name, email, department, job title)\nis NOT exposed by the Integrations API in this version: those fields are\nalways `null`.", "required": [ "id", "tenant_id", "user_id", "employee_number", "email", "first_name", "last_name", "department", "job_title", "employment_status", "hire_date", "termination_date", "manager_id", "created_at", "updated_at" ], "properties": { "id": { "description": "Employee id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "user_id": { "description": "The OfficeHero user linked to this employee, if any.", "type": [ "string", "null" ], "format": "uuid" }, "employee_number": { "description": "Your employee number.", "type": [ "string", "null" ] }, "email": { "description": "Always `null` in this version (personal data is not exposed).", "type": [ "string", "null" ], "format": "email" }, "first_name": { "description": "Always `null` in this version (personal data is not exposed).", "type": [ "string", "null" ] }, "last_name": { "description": "Always `null` in this version (personal data is not exposed).", "type": [ "string", "null" ] }, "department": { "description": "Always `null` in this version.", "type": [ "string", "null" ] }, "job_title": { "description": "Always `null` in this version.", "type": [ "string", "null" ] }, "employment_status": { "description": "`active`, `on_leave`, `terminated` or `retired`.", "type": "string", "enum": [ "active", "on_leave", "terminated", "retired" ] }, "hire_date": { "description": "First day of employment.", "type": [ "string", "null" ], "format": "date" }, "termination_date": { "description": "Last day of employment, if it has ended.", "type": [ "string", "null" ], "format": "date" }, "manager_id": { "description": "The employee's manager (another employee id).", "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "description": "When the record was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the record last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "user_id": "0199c386-becf-70d1-9c3d-5e6f7a8b9c15", "employee_number": "E-0042", "email": null, "first_name": null, "last_name": null, "department": null, "job_title": null, "employment_status": "active", "hire_date": "2023-04-03", "termination_date": null, "manager_id": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "created_at": "2023-03-27T08:15:00Z", "updated_at": "2026-08-30T12:00:00Z" } }, "EmployeeEventData": { "type": "object", "description": "The `data` of `hr.employee.created`, `hr.employee.terminated`, `hr.employee.updated`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "user_id": { "type": [ "string", "null" ], "description": "Id of the user.", "format": "uuid" }, "employee_number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "email": { "type": [ "string", "null" ], "description": "An e-mail address.", "format": "email" }, "first_name": { "type": [ "string", "null" ], "description": "A name, for display." }, "last_name": { "type": [ "string", "null" ], "description": "A name, for display." }, "department": { "type": [ "string", "null" ] }, "job_title": { "type": [ "string", "null" ] }, "employment_status": { "type": "string" }, "hire_date": { "type": [ "string", "null" ], "format": "date", "description": "Hire date, `YYYY-MM-DD`." }, "termination_date": { "type": [ "string", "null" ], "format": "date", "description": "Termination date, `YYYY-MM-DD`." }, "manager_id": { "type": [ "string", "null" ], "description": "Id of the manager." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "user_id", "employee_number", "email", "first_name", "last_name", "department", "job_title", "employment_status", "hire_date", "termination_date", "manager_id", "created_at", "updated_at" ] }, "EmployeePage": { "type": "object", "description": "One page of employees, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Employee" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "EventEnvelope": { "type": "object", "description": "The JSON body of every webhook delivery. `data` depends on `type` — see each\nevent. Deduplicate on `id`: a delivery can arrive more than once.\n", "required": [ "id", "type", "occurred_at", "tenant", "schema_version", "data", "metadata" ], "properties": { "id": { "type": "string", "pattern": "^evt_", "description": "The event id, `evt_` + a UUID. Same value as the `OH-Event-Id` header." }, "type": { "type": "string", "description": "The event type, e.g. `fin.invoice.paid`." }, "occurred_at": { "type": "string", "format": "date-time" }, "tenant": { "type": "object", "description": "The company the event belongs to. Join on `id`; show `slug`. These are the\nonly tenant fields: OfficeHero's internal identifiers are never sent.\n", "required": [ "id", "slug" ], "properties": { "id": { "type": "string", "format": "uuid" }, "slug": { "type": "string" } } }, "schema_version": { "type": "string", "format": "date", "description": "The payload version (`2026-05-16`)." }, "data": { "type": "object", "description": "The event's payload." }, "metadata": { "type": "object", "required": [ "request_id", "actor" ], "properties": { "request_id": { "type": [ "string", "null" ], "description": "For a write made through the Integrations API, the `x-trace-id` that\nrequest was answered with. Usually `null` otherwise.\n" }, "actor": { "type": "object", "required": [ "type", "id" ], "properties": { "type": { "type": [ "string", "null" ], "description": "Who caused the event: `api_key` for a write made through the\nIntegrations API (recognise your own writes by it), `user` for a\nchange made in the apps, `system` for an automatic one." }, "id": { "type": [ "string", "null" ], "description": "The API key's or the user's id; `null` for `system`." } } } } } } }, "FrEinvoicingEreportingSubmittedEventData": { "type": "object", "description": "The `data` of `compliance.fr_einvoicing.ereporting.submitted`.", "properties": { "submission_id": { "type": "string", "description": "Id of the submission." }, "report_type": { "type": "string" }, "period_from": { "type": "string", "format": "date", "description": "Period from, `YYYY-MM-DD`." }, "period_to": { "type": "string", "format": "date", "description": "Period to, `YYYY-MM-DD`." }, "total_transactions": { "type": "integer" }, "total_amount_minor": { "type": "integer", "description": "Total amount in minor units of `currency` (cents for EUR)." }, "currency": { "type": "string", "description": "ISO 4217 currency code." }, "state": { "type": "string", "description": "The record's status after the change." }, "ppf_reference": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "rejection_reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "submitted_at": { "type": "string", "format": "date-time", "description": "When submitted — RFC 3339, UTC." } }, "required": [ "submission_id", "report_type", "period_from", "period_to", "total_transactions", "total_amount_minor", "currency", "state", "ppf_reference", "rejection_reason", "submitted_at" ] }, "FrEinvoicingInboundReceivedEventData": { "type": "object", "description": "The `data` of `compliance.fr_einvoicing.document.inbound_received`.", "properties": { "document_id": { "type": "string", "description": "Id of the document.", "format": "uuid" }, "document_type": { "type": "string" }, "ppf_reference": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "supplier_id": { "type": [ "string", "null" ], "description": "Id of the supplier.", "format": "uuid" }, "supplier_name": { "type": [ "string", "null" ], "description": "A name, for display." }, "total_minor": { "type": [ "integer", "null" ], "description": "Total in minor units of `currency` (cents for EUR)." }, "currency": { "type": [ "string", "null" ], "description": "ISO 4217 currency code." }, "issue_date": { "type": [ "string", "null" ], "format": "date", "description": "Issue date, `YYYY-MM-DD`." }, "received_at": { "type": "string", "format": "date-time", "description": "When received — RFC 3339, UTC." }, "delivery_channel": { "type": "string" }, "peer_pa_siren": { "type": [ "string", "null" ] } }, "required": [ "document_id", "document_type", "ppf_reference", "supplier_id", "supplier_name", "total_minor", "currency", "issue_date", "received_at", "delivery_channel", "peer_pa_siren" ] }, "FrEinvoicingIncidentEventData": { "type": "object", "description": "The `data` of `compliance.fr_einvoicing.incident.opened`, `compliance.fr_einvoicing.incident.regulator_notified`, `compliance.fr_einvoicing.incident.resolved`, `compliance.fr_einvoicing.serious_incident.opened`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "document_id": { "type": [ "string", "null" ], "description": "Id of the document.", "format": "uuid" }, "severity": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "category": { "type": "string", "description": "The category the record was filed under in OfficeHero." }, "title": { "type": "string", "description": "Free text for people. Do not branch on it." }, "detected_at": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." }, "acknowledged_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When acknowledged — RFC 3339, UTC." }, "resolved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When resolved — RFC 3339, UTC." }, "regulator_notified_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When regulator notified — RFC 3339, UTC." }, "regulator_reference": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "document_id", "severity", "category", "title", "detected_at", "acknowledged_at", "resolved_at", "regulator_notified_at", "regulator_reference", "created_at", "updated_at" ] }, "FrEinvoicingOutboundDeliveryEventData": { "type": "object", "description": "The `data` of `compliance.fr_einvoicing.outbound_delivery.attempted`, `compliance.fr_einvoicing.outbound_delivery.permanently_failed`.", "properties": { "attempt_id": { "type": "string", "description": "Id of the attempt." }, "document_id": { "type": "string", "description": "Id of the document.", "format": "uuid" }, "attempt_n": { "type": "integer" }, "target_kind": { "type": "string" }, "target_identifier": { "type": [ "string", "null" ] }, "idempotency_key": { "type": "string" }, "state": { "type": "string", "description": "The record's status after the change." }, "failure_reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "http_status": { "type": [ "integer", "null" ] }, "started_at": { "type": "string", "format": "date-time", "description": "When started — RFC 3339, UTC." }, "completed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When completed — RFC 3339, UTC." }, "next_retry_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When next retry — RFC 3339, UTC." } }, "required": [ "attempt_id", "document_id", "attempt_n", "target_kind", "target_identifier", "idempotency_key", "state", "failure_reason", "http_status", "started_at", "completed_at", "next_retry_at" ] }, "FuelLog": { "type": "object", "description": "One fuel purchase for a vehicle.", "required": [ "id", "tenant_id", "vehicle_id", "driver_id", "recorded_at", "fuel_type", "volume_l", "price_per_unit_minor", "total_cost_minor", "currency", "odometer_km", "location_lat", "location_lng", "source", "created_at" ], "properties": { "id": { "description": "Fuel log id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "vehicle_id": { "description": "The vehicle that was refuelled.", "type": "string", "format": "uuid" }, "driver_id": { "description": "The driver, when known.", "type": [ "string", "null" ], "format": "uuid" }, "recorded_at": { "description": "When the refuel happened.", "type": "string", "format": "date-time" }, "fuel_type": { "description": "Fuel type.", "type": [ "string", "null" ] }, "volume_l": { "description": "Volume in litres.", "type": "number" }, "price_per_unit_minor": { "description": "Price per litre, in minor units of `currency`.", "type": [ "integer", "null" ] }, "total_cost_minor": { "description": "Total cost, in minor units of `currency`.", "type": [ "integer", "null" ] }, "currency": { "description": "ISO 4217 currency code.", "type": [ "string", "null" ], "pattern": "^[A-Z]{3}$" }, "odometer_km": { "description": "Odometer at the time of the refuel.", "type": [ "integer", "null" ] }, "location_lat": { "description": "Latitude of the fuel station, when known.", "type": [ "number", "null" ] }, "location_lng": { "description": "Longitude of the fuel station, when known.", "type": [ "number", "null" ] }, "source": { "description": "`manual` entry, fuel `card` feed, file `import`, or `detected` from telematics.", "type": [ "string", "null" ], "enum": [ "manual", "detected", "card", "import", null ] }, "created_at": { "description": "When the record was created.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a9-8b9c-7dae-8f0a-2b3c4d5e6f12", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "driver_id": "0199c384-9cad-7ebf-9a1b-3c4d5e6f7a13", "recorded_at": "2026-09-13T16:48:00Z", "fuel_type": "diesel", "volume_l": 312.5, "price_per_unit_minor": 142, "total_cost_minor": 44375, "currency": "EUR", "odometer_km": 283977, "location_lat": 41.9973, "location_lng": 21.428, "source": "card", "created_at": "2026-09-13T17:02:31Z" } }, "FuelLogEventData": { "type": "object", "description": "The `data` of `fm.fuel_log.recorded`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "vehicle_id": { "type": "string", "description": "Id of the vehicle.", "format": "uuid" }, "driver_id": { "type": [ "string", "null" ], "description": "Id of the driver." }, "recorded_at": { "type": "string", "format": "date-time", "description": "When recorded — RFC 3339, UTC." }, "fuel_type": { "type": [ "string", "null" ] }, "volume_l": { "type": "number", "description": "Litres." }, "price_per_unit_minor": { "type": [ "integer", "null" ], "description": "Price per unit in minor units of `currency` (cents for EUR)." }, "total_cost_minor": { "type": [ "integer", "null" ], "description": "Total cost in minor units of `currency` (cents for EUR)." }, "currency": { "type": [ "string", "null" ], "description": "ISO 4217 currency code." }, "odometer_km": { "type": [ "integer", "null" ], "description": "Kilometres." }, "location_lat": { "type": [ "number", "null" ], "description": "Latitude in decimal degrees (WGS 84)." }, "location_lng": { "type": [ "number", "null" ], "description": "Longitude in decimal degrees (WGS 84)." }, "source": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." } }, "required": [ "id", "tenant_id", "vehicle_id", "driver_id", "recorded_at", "fuel_type", "volume_l", "price_per_unit_minor", "total_cost_minor", "currency", "odometer_km", "location_lat", "location_lng", "source", "created_at" ] }, "FuelLogPage": { "type": "object", "description": "One page of fuel logs, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/FuelLog" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "Invoice": { "type": "object", "description": "A sales invoice. Amounts are minor units of `currency`.", "required": [ "id", "number", "customer_id", "status", "currency", "subtotal_minor", "tax_minor", "total_minor", "paid_minor", "balance_minor", "issue_date", "due_date", "issued_at", "voided_at", "einvoice_status", "notes", "sales_order_id", "created_at", "updated_at" ], "properties": { "id": { "description": "Invoice id.", "type": "string", "format": "uuid" }, "number": { "description": "The invoice number, allocated when the invoice is issued. `null` while it is a draft.", "type": [ "string", "null" ] }, "customer_id": { "description": "The customer (a Finance trading partner).", "type": "string", "format": "uuid" }, "status": { "description": "`draft` (editable), `issued`, `partial` (part-paid), `paid`, `overdue`\n(past `due_date` and not fully paid), `void`, or `credited` (reversed by a\ncredit note).", "type": "string", "enum": [ "draft", "issued", "partial", "paid", "void", "overdue", "credited" ] }, "currency": { "description": "ISO 4217 currency code.", "type": "string", "pattern": "^[A-Z]{3}$" }, "subtotal_minor": { "description": "Sum of the lines before tax, in minor units.", "type": "integer" }, "tax_minor": { "description": "Total tax, in minor units.", "type": "integer" }, "total_minor": { "description": "`subtotal_minor` + `tax_minor`.", "type": "integer" }, "paid_minor": { "description": "Amount paid so far.", "type": "integer" }, "balance_minor": { "description": "Amount still owed (`total_minor` − `paid_minor`).", "type": "integer" }, "issue_date": { "description": "Invoice date.", "type": [ "string", "null" ], "format": "date" }, "due_date": { "description": "Payment due date.", "type": [ "string", "null" ], "format": "date" }, "issued_at": { "description": "When the invoice was issued. `null` for a draft.", "type": [ "string", "null" ], "format": "date-time" }, "voided_at": { "description": "When the invoice was voided, if it was.", "type": [ "string", "null" ], "format": "date-time" }, "einvoice_status": { "description": "Where the invoice is in the e-invoicing network flow, if your country uses one.", "type": "string", "enum": [ "none", "pending", "submitted", "accepted", "rejected" ] }, "notes": { "description": "Free text printed on the invoice.", "type": [ "string", "null" ] }, "sales_order_id": { "description": "The sales order the invoice was created from, if any.", "type": [ "string", "null" ], "format": "uuid" }, "created_at": { "description": "When the invoice was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the invoice last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "number": "INV-2026-00418", "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "status": "partial", "currency": "EUR", "subtotal_minor": 125000, "tax_minor": 22500, "total_minor": 147500, "paid_minor": 50000, "balance_minor": 97500, "issue_date": "2026-09-14", "due_date": "2026-10-14", "issued_at": "2026-09-14T08:32:10Z", "voided_at": null, "einvoice_status": "none", "notes": "PO 4471 — September maintenance", "sales_order_id": "0199c398-5e6f-7a10-9b21-c3d4e5f60718", "created_at": "2026-09-14T08:30:00Z", "updated_at": "2026-09-21T10:05:44Z" } }, "InvoiceCreate": { "type": "object", "description": "Creates a **draft** sales invoice. Issue it in the Finance app.\n\n**`customer_id` must be one of your Finance customers.** This API has no\ncustomers endpoint: take the id from an existing invoice\n(`GET /v1/invoices` → `customer_id`) or from the customer's page in the Finance\napp (the id in its address). The id in the example is synthetic — replace it,\nor the call answers `422` `errors.common.validation.invalid_reference`. The same\napplies to a line's `product_id` and `tax_rate_id`.\n", "required": [ "customer_id", "currency", "lines" ], "properties": { "customer_id": { "type": "string", "format": "uuid", "description": "One of your Finance customers. An id that does not exist in your company is a\n`422` (`errors.common.validation.invalid_reference`).\n" }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "Upper-case ISO 4217 code, e.g. `EUR`. It must be switched on in your Finance\ncurrency settings; another is a `422` (`errors.finance.validation.currency_not_enabled`),\na code that is not three upper-case letters a `422` (`validation_failed`).\n" }, "lines": { "type": "array", "minItems": 1, "items": { "$ref": "#/components/schemas/InvoiceLineInput" } }, "issue_date": { "type": "string", "format": "date", "description": "`YYYY-MM-DD`. Optional: without it the draft has no issue date (`null`) and\ngets the day it is issued.\n" }, "due_date": { "type": "string", "format": "date", "description": "`YYYY-MM-DD`, not before `issue_date`. Optional: without it the draft has no\ndue date (`null`); when it is issued, the due date is set from the customer's\npayment terms (it stays `null` if the customer has none).\n" }, "notes": { "type": "string", "maxLength": 2000, "description": "Free text printed on the invoice." } }, "example": { "customer_id": "0199c3a1-7d4e-7b20-8a11-2f6c9d0e4a17", "currency": "EUR", "issue_date": "2026-09-14", "due_date": "2026-10-14", "notes": "PO 4471 — September maintenance", "lines": [ { "description": "Brake pads, front axle (DAF XF)", "qty": 2, "unit_price_minor": 18500, "tax_rate": 18 }, { "description": "Labour, 3 h", "qty": 3, "unit_price_minor": 4500, "tax_rate": 18 } ] } }, "InvoiceEventData": { "type": "object", "description": "The `data` of `fin.invoice.created`, `fin.invoice.overdue`, `fin.invoice.paid`, `fin.invoice.sent`, `fin.invoice.updated`, `fin.invoice.voided`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "customer_id": { "type": "string", "description": "Id of the customer.", "format": "uuid" }, "currency": { "type": "string", "description": "ISO 4217 currency code." }, "status": { "type": "string", "description": "The record's status after the change." }, "subtotal_minor": { "type": "integer", "description": "Subtotal in minor units of `currency` (cents for EUR)." }, "tax_minor": { "type": "integer", "description": "Tax in minor units of `currency` (cents for EUR)." }, "total_minor": { "type": "integer", "description": "Total in minor units of `currency` (cents for EUR)." }, "paid_minor": { "type": "integer", "description": "Paid in minor units of `currency` (cents for EUR)." }, "balance_minor": { "type": "integer", "description": "Balance in minor units of `currency` (cents for EUR)." }, "issue_date": { "type": [ "string", "null" ], "format": "date", "description": "Issue date, `YYYY-MM-DD`." }, "due_date": { "type": [ "string", "null" ], "format": "date", "description": "Due date, `YYYY-MM-DD`." }, "issued_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When issued — RFC 3339, UTC." }, "voided_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When voided — RFC 3339, UTC." }, "einvoice_status": { "type": "string" }, "notes": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "sales_order_id": { "type": [ "string", "null" ], "description": "Id of the sales order.", "format": "uuid" }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "number", "customer_id", "currency", "status", "subtotal_minor", "tax_minor", "total_minor", "paid_minor", "balance_minor", "issue_date", "due_date", "issued_at", "voided_at", "einvoice_status", "notes", "sales_order_id", "created_at", "updated_at" ] }, "InvoiceLineInput": { "type": "object", "description": "One invoice line. Amounts are minor units of the invoice currency. A negative\nor non-numeric quantity, price or tax rate is a `422` (`line_invalid`).\n", "properties": { "product_id": { "type": [ "string", "null" ], "format": "uuid", "description": "A product from your Finance catalogue. Optional." }, "description": { "type": [ "string", "null" ], "description": "Line text shown on the invoice." }, "qty": { "type": "number", "minimum": 0, "default": 0, "description": "Quantity. `quantity` is accepted as an alias." }, "unit_price_minor": { "type": "integer", "minimum": 0, "default": 0, "description": "Unit price in minor units (e.g. cents), before tax." }, "tax_rate": { "type": "number", "minimum": 0, "default": 0, "description": "Tax rate in percent (e.g. `18`). `tax_rate_percent` is accepted as an alias." }, "tax_rate_id": { "type": [ "string", "null" ], "format": "uuid", "description": "A tax rate from your Finance settings. Optional." } } }, "InvoicePage": { "type": "object", "description": "One page of invoices, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Invoice" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "InvoiceUpdate": { "type": "object", "description": "Changes a **draft** invoice. Only these fields are writable. An unknown key is a\n`422` (`validation_failed`, with `errors[].code` = `unknown_field`); a body with\nnone of these fields is a `422` (`no_writable_fields`); an invoice that is no\nlonger a draft cannot be changed (`422`, `update_failed`). `due_date` may not be\nbefore `issue_date`.\n", "minProperties": 1, "properties": { "customer_id": { "type": "string", "format": "uuid" }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "Upper-case ISO 4217 code switched on in your Finance currency settings." }, "issue_date": { "type": "string", "format": "date" }, "due_date": { "type": "string", "format": "date", "description": "Not before `issue_date` (the stored one when you send only `due_date`)." }, "notes": { "type": [ "string", "null" ], "maxLength": 2000 }, "payment_method": { "type": [ "string", "null" ], "enum": [ "bank_transfer", "card", "cash", "direct_debit", "other", null ], "description": "Payment method shown on the invoice." }, "skip_einvoice": { "type": "boolean", "description": "Do not send this invoice through the e-invoicing network when it is issued." } }, "example": { "due_date": "2026-10-30", "notes": "PO 4471 — net 45 agreed with Northwind Transport" } }, "InvoiceVoid": { "type": "object", "description": "Optional reason recorded in the audit trail.", "properties": { "reason": { "type": "string", "default": "integrations_api_void" } }, "example": { "reason": "Duplicate of INV-2026-00412" } }, "LeaveRequest": { "type": "object", "description": "A request for leave (absence) by an employee.", "required": [ "id", "tenant_id", "employee_id", "leave_type_id", "status", "start_date", "end_date", "duration_hours", "reason", "approved_by", "approved_at", "rejected_by", "rejected_at", "cancelled_at", "created_at", "updated_at" ], "properties": { "id": { "description": "Leave request id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "employee_id": { "description": "The employee asking for leave.", "type": "string", "format": "uuid" }, "leave_type_id": { "description": "The leave type (annual, sick, …) as configured in the HR app.", "type": [ "string", "null" ], "format": "uuid" }, "status": { "description": "`pending`, `approved`, `rejected` or `cancelled`.", "type": "string", "enum": [ "pending", "approved", "rejected", "cancelled" ] }, "start_date": { "description": "First day of leave.", "type": "string", "format": "date" }, "end_date": { "description": "Last day of leave.", "type": "string", "format": "date" }, "duration_hours": { "description": "Working days requested × your country's standard working day (8 h when none is configured).", "type": [ "number", "null" ] }, "reason": { "description": "Always `null` over REST in this version — the employee's free-text reason is\npersonal data. The `hr.leave_request.*` webhooks carry it, to endpoints\nenabled for personal data.", "type": [ "string", "null" ] }, "approved_by": { "description": "Who approved it. Only set while `approved`.", "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "description": "When it was approved. Only set while `approved`.", "type": [ "string", "null" ], "format": "date-time" }, "rejected_by": { "description": "Who rejected it. Only set while `rejected`.", "type": [ "string", "null" ], "format": "uuid" }, "rejected_at": { "description": "When it was rejected (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "cancelled_at": { "description": "When it was cancelled (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "description": "When the request was made.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the request last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3aa-d0e1-72f3-9e5f-7a8b9cadbe17", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "leave_type_id": "0199c388-e1f2-7304-8f60-8b9cadbecf18", "status": "approved", "start_date": "2026-10-05", "end_date": "2026-10-09", "duration_hours": 40.0, "reason": null, "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-22T09:30:00Z", "rejected_by": null, "rejected_at": null, "cancelled_at": null, "created_at": "2026-09-20T18:04:12Z", "updated_at": "2026-09-22T09:30:00Z" } }, "LeaveRequestEventData": { "type": "object", "description": "The `data` of `hr.leave_request.approved`, `hr.leave_request.cancelled`, `hr.leave_request.rejected`, `hr.leave_request.submitted`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "employee_id": { "type": "string", "description": "Id of the employee.", "format": "uuid" }, "leave_type_id": { "type": [ "string", "null" ], "description": "Id of the leave type." }, "status": { "type": "string", "description": "The record's status after the change." }, "start_date": { "type": "string", "format": "date", "description": "Start date, `YYYY-MM-DD`." }, "end_date": { "type": "string", "format": "date", "description": "End date, `YYYY-MM-DD`." }, "duration_hours": { "type": [ "number", "null" ], "description": "A duration in hours (decimal: `7.5` is 7 h 30 min)." }, "reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "approved_by": { "type": [ "string", "null" ], "description": "Id of the user who approved it." }, "approved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When approved — RFC 3339, UTC." }, "rejected_by": { "type": [ "string", "null" ], "description": "Id of the user who rejected it." }, "rejected_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When rejected — RFC 3339, UTC." }, "cancelled_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When cancelled — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "employee_id", "leave_type_id", "status", "start_date", "end_date", "duration_hours", "reason", "approved_by", "approved_at", "rejected_by", "rejected_at", "cancelled_at", "created_at", "updated_at" ] }, "LeaveRequestPage": { "type": "object", "description": "One page of leave requests, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/LeaveRequest" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "MessageEventData": { "type": "object", "description": "The `data` of `messaging.message.sent`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "conversation_id": { "type": "string", "description": "Id of the conversation." }, "sender_id": { "type": [ "string", "null" ], "description": "Id of the sender." }, "body": { "type": "string", "description": "Free text for people. Do not branch on it." }, "parent_message_id": { "type": [ "string", "null" ], "description": "Id of the parent message." }, "sent_at": { "type": "string", "format": "date-time", "description": "When sent — RFC 3339, UTC." }, "type": { "type": "string" } }, "required": [ "id", "tenant_id", "conversation_id", "sender_id", "body", "parent_message_id", "sent_at", "type" ] }, "Nis2Article21AttestationChangedEventData": { "type": "object", "description": "The `data` of `compliance.nis2.article21.attestation_changed`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "measure_id": { "type": "string", "description": "Id of the measure." }, "from_state": { "type": "string", "description": "The status before the change." }, "to_state": { "type": "string", "description": "The status after the change." }, "attested_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When attested — RFC 3339, UTC." }, "reason": { "type": "string", "description": "Free text for people. Do not branch on it." }, "changed_by": { "type": "string", "description": "Id of the user who changed it." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "measure_id", "from_state", "to_state", "attested_at", "reason", "changed_by", "created_at", "updated_at" ] }, "Nis2BoardAccountabilityChangedEventData": { "type": "object", "description": "The `data` of `compliance.nis2.board.accountability_changed`.", "properties": { "entry_kind": { "type": "string", "enum": [ "member", "training", "decision", "attestation" ] }, "entry_id": { "type": "string", "description": "Id of the entry." }, "member_id": { "type": [ "string", "null" ], "description": "Id of the member." }, "topic": { "type": [ "string", "null" ] }, "from_state": { "type": [ "string", "null" ], "description": "The status before the change." }, "to_state": { "type": [ "string", "null" ], "description": "The status after the change." }, "severity": { "type": [ "string", "null" ], "description": "A level such as `low`, `medium`, `high` or `critical`." }, "occurred_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When occurred — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] }, "actor_user_id": { "type": "string", "description": "Id of the actor user.", "format": "uuid" }, "occurred_event_at": { "type": "string", "format": "date-time", "description": "When occurred event — RFC 3339, UTC." } }, "required": [ "entry_kind", "entry_id", "member_id", "topic", "from_state", "to_state", "severity", "occurred_at", "previous", "actor_user_id", "occurred_event_at" ] }, "Nis2CsirtSubmissionStateChangedEventData": { "type": "object", "description": "The `data` of `compliance.nis2.csirt.submission_state_changed`.", "properties": { "notification_id": { "type": "string", "description": "Id of the notification." }, "incident_id": { "type": "string", "description": "Id of the incident." }, "adapter_code": { "type": "string" }, "csirt_member_state": { "type": "string" }, "notification_kind": { "type": "string", "enum": [ "early_warning", "notification", "final_report" ] }, "previous_status": { "type": [ "string", "null" ], "description": "The status before the change." }, "new_status": { "type": "string", "description": "The status after the change." }, "csirt_reference": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "error_message": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "attempt_number": { "type": "integer" }, "occurred_event_at": { "type": "string", "format": "date-time", "description": "When occurred event — RFC 3339, UTC." } }, "required": [ "notification_id", "incident_id", "adapter_code", "csirt_member_state", "notification_kind", "previous_status", "new_status", "csirt_reference", "error_message", "attempt_number", "occurred_event_at" ] }, "Nis2IncidentStateChangedEventData": { "type": "object", "description": "The `data` of `compliance.nis2.incident.state_changed`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "severity": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "category": { "type": "string", "description": "The category the record was filed under in OfficeHero." }, "from_state": { "type": "string", "description": "The status before the change." }, "to_state": { "type": "string", "description": "The status after the change." }, "discovered_at": { "type": "string", "format": "date-time", "description": "When discovered — RFC 3339, UTC." }, "closed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When closed — RFC 3339, UTC." }, "reason": { "type": "string", "description": "Free text for people. Do not branch on it." }, "transitioned_by": { "type": "string", "description": "Id of the user who transitioned it." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "severity", "category", "from_state", "to_state", "discovered_at", "closed_at", "reason", "transitioned_by", "created_at", "updated_at" ] }, "Nis2SupplyChainEntryStateChangedEventData": { "type": "object", "description": "The `data` of `compliance.nis2.supply_chain.entry_state_changed`.", "properties": { "entry_kind": { "type": "string", "enum": [ "supplier", "assessment", "cyclone_coordination" ] }, "entry_id": { "type": "string", "description": "Id of the entry." }, "supplier_id": { "type": "string", "description": "Id of the supplier.", "format": "uuid" }, "assessment_id": { "type": [ "string", "null" ], "description": "Id of the assessment." }, "supplier_name": { "type": "string", "description": "A name, for display." }, "supplier_criticality": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "from_lifecycle_state": { "type": "string", "description": "The status before the change." }, "to_lifecycle_state": { "type": "string", "description": "The status after the change." }, "severity": { "type": [ "string", "null" ], "description": "A level such as `low`, `medium`, `high` or `critical`." }, "occurred_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When occurred — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "properties": { "lifecycle_state": { "type": "string" }, "severity": { "type": "string" } } }, { "type": "array", "maxItems": 0 } ] }, "actor_user_id": { "type": "string", "description": "Id of the actor user.", "format": "uuid" }, "occurred_event_at": { "type": "string", "format": "date-time", "description": "When occurred event — RFC 3339, UTC." } }, "required": [ "entry_kind", "entry_id", "supplier_id", "assessment_id", "supplier_name", "supplier_criticality", "from_lifecycle_state", "to_lifecycle_state", "severity", "occurred_at", "previous", "actor_user_id", "occurred_event_at" ] }, "PayInformationRequestEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.rti.responded`, `compliance.pay_transparency.rti.submitted`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "employee_id": { "type": "string", "description": "Id of the employee.", "format": "uuid" }, "role_code": { "type": [ "string", "null" ] }, "status": { "type": "string", "description": "The record's status after the change." }, "submitted_at": { "type": "string", "format": "date-time", "description": "When submitted — RFC 3339, UTC." }, "responded_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When responded — RFC 3339, UTC." }, "response_band_code": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "employee_id", "role_code", "status", "submitted_at", "responded_at", "response_band_code", "created_at", "updated_at" ] }, "PayTransparencyAssessmentEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.assessment.closed`, `compliance.pay_transparency.assessment.opened`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "establishment_group_id": { "type": "string", "description": "Id of the establishment group." }, "period_start": { "type": "string", "format": "date", "description": "Period start, `YYYY-MM-DD`." }, "period_end": { "type": "string", "format": "date", "description": "Period end, `YYYY-MM-DD`." }, "status": { "type": "string", "description": "The record's status after the change." }, "gap_pct": { "type": [ "number", "null" ], "description": "A percentage (`12.5` is 12.5 %)." }, "opened_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When opened — RFC 3339, UTC." }, "closed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When closed — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "establishment_group_id", "period_start", "period_end", "status", "gap_pct", "opened_at", "closed_at", "created_at", "updated_at" ] }, "PayTransparencyBenchmarkEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.benchmark.published`.", "properties": { "position_canonical_id": { "type": "string", "description": "Id of the position canonical." }, "country_code": { "type": "string", "description": "ISO 3166-1 alpha-2 country code." }, "region": { "type": "string" }, "period_quarter": { "type": "string" }, "sample_tenant_count": { "type": "integer", "description": "A count." }, "sample_employee_count": { "type": "integer", "description": "A count." }, "p25_eur": { "type": "number", "description": "An amount in euros, in major units (not cents)." }, "p50_eur": { "type": "number", "description": "An amount in euros, in major units (not cents)." }, "p75_eur": { "type": "number", "description": "An amount in euros, in major units (not cents)." }, "published_at": { "type": "string", "format": "date-time", "description": "When published — RFC 3339, UTC." }, "dp_noise_epsilon": { "type": [ "number", "null" ] } }, "required": [ "position_canonical_id", "country_code", "region", "period_quarter", "sample_tenant_count", "sample_employee_count", "p25_eur", "p50_eur", "p75_eur", "published_at", "dp_noise_epsilon" ] }, "PayTransparencyEvidenceChainIntegrityEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.evidence_chain.integrity_violation`.", "properties": { "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "anchor_id": { "type": "string", "description": "Id of the anchor." }, "period_from": { "type": "string", "format": "date", "description": "Period from, `YYYY-MM-DD`." }, "period_to": { "type": "string", "format": "date", "description": "Period to, `YYYY-MM-DD`." }, "anchored_root": { "type": "string" }, "current_merkle_root": { "type": "string" }, "anchored_sample_count": { "type": "integer", "description": "A count." }, "current_sample_count": { "type": "integer", "description": "A count." }, "failure_reason": { "type": "string", "description": "Free text for people. Do not branch on it." }, "detected_at": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." } }, "required": [ "tenant_id", "anchor_id", "period_from", "period_to", "anchored_root", "current_merkle_root", "anchored_sample_count", "current_sample_count", "failure_reason", "detected_at" ] }, "PayTransparencyRegulatorAuditEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.regulator.audit_queried`.", "properties": { "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "actor_user_id": { "type": "string", "description": "Id of the actor user.", "format": "uuid" }, "since_iso": { "type": [ "string", "null" ], "description": "Since iso: the ISO 8601 timestamp the request carried." }, "until_iso": { "type": [ "string", "null" ], "description": "Until iso: the ISO 8601 timestamp the request carried." }, "rows_returned": { "type": "integer" }, "verified": { "type": "boolean" }, "gap_count": { "type": "integer", "description": "A count." }, "queried_at": { "type": "string", "format": "date-time", "description": "When queried — RFC 3339, UTC." } }, "required": [ "tenant_id", "actor_user_id", "since_iso", "until_iso", "rows_returned", "verified", "gap_count", "queried_at" ] }, "PayTransparencyReportPublishedEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.report.published`.", "properties": { "report_id": { "type": "string", "description": "Id of the report." }, "country_code": { "type": "string", "description": "ISO 3166-1 alpha-2 country code." }, "obligation_id": { "type": "string", "description": "Id of the obligation." }, "period_from": { "type": "string", "format": "date", "description": "Period from, `YYYY-MM-DD`." }, "period_to": { "type": "string", "format": "date", "description": "Period to, `YYYY-MM-DD`." }, "public_slug": { "type": "string" }, "published_at": { "type": "string", "format": "date-time", "description": "When published — RFC 3339, UTC." }, "dp_noise_epsilon": { "type": [ "number", "null" ] } }, "required": [ "report_id", "country_code", "obligation_id", "period_from", "period_to", "public_slug", "published_at", "dp_noise_epsilon" ] }, "Payment": { "type": "object", "description": "A payment received from a customer or paid to a supplier.", "required": [ "id", "tenant_id", "invoice_id", "bill_id", "amount_minor", "currency", "direction", "status", "received_at", "failure_reason", "created_at", "updated_at" ], "properties": { "id": { "description": "Payment id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "invoice_id": { "description": "The first sales invoice this payment is allocated to. A payment split across several invoices shows the earliest allocation.", "type": [ "string", "null" ], "format": "uuid" }, "bill_id": { "description": "The first bill (purchase invoice) this payment is allocated to.", "type": [ "string", "null" ], "format": "uuid" }, "amount_minor": { "description": "Amount in minor units of `currency`.", "type": "integer" }, "currency": { "description": "ISO 4217 currency code.", "type": "string", "pattern": "^[A-Z]{3}$" }, "direction": { "description": "`in` from a customer, `out` to a supplier, `refund` returned to a customer.", "type": "string", "enum": [ "in", "out", "refund" ] }, "status": { "description": "Derived from `direction`: `sent` for `out`, otherwise `received` — a refund\ncurrently also reads `received`. Use `direction` to tell them apart.", "type": "string", "enum": [ "received", "sent" ] }, "received_at": { "description": "The payment date (midnight UTC; payments are recorded by date, not time).", "type": [ "string", "null" ], "format": "date-time" }, "failure_reason": { "description": "Always `null` — only completed payments are recorded.", "type": [ "string", "null" ] }, "created_at": { "description": "When the payment was recorded.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the payment last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a5-0f1e-7d2c-8b3a-49586a7b8c03", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "invoice_id": "0199c3a2-4b7e-7f30-9c2e-6a8d4f1b2c01", "bill_id": null, "amount_minor": 50000, "currency": "EUR", "direction": "in", "status": "received", "received_at": "2026-09-21T00:00:00Z", "failure_reason": null, "created_at": "2026-09-21T10:05:40Z", "updated_at": "2026-09-21T10:05:40Z" } }, "PaymentEventData": { "type": "object", "description": "The `data` of `fin.payment.failed`, `fin.payment.received`, `fin.payment.refunded`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "invoice_id": { "type": [ "string", "null" ], "description": "Id of the invoice.", "format": "uuid" }, "bill_id": { "type": [ "string", "null" ], "description": "Id of the bill.", "format": "uuid" }, "amount_minor": { "type": "integer", "description": "Amount in minor units of `currency` (cents for EUR)." }, "currency": { "type": "string", "description": "ISO 4217 currency code." }, "direction": { "type": "string" }, "status": { "type": "string", "description": "The record's status after the change." }, "received_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When received — RFC 3339, UTC." }, "failure_reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "invoice_id", "bill_id", "amount_minor", "currency", "direction", "status", "received_at", "failure_reason", "created_at", "updated_at" ] }, "PaymentPage": { "type": "object", "description": "One page of payments, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Payment" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "Problem": { "type": "object", "description": "An RFC 9457 problem document (`Content-Type: application/problem+json`).\nBranch on `type` and, for the specific cause, on `detail_key` — both are\nstable. `detail` is a sentence for humans, translated to the request's\n`Accept-Language`, and may change wording at any time.\n\n`detail_key` is absent on `405` (wrong method), on rate-limit `429`s and on the\ntwo idempotency `409`s, whose key is in `detail`. Other members may be added\nat any time; ignore the ones you do not know.\n", "required": [ "type", "title", "status" ], "properties": { "type": { "type": "string", "format": "uri", "description": "The problem type. See [error types](https://developers.officehero.io/docs/errors).", "enum": [ "https://officehero.io/errors/validation", "https://officehero.io/errors/not-found", "https://officehero.io/errors/method-not-allowed", "https://officehero.io/errors/unauthorized", "https://officehero.io/errors/forbidden", "https://officehero.io/errors/feature_disabled", "https://officehero.io/errors/conflict", "https://officehero.io/errors/idempotency-conflict", "https://officehero.io/errors/rate-limited", "https://officehero.io/errors/gone", "https://officehero.io/errors/internal", "https://officehero.io/errors/service-unavailable" ] }, "title": { "type": "string", "description": "A short summary of the type for humans. Like `detail` it is translated to\nthe request's `Accept-Language` (`Nicht gefunden` for `de`), so never\ncompare it — branch on `type`.\n" }, "status": { "type": "integer", "description": "The HTTP status code." }, "detail": { "type": "string", "description": "What went wrong, for a human, in the request's language." }, "detail_key": { "type": "string", "description": "The stable machine key for this exact cause, e.g. `errors.integrations.invoices.not_found`." }, "code": { "type": "string", "description": "A short token present on most problems. On a `422` it is the validation code\nof the offending field (`unknown_field`, …); on other refusals it is the last\nsegment of `detail_key` (`not_found`, `endpoint_not_active`, `rate_limited`).\n" }, "field": { "type": "string", "description": "On a validation problem about one field, that field's name." }, "errors": { "type": "array", "description": "On a validation problem, one entry per invalid field.", "items": { "type": "object", "properties": { "path": { "type": "string" }, "code": { "type": "string" }, "message": { "type": "string" } } } }, "missing_scope": { "type": "string", "description": "On a `403`, the scope the API key needs." }, "missing_scopes": { "type": "array", "items": { "type": "string" }, "description": "On a `403` from creating or changing a webhook endpoint, every read scope\nthe subscribed event types need (`missing_scope` is the first).\n" }, "unknown_event_types": { "type": "array", "items": { "type": "string" }, "description": "On a `422` `unknown_event_type`, the event types that are not in the catalogue." }, "flag_code": { "type": "string", "description": "On a `403` `feature_disabled`, the switched-off feature (`integrations.api.enabled`)." }, "currency": { "type": "string", "description": "On a `422` `currency_not_enabled`, the currency that was refused." }, "retry_after_s": { "type": "integer", "description": "On a `429`, seconds to wait (same as `Retry-After`)." } } }, "PurchaseOrder": { "type": "object", "description": "A purchase order sent to a supplier.", "required": [ "id", "tenant_id", "number", "supplier_id", "status", "currency", "total_minor", "expected_at", "approved_at", "received_at", "closed_at", "created_at", "updated_at" ], "properties": { "id": { "description": "Purchase order id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "number": { "description": "Purchase order number.", "type": [ "string", "null" ] }, "supplier_id": { "description": "The supplier.", "type": "string", "format": "uuid" }, "status": { "description": "`draft`, `sent`, `received_partial`, `received`, `closed` or `cancelled`.", "type": "string", "enum": [ "draft", "sent", "received_partial", "received", "closed", "cancelled" ] }, "currency": { "description": "ISO 4217 currency code.", "type": "string", "pattern": "^[A-Z]{3}$" }, "total_minor": { "description": "Order total, in minor units.", "type": "integer" }, "expected_at": { "description": "Expected delivery date (midnight UTC).", "type": [ "string", "null" ], "format": "date-time" }, "approved_at": { "description": "Set once the order has left `draft` (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "received_at": { "description": "Set once goods were received, partly or fully (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "closed_at": { "description": "Set when the order is `closed` (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "description": "When the order was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the order last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a7-2b3c-7d4e-8f5a-6b7c8d9e0f06", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "PO-2026-00231", "supplier_id": "0199c390-3c4d-7e5f-8a6b-7c8d9e0f1a05", "status": "sent", "currency": "EUR", "total_minor": 101480, "expected_at": "2026-09-25T00:00:00Z", "approved_at": "2026-09-08T11:00:05Z", "received_at": null, "closed_at": null, "created_at": "2026-09-08T10:41:30Z", "updated_at": "2026-09-08T11:00:05Z" } }, "PurchaseOrderEventData": { "type": "object", "description": "The `data` of `fin.purchase_order.approved`, `fin.purchase_order.closed`, `fin.purchase_order.created`, `fin.purchase_order.received`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "supplier_id": { "type": "string", "description": "Id of the supplier.", "format": "uuid" }, "status": { "type": "string", "description": "The record's status after the change." }, "currency": { "type": "string", "description": "ISO 4217 currency code." }, "total_minor": { "type": "integer", "description": "Total in minor units of `currency` (cents for EUR)." }, "expected_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When expected — RFC 3339, UTC." }, "approved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When approved — RFC 3339, UTC." }, "received_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When received — RFC 3339, UTC." }, "closed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When closed — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "number", "supplier_id", "status", "currency", "total_minor", "expected_at", "approved_at", "received_at", "closed_at", "created_at", "updated_at" ] }, "PurchaseOrderPage": { "type": "object", "description": "One page of purchase orders, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/PurchaseOrder" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "ReplayFailedResult": { "type": "object", "required": [ "enqueued" ], "properties": { "enqueued": { "type": "integer", "minimum": 0, "description": "How many failed or dead deliveries were queued again." } } }, "TachographThresholdEventData": { "type": "object", "description": "The `data` of `fm.tachograph.threshold.exceeded`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "threshold_code": { "type": "string" }, "driver_employee_id": { "type": [ "string", "null" ], "description": "Id of the driver employee.", "format": "uuid" }, "vehicle_id": { "type": [ "string", "null" ], "description": "Id of the vehicle.", "format": "uuid" }, "severity": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "exceeded_at": { "type": "string", "format": "date-time", "description": "When exceeded — RFC 3339, UTC." }, "observed_value": { "type": [ "number", "null" ] }, "threshold_value": { "type": [ "number", "null" ] }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." } }, "required": [ "id", "threshold_code", "driver_employee_id", "vehicle_id", "severity", "exceeded_at", "observed_value", "threshold_value", "created_at" ] }, "TachographUploadEventData": { "type": "object", "description": "The `data` of `fm.tachograph.upload.lcv_received`, `fm.tachograph.upload.processed`, `fm.tachograph.upload.received`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "source_kind": { "type": "string" }, "driver_employee_id": { "type": [ "string", "null" ], "description": "Id of the driver employee.", "format": "uuid" }, "vehicle_id": { "type": [ "string", "null" ], "description": "Id of the vehicle.", "format": "uuid" }, "file_name": { "type": "string", "description": "A name, for display." }, "file_size_bytes": { "type": "integer", "description": "A size in bytes." }, "status": { "type": "string", "description": "The record's status after the change." }, "activity_start": { "type": [ "string", "null" ], "description": "Activity start: a timestamp as stored (`2026-09-14 08:30:00+00`). Unlike the `*_at` fields it is not normalised to RFC 3339." }, "activity_end": { "type": [ "string", "null" ], "description": "Activity end: a timestamp as stored (`2026-09-14 08:30:00+00`). Unlike the `*_at` fields it is not normalised to RFC 3339." }, "violation_count": { "type": "integer", "description": "A count." }, "uploaded_at": { "type": "string", "format": "date-time", "description": "When uploaded — RFC 3339, UTC." }, "processed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When processed — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "source_kind", "driver_employee_id", "vehicle_id", "file_name", "file_size_bytes", "status", "activity_start", "activity_end", "violation_count", "uploaded_at", "processed_at", "created_at", "updated_at" ] }, "TachographViolationEventData": { "type": "object", "description": "The `data` of `fm.tachograph.osnma.verification_failed`, `fm.tachograph.violation.detected`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "upload_id": { "type": "string", "description": "Id of the upload." }, "driver_employee_id": { "type": [ "string", "null" ], "description": "Id of the driver employee.", "format": "uuid" }, "vehicle_id": { "type": [ "string", "null" ], "description": "Id of the vehicle.", "format": "uuid" }, "rule_code": { "type": "string" }, "severity": { "type": "string", "description": "A level such as `low`, `medium`, `high` or `critical`." }, "detected_at": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." }, "window_start": { "type": [ "string", "null" ], "description": "Window start: a timestamp as stored (`2026-09-14 08:30:00+00`). Unlike the `*_at` fields it is not normalised to RFC 3339." }, "window_end": { "type": [ "string", "null" ], "description": "Window end: a timestamp as stored (`2026-09-14 08:30:00+00`). Unlike the `*_at` fields it is not normalised to RFC 3339." }, "overage_seconds": { "type": [ "integer", "null" ], "description": "A duration in seconds." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." } }, "required": [ "id", "upload_id", "driver_employee_id", "vehicle_id", "rule_code", "severity", "detected_at", "window_start", "window_end", "overage_seconds", "created_at" ] }, "Ticket": { "type": "object", "description": "A support ticket.", "required": [ "id", "tenant_id", "number", "subject", "status", "priority", "category_id", "opened_by", "assigned_to", "first_response_at", "resolved_at", "closed_at", "last_activity_at", "source", "tags", "created_at", "updated_at" ], "properties": { "id": { "description": "Ticket id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "number": { "description": "Ticket number as shown to customers and staff.", "type": [ "string", "null" ] }, "subject": { "description": "Subject line.", "type": "string" }, "status": { "description": "`open`, `awaiting_customer`, `awaiting_staff`, `resolved` or `closed`.", "type": "string", "enum": [ "open", "awaiting_customer", "awaiting_staff", "resolved", "closed" ] }, "priority": { "description": "Urgency.", "type": [ "string", "null" ], "enum": [ "low", "normal", "high", "urgent", null ] }, "category_id": { "description": "The ticket category.", "type": [ "string", "null" ], "format": "uuid" }, "opened_by": { "description": "The user who opened the ticket.", "type": [ "string", "null" ], "format": "uuid" }, "assigned_to": { "description": "The staff member handling it.", "type": [ "string", "null" ], "format": "uuid" }, "first_response_at": { "description": "When staff first replied.", "type": [ "string", "null" ], "format": "date-time" }, "resolved_at": { "description": "When it was resolved.", "type": [ "string", "null" ], "format": "date-time" }, "closed_at": { "description": "When it was closed.", "type": [ "string", "null" ], "format": "date-time" }, "last_activity_at": { "description": "Time of the latest message or change.", "type": [ "string", "null" ], "format": "date-time" }, "source": { "description": "Where the ticket came from.", "type": [ "string", "null" ], "enum": [ "web", "mobile", "email", "api", "phone", null ] }, "tags": { "description": "Labels on the ticket.", "type": "array", "items": { "type": "string" } }, "created_at": { "description": "When the ticket was opened.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the ticket last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3ac-0314-7526-8182-adbecfd0e120", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "1287", "subject": "Invoice INV-2026-00418 shows the wrong VAT rate", "status": "awaiting_staff", "priority": "normal", "category_id": "0199c389-1425-7637-9293-becfd0e1f221", "opened_by": "0199c38b-3647-7859-94b5-d0e1f2031423", "assigned_to": "0199c38a-2536-7748-83a4-cfd0e1f20322", "first_response_at": "2026-09-22T09:41:00Z", "resolved_at": null, "closed_at": null, "last_activity_at": "2026-09-22T11:02:17Z", "source": "email", "tags": [ "billing", "vat" ], "created_at": "2026-09-22T09:12:55Z", "updated_at": "2026-09-22T11:02:17Z" } }, "TicketEventData": { "type": "object", "description": "The `data` of `support.ticket.closed`, `support.ticket.created`, `support.ticket.reopened`, `support.ticket.replied`, `support.ticket.resolved`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "subject": { "type": "string", "description": "Free text for people. Do not branch on it." }, "status": { "type": "string", "description": "The record's status after the change." }, "priority": { "type": [ "string", "null" ], "description": "A level such as `low`, `medium`, `high` or `critical`." }, "category_id": { "type": [ "string", "null" ], "description": "Id of the category." }, "opened_by": { "type": [ "string", "null" ], "description": "Id of the user who opened it." }, "assigned_to": { "type": [ "string", "null" ] }, "first_response_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When first response — RFC 3339, UTC." }, "resolved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When resolved — RFC 3339, UTC." }, "closed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When closed — RFC 3339, UTC." }, "last_activity_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When last activity — RFC 3339, UTC." }, "source": { "type": [ "string", "null" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Labels, as entered in OfficeHero." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "number", "subject", "status", "priority", "category_id", "opened_by", "assigned_to", "first_response_at", "resolved_at", "closed_at", "last_activity_at", "source", "tags", "created_at", "updated_at" ] }, "TicketPage": { "type": "object", "description": "One page of tickets, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Ticket" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "Timesheet": { "type": "object", "description": "An employee's timesheet for one period.", "required": [ "id", "tenant_id", "employee_id", "period_start", "period_end", "status", "total_hours", "regular_hours", "overtime_hours", "submitted_at", "approved_by", "approved_at", "created_at", "updated_at" ], "properties": { "id": { "description": "Timesheet id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "employee_id": { "description": "The employee.", "type": "string", "format": "uuid" }, "period_start": { "description": "First day of the period.", "type": "string", "format": "date" }, "period_end": { "description": "Last day of the period.", "type": "string", "format": "date" }, "status": { "description": "`draft`, `submitted`, `approved`, `rejected` or `locked` (payroll closed).", "type": "string", "enum": [ "draft", "submitted", "approved", "rejected", "locked" ] }, "total_hours": { "description": "Sum of the hours worked on the timesheet's entries.", "type": [ "number", "null" ] }, "regular_hours": { "description": "Always `null` in this version.", "type": [ "number", "null" ] }, "overtime_hours": { "description": "Always `null` in this version.", "type": [ "number", "null" ] }, "submitted_at": { "description": "When the employee submitted it.", "type": [ "string", "null" ], "format": "date-time" }, "approved_by": { "description": "Who approved it.", "type": [ "string", "null" ], "format": "uuid" }, "approved_at": { "description": "When it was approved.", "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "description": "When the timesheet was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the timesheet last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3ab-f203-7415-9071-9cadbecfd019", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "employee_id": "0199c385-adbe-7fc0-8b2c-4d5e6f7a8b14", "period_start": "2026-09-07", "period_end": "2026-09-13", "status": "approved", "total_hours": 41.5, "regular_hours": null, "overtime_hours": null, "submitted_at": "2026-09-13T16:00:00Z", "approved_by": "0199c387-cfd0-71e2-8d4e-6f7a8b9cad16", "approved_at": "2026-09-14T08:10:00Z", "created_at": "2026-09-07T06:00:00Z", "updated_at": "2026-09-14T08:10:00Z" } }, "TimesheetEventData": { "type": "object", "description": "The `data` of `hr.timesheet.approved`, `hr.timesheet.submitted`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "employee_id": { "type": "string", "description": "Id of the employee.", "format": "uuid" }, "period_start": { "type": "string", "format": "date", "description": "Period start, `YYYY-MM-DD`." }, "period_end": { "type": "string", "format": "date", "description": "Period end, `YYYY-MM-DD`." }, "status": { "type": "string", "description": "The record's status after the change." }, "total_hours": { "type": [ "number", "null" ], "description": "A duration in hours (decimal: `7.5` is 7 h 30 min)." }, "regular_hours": { "type": [ "number", "null" ], "description": "A duration in hours (decimal: `7.5` is 7 h 30 min)." }, "overtime_hours": { "type": [ "number", "null" ], "description": "A duration in hours (decimal: `7.5` is 7 h 30 min)." }, "submitted_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When submitted — RFC 3339, UTC." }, "approved_by": { "type": [ "string", "null" ], "description": "Id of the user who approved it." }, "approved_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When approved — RFC 3339, UTC." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "employee_id", "period_start", "period_end", "status", "total_hours", "regular_hours", "overtime_hours", "submitted_at", "approved_by", "approved_at", "created_at", "updated_at" ] }, "TimesheetPage": { "type": "object", "description": "One page of timesheets, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Timesheet" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "UkGpgrStatusChangedEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.uk_gpgr.status_changed`.", "properties": { "submission_id": { "type": "string", "description": "Id of the submission." }, "reporting_year": { "type": "integer" }, "submission_reference": { "type": "string", "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "previous_status": { "type": "string", "description": "The status before the change." }, "new_status": { "type": "string", "description": "The status after the change." }, "environment": { "type": "string" }, "government_receipt": { "type": [ "string", "null" ] }, "message": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "observed_at": { "type": "string", "format": "date-time", "description": "When observed — RFC 3339, UTC." } }, "required": [ "submission_id", "reporting_year", "submission_reference", "previous_status", "new_status", "environment", "government_receipt", "message", "observed_at" ] }, "UkGpgrSubmittedEventData": { "type": "object", "description": "The `data` of `compliance.pay_transparency.uk_gpgr.submitted`.", "properties": { "submission_id": { "type": "string", "description": "Id of the submission." }, "reporting_year": { "type": "integer" }, "employer_size": { "type": "string" }, "submission_reference": { "type": "string", "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "environment": { "type": "string" }, "submitted_at": { "type": "string", "format": "date-time", "description": "When submitted — RFC 3339, UTC." } }, "required": [ "submission_id", "reporting_year", "employer_size", "submission_reference", "environment", "submitted_at" ] }, "UkMtdItsaOauthGrantStateEventData": { "type": "object", "description": "The `data` of `compliance.uk_mtd.itsa.oauth_granted`, `compliance.uk_mtd.itsa.oauth_refresh_failed`, `compliance.uk_mtd.itsa.oauth_refreshed`, `compliance.uk_mtd.itsa.oauth_revoked`.", "properties": { "grant_id": { "type": "string", "description": "Id of the grant." }, "taxpayer_id": { "type": "string", "description": "Id of the taxpayer." }, "environment": { "type": "string", "enum": [ "sandbox", "production" ] }, "transition": { "type": "string", "enum": [ "granted", "refreshed", "refresh_failed", "revoked" ] }, "previous_status": { "type": [ "string", "null" ], "description": "The status before the change." }, "new_status": { "type": "string", "description": "The status after the change." }, "scopes": { "type": "array", "items": { "type": "string" } }, "expires_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When expires — RFC 3339, UTC." }, "failure_reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "attempt_number": { "type": "integer" }, "occurred_event_at": { "type": "string", "format": "date-time", "description": "When occurred event — RFC 3339, UTC." } }, "required": [ "grant_id", "taxpayer_id", "environment", "transition", "previous_status", "new_status", "scopes", "expires_at", "failure_reason", "attempt_number", "occurred_event_at" ] }, "UkMtdItsaPenaltyReceivedEventData": { "type": "object", "description": "The `data` of `compliance.uk_mtd.itsa.penalty_received`. **Its keys are camelCase**, an exception to the snake_case convention of every other payload; they are sent exactly as shown.", "properties": { "replayId": { "type": "string", "description": "Id of the replay." }, "nino": { "type": "string" }, "taxYear": { "type": "string" }, "periodKey": { "type": "string" }, "hmrcPenaltyReference": { "type": "string", "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "penaltyKind": { "type": "string" }, "amountMinor": { "type": "integer", "description": "Amount in minor units of `currency` (cents for EUR)." }, "linkedSubmissionId": { "type": [ "string", "null" ], "description": "Id of the linked submission." }, "replayStatus": { "type": "string" } }, "required": [ "replayId", "nino", "taxYear", "periodKey", "hmrcPenaltyReference", "penaltyKind", "amountMinor", "linkedSubmissionId", "replayStatus" ] }, "UkMtdItsaSubmissionAcceptedEventData": { "type": "object", "description": "The `data` of `compliance.uk_mtd.itsa.submission_accepted`. **Its keys are camelCase**, an exception to the snake_case convention of every other payload; they are sent exactly as shown.", "properties": { "submissionId": { "type": "string", "description": "Id of the submission." }, "nino": { "type": "string" }, "taxYear": { "type": "string" }, "periodKey": { "type": "string" }, "submissionKind": { "type": "string" }, "hmrcReceiptId": { "type": "string", "description": "Id of the hmrc receipt." }, "hmrcEnvironment": { "type": "string" } }, "required": [ "submissionId", "nino", "taxYear", "periodKey", "submissionKind", "hmrcReceiptId", "hmrcEnvironment" ] }, "UserEventData": { "type": "object", "description": "The `data` of `identity.user.created`, `identity.user.deactivated`, `identity.user.reactivated`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "email": { "type": "string", "description": "An e-mail address.", "format": "email" }, "first_name": { "type": [ "string", "null" ], "description": "A name, for display." }, "last_name": { "type": [ "string", "null" ], "description": "A name, for display." }, "status": { "type": "string", "description": "The record's status after the change." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "deactivated_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When deactivated — RFC 3339, UTC." }, "deleted_reason": { "type": [ "string", "null" ], "description": "Free text for people. Do not branch on it." }, "membership": { "type": "object", "properties": { "id": { "type": "string" }, "primary_role": { "type": "string" }, "status": { "type": "string" }, "joined_at": { "type": "string", "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "id", "primary_role", "status", "joined_at", "revoked_at" ] }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "email", "first_name", "last_name", "status", "created_at", "deactivated_at", "deleted_reason", "membership" ] }, "Vehicle": { "type": "object", "description": "A vehicle in your fleet.", "required": [ "id", "tenant_id", "license_plate", "vin", "make", "model", "year", "color", "fuel_type", "tank_capacity_l", "country_code", "group_id", "status", "last_seen_at", "odometer_km", "created_at", "updated_at" ], "properties": { "id": { "description": "Vehicle id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "license_plate": { "description": "Registration plate as entered.", "type": [ "string", "null" ] }, "vin": { "description": "Vehicle identification number (17 characters when known).", "type": [ "string", "null" ] }, "make": { "description": "Manufacturer.", "type": [ "string", "null" ] }, "model": { "description": "Model.", "type": [ "string", "null" ] }, "year": { "description": "Model year.", "type": [ "integer", "null" ] }, "color": { "description": "Colour as entered.", "type": [ "string", "null" ] }, "fuel_type": { "description": "Fuel or energy type.", "type": [ "string", "null" ], "enum": [ "petrol", "diesel", "electric", "hybrid", "lpg", "cng", "hydrogen", null ] }, "tank_capacity_l": { "description": "Tank capacity in litres.", "type": [ "number", "null" ] }, "country_code": { "description": "ISO 3166-1 alpha-2 country of registration.", "type": [ "string", "null" ] }, "group_id": { "description": "The vehicle group it belongs to.", "type": [ "string", "null" ], "format": "uuid" }, "status": { "description": "`active`, `inactive`, `maintenance`, `retired` or `disposed`.", "type": "string", "enum": [ "active", "inactive", "maintenance", "retired", "disposed" ] }, "last_seen_at": { "description": "Always `null` in this version. Live positions are not part of the Integrations API.", "type": [ "string", "null" ], "format": "date-time" }, "odometer_km": { "description": "Last recorded odometer reading, in kilometres.", "type": [ "integer", "null" ] }, "created_at": { "description": "When the vehicle was added.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the vehicle last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "license_plate": "SK 4821 AB", "vin": "XLRTE47MS0G000042", "make": "DAF", "model": "XF 480", "year": 2022, "color": "White", "fuel_type": "diesel", "tank_capacity_l": 430.0, "country_code": "MK", "group_id": "0199c383-7a8b-7c9d-9e0f-1a2b3c4d5e11", "status": "active", "last_seen_at": null, "odometer_km": 284115, "created_at": "2026-02-03T09:00:00Z", "updated_at": "2026-09-15T07:10:00Z" } }, "VehicleEventData": { "type": "object", "description": "The `data` of `fm.vehicle.back_in_service`, `fm.vehicle.created`, `fm.vehicle.out_of_service`, `fm.vehicle.updated`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "license_plate": { "type": [ "string", "null" ], "description": "The registration plate, as entered in OfficeHero." }, "vin": { "type": [ "string", "null" ], "description": "Vehicle identification number (17 characters, ISO 3779)." }, "make": { "type": [ "string", "null" ] }, "model": { "type": [ "string", "null" ] }, "year": { "type": [ "integer", "null" ] }, "color": { "type": [ "string", "null" ] }, "fuel_type": { "type": [ "string", "null" ] }, "tank_capacity_l": { "type": [ "number", "null" ], "description": "Litres." }, "country_code": { "type": [ "string", "null" ], "description": "ISO 3166-1 alpha-2 country code." }, "group_id": { "type": [ "string", "null" ], "description": "Id of the group." }, "status": { "type": "string", "description": "The record's status after the change." }, "last_seen_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When last seen — RFC 3339, UTC." }, "odometer_km": { "type": [ "integer", "null" ], "description": "Kilometres." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "license_plate", "vin", "make", "model", "year", "color", "fuel_type", "tank_capacity_l", "country_code", "group_id", "status", "last_seen_at", "odometer_km", "created_at", "updated_at" ] }, "VehiclePage": { "type": "object", "description": "One page of vehicles, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/Vehicle" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "WebhookDelivery": { "type": "object", "description": "One attempt to deliver one event to one endpoint.", "required": [ "id", "endpoint_id", "event_id", "attempt", "max_attempts", "status", "response_status", "response_ms", "error_class", "error_detail", "delivered_at", "next_attempt_at", "replayed_from", "created_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "endpoint_id": { "type": "string", "format": "uuid" }, "event_id": { "type": "string", "format": "uuid", "description": "The event's id. The envelope and the `OH-Event-Id` header carry it as `evt_`." }, "attempt": { "type": "integer", "description": "Attempts made so far." }, "max_attempts": { "type": "integer" }, "status": { "type": "string", "enum": [ "pending", "delivered", "failed", "dead" ], "description": "`pending` — queued, or waiting for its next attempt (`next_attempt_at`).\n`delivered` — your endpoint answered `2xx`.\n`failed` — stopped without using up its attempts, and not retried: your\nendpoint answered `410 Gone` (`error_class: gone`), the endpoint was paused or\ndisabled when the attempt came up (`endpoint_disabled`), its URL resolved to a\nnon-public address (`ssrf_rejected`), or the owning key was revoked or lost the\nscope (`api_key_inactive`, `api_key_scope_insufficient`).\n`dead` — all 8 attempts failed.\n`failed` and `dead` deliveries can be sent again with replay.\n" }, "response_status": { "type": [ "integer", "null" ], "description": "HTTP status your receiver answered with." }, "response_ms": { "type": [ "integer", "null" ], "description": "How long your receiver took, in milliseconds." }, "error_class": { "type": [ "string", "null" ], "description": "Why the last attempt failed: `http_5xx`, `http_4xx`, `redirect_blocked` (a\n`3xx`; redirects are not followed), `timeout`, `connect_failed`, `tls`, `dns`,\n`transport`, `rate_limited` (your `429`), `gone` (your `410`), `endpoint_disabled`,\n`ssrf_rejected`, `api_key_inactive`, `api_key_scope_insufficient` or\n`pii_capability_blocked`. `null` before the first attempt and on a `delivered`\ndelivery, including one that succeeded on a retry: the successful attempt clears\nit (`attempt` still shows how many attempts it took). A delivery that succeeded\non a retry before this changed (changelog, 2026-10-12) may still show the class\nof its failed attempt.\n" }, "error_detail": { "type": [ "string", "null" ], "description": "More about the last failed attempt — `HTTP 503`, the connection error, or how\nlong a `429`'s `Retry-After` made it wait. `null` whenever `error_class` is, and\nfor a delivery stopped before it was sent (`endpoint_disabled`, `ssrf_rejected`,\n`api_key_inactive`, `api_key_scope_insufficient`, `pii_capability_blocked`).\n" }, "delivered_at": { "type": [ "string", "null" ], "format": "date-time" }, "next_attempt_at": { "type": [ "string", "null" ], "format": "date-time" }, "replayed_from": { "type": [ "string", "null" ], "format": "uuid", "description": "For a replay, the delivery it was copied from." }, "created_at": { "type": "string", "format": "date-time" } } }, "WebhookDeliveryPage": { "type": "object", "description": "One page of deliveries, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookDelivery" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } }, "WebhookEndpoint": { "type": "object", "description": "An HTTPS URL that receives signed event deliveries. The secret itself is\nnever returned after creation — only `secret_prefix`, to tell secrets apart.\n", "required": [ "id", "name", "url", "secret_prefix", "event_types", "pinned_version", "status", "consecutive_failures", "last_success_at", "last_failure_at", "disabled_reason", "api_key_id", "secret_rotated_at", "canonical_signing_enabled", "created_at", "updated_at" ], "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string", "description": "Your label for the endpoint." }, "url": { "type": "string", "format": "uri", "description": "Where deliveries are POSTed. Must resolve to a public address." }, "secret_prefix": { "type": "string", "description": "The first characters of the signing secret (`whsec_` + 6)." }, "event_types": { "type": "array", "items": { "type": "string" }, "description": "Event types delivered to this endpoint, or `[\"*\"]` for all." }, "pinned_version": { "type": "string", "format": "date", "description": "The `OH-Version` sent with every delivery." }, "status": { "type": "string", "enum": [ "active", "paused", "disabled" ], "description": "`active` receives deliveries. `paused` does not: you paused it, or the API\nkey that owns it was revoked (`disabled_reason: api_key_revoked`) or expired\n(`api_key_inactive`). `disabled`\nwas deleted by you (`user_deleted`) or switched off automatically after\nfailures (see `disabled_reason`). Resuming puts any of them back to `active`,\nexcept an endpoint whose owning key is revoked or expired (`409`\n`owner_key_inactive`); a `disabled` one takes a place in the quota again.\n" }, "consecutive_failures": { "type": "integer", "minimum": 0 }, "last_success_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_failure_at": { "type": [ "string", "null" ], "format": "date-time" }, "disabled_reason": { "type": [ "string", "null" ], "description": "Why the endpoint is not `active`, when OfficeHero changed it: `user_deleted`,\n`auto_consecutive_failures` (50 failed attempts in a row), `auto_410_repeat`\n(three `410 Gone` within 24 hours), `auto_7_day_all_dead` (every delivery of the\nlast 7 days failed for good), `api_key_revoked` (paused when its key was\nrevoked) or `api_key_inactive` (paused at the first event after its key\nexpired or was deleted). `null` after you pause it yourself.\n" }, "api_key_id": { "type": [ "string", "null" ], "format": "uuid", "description": "The API key that owns the endpoint (the one that created it, or the key it\nwas rotated to). Only that key can see and manage the endpoint.\n" }, "secret_rotated_at": { "type": [ "string", "null" ], "format": "date-time" }, "canonical_signing_enabled": { "type": "boolean", "description": "`true` when `X-OH-Signature` is signed with your raw `whsec_` secret (the\ndocumented algorithm). `false` only for an endpoint created while the\nsecret vault was unavailable; rotate its secret to enable it.\n" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } } }, "WebhookEndpointCreate": { "type": "object", "description": "Any other member is refused (`422`, `errors[].code` = `unknown_field`).", "required": [ "name", "url", "event_types" ], "additionalProperties": false, "properties": { "name": { "type": "string", "minLength": 1 }, "url": { "type": "string", "format": "uri", "description": "An `https://` URL on a public address. Private, loopback, link-local and\nreserved addresses — and names that do not resolve, such as `*.invalid` — are\nrefused (`422`, `url_not_publicly_routable`). Deliveries go over IPv4: the\nhost needs an `A` record (an `AAAA`-only host is accepted, but every delivery\nto it fails).\n" }, "event_types": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "Event types to receive, from the [event catalogue](https://developers.officehero.io/docs/webhooks/events).\nAn unknown type is a `422` (`unknown_event_type`, listed in `unknown_event_types`).\nYour key must hold the read scope of every type's family — e.g.\n`int:fin.invoices:read` for `fin.invoice.*` — or the answer is `403`\n(`missing_scope`, `missing_scopes`). `[\"*\"]` (every event) and families with no\nread endpoint need `int:*`.\n" }, "pinned_version": { "type": "string", "format": "date", "description": "The `OH-Version` to send with deliveries. Defaults to the oldest supported version." } } }, "WebhookEndpointCreated": { "description": "The new endpoint plus its signing secret, shown this once. Store it now.", "allOf": [ { "$ref": "#/components/schemas/WebhookEndpoint" }, { "type": "object", "required": [ "secret" ], "properties": { "secret": { "type": "string", "pattern": "^whsec_", "description": "The signing secret. It is never shown again; rotate it if you lose it." } } } ] }, "WebhookEndpointList": { "type": "object", "description": "All of your endpoints. This list is not paginated (an account has at most a handful).", "required": [ "data" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEndpoint" } } } }, "WebhookEndpointUpdate": { "type": "object", "description": "Send only the fields you want to change; any other member is refused (`422`,\n`unknown_field`). `event_types` follows the same rules as on create and cannot\nbe empty. Changing `url` or `event_types` withdraws the endpoint's permission\nto receive personal data — ask support to enable it again.\n", "additionalProperties": false, "properties": { "name": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "event_types": { "type": "array", "minItems": 1, "items": { "type": "string" } }, "pinned_version": { "type": "string", "format": "date" } } }, "WebhookSecretRotation": { "type": "object", "description": "The new secret, shown this once. `X-OH-Signature` uses it from the next\ndelivery on; update your receiver straight away.\n", "required": [ "secret", "secret_prefix", "secret_rotated_at" ], "properties": { "secret": { "type": "string", "pattern": "^whsec_" }, "secret_prefix": { "type": "string" }, "secret_rotated_at": { "type": [ "string", "null" ], "format": "date-time" } } }, "WhistleblowingHandlerTrainingEventData": { "type": "object", "description": "The `data` of `compliance.whistleblowing.handler_training_due`.", "properties": { "handler_user_id": { "type": "string", "description": "Id of the handler user." }, "role": { "type": "string" }, "last_trained_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When last trained — RFC 3339, UTC." }, "days_since_training": { "type": [ "integer", "null" ] }, "reminder_threshold_days": { "type": "integer", "description": "A number of days." }, "detected_at": { "type": "string", "format": "date-time", "description": "When detected — RFC 3339, UTC." } }, "required": [ "handler_user_id", "role", "last_trained_at", "days_since_training", "reminder_threshold_days", "detected_at" ] }, "WhistleblowingReportEventData": { "type": "object", "description": "The `data` of `compliance.whistleblowing.report.acknowledged`, `compliance.whistleblowing.report.handler_assigned`, `compliance.whistleblowing.report.received`, `compliance.whistleblowing.report.sla_breached`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "anonymous": { "type": "boolean" }, "reporter_employee_id": { "type": [ "string", "null" ], "description": "Id of the reporter employee." }, "channel": { "type": "string" }, "category": { "type": "string", "description": "The category the record was filed under in OfficeHero." }, "status": { "type": "string", "description": "The record's status after the change." }, "received_at": { "type": "string", "format": "date-time", "description": "When received — RFC 3339, UTC." }, "acknowledged_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When acknowledged — RFC 3339, UTC." }, "sla_breached_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When sla breached — RFC 3339, UTC." }, "handler_employee_ids": { "type": "array", "items": { "type": "string" } }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." } }, "required": [ "id", "anonymous", "reporter_employee_id", "channel", "category", "status", "received_at", "acknowledged_at", "sla_breached_at", "handler_employee_ids", "created_at", "updated_at" ] }, "WorkOrder": { "type": "object", "description": "A maintenance or repair work order for a vehicle.", "required": [ "id", "tenant_id", "number", "vehicle_id", "vendor_id", "assigned_to", "status", "priority", "scheduled_at", "started_at", "completed_at", "cancelled_at", "total_cost_minor", "currency", "created_at", "updated_at" ], "properties": { "id": { "description": "Work order id.", "type": "string", "format": "uuid" }, "tenant_id": { "description": "Your tenant's id.", "type": "string", "format": "uuid" }, "number": { "description": "Work order number.", "type": [ "string", "null" ] }, "vehicle_id": { "description": "The vehicle being worked on.", "type": [ "string", "null" ], "format": "uuid" }, "vendor_id": { "description": "The workshop or vendor, if an external one does the work.", "type": [ "string", "null" ], "format": "uuid" }, "assigned_to": { "description": "The user the work is assigned to.", "type": [ "string", "null" ], "format": "uuid" }, "status": { "description": "`scheduled`, `assigned`, `in_progress`, `on_hold`, `completed` or `cancelled`.", "type": "string", "enum": [ "scheduled", "assigned", "in_progress", "on_hold", "completed", "cancelled" ] }, "priority": { "description": "Urgency.", "type": [ "string", "null" ], "enum": [ "low", "normal", "high", "critical", null ] }, "scheduled_at": { "description": "The scheduled date (midnight UTC).", "type": [ "string", "null" ], "format": "date-time" }, "started_at": { "description": "While the order is `in_progress`, the time it last changed; otherwise `null`.", "type": [ "string", "null" ], "format": "date-time" }, "completed_at": { "description": "When the work was completed.", "type": [ "string", "null" ], "format": "date-time" }, "cancelled_at": { "description": "When the order was cancelled (the time of its latest change).", "type": [ "string", "null" ], "format": "date-time" }, "total_cost_minor": { "description": "Total cost, in minor units of `currency`.", "type": [ "integer", "null" ] }, "currency": { "description": "ISO 4217 currency code.", "type": [ "string", "null" ], "pattern": "^[A-Z]{3}$" }, "created_at": { "description": "When the work order was created.", "type": "string", "format": "date-time" }, "updated_at": { "description": "When the work order last changed.", "type": "string", "format": "date-time" } }, "example": { "id": "0199c3a8-3c4d-7e5f-9a6b-7c8d9e0f1a07", "tenant_id": "0199c39f-1a2b-7c3d-8e4f-5a6b7c8d9e01", "number": "WO-2026-0153", "vehicle_id": "0199c380-4d5e-7f6a-8b7c-8d9e0f1a2b08", "vendor_id": "0199c381-5e6f-7a7b-9c8d-9e0f1a2b3c09", "assigned_to": "0199c382-6f7a-7b8c-8d9e-0f1a2b3c4d10", "status": "in_progress", "priority": "high", "scheduled_at": "2026-09-15T00:00:00Z", "started_at": "2026-09-15T07:10:00Z", "completed_at": null, "cancelled_at": null, "total_cost_minor": 50500, "currency": "EUR", "created_at": "2026-09-12T14:02:11Z", "updated_at": "2026-09-15T07:10:00Z" } }, "WorkOrderEventData": { "type": "object", "description": "The `data` of `fm.work_order.assigned`, `fm.work_order.cancelled`, `fm.work_order.completed`, `fm.work_order.created`, `fm.work_order.started`.", "properties": { "id": { "type": "string", "description": "The record's id (a UUID).", "format": "uuid" }, "tenant_id": { "type": "string", "description": "Your company's id — the same as the envelope's `tenant.id`.", "format": "uuid" }, "number": { "type": [ "string", "null" ], "description": "A human-readable number or reference, as shown in OfficeHero or by the authority." }, "vehicle_id": { "type": [ "string", "null" ], "description": "Id of the vehicle.", "format": "uuid" }, "vendor_id": { "type": [ "string", "null" ], "description": "Id of the vendor." }, "assigned_to": { "type": [ "string", "null" ] }, "status": { "type": "string", "description": "The record's status after the change." }, "priority": { "type": [ "string", "null" ], "description": "A level such as `low`, `medium`, `high` or `critical`." }, "scheduled_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When scheduled — RFC 3339, UTC." }, "started_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When started — RFC 3339, UTC." }, "completed_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When completed — RFC 3339, UTC." }, "cancelled_at": { "type": [ "string", "null" ], "format": "date-time", "description": "When cancelled — RFC 3339, UTC." }, "total_cost_minor": { "type": [ "integer", "null" ], "description": "Total cost in minor units of `currency` (cents for EUR)." }, "currency": { "type": [ "string", "null" ], "description": "ISO 4217 currency code." }, "created_at": { "type": "string", "format": "date-time", "description": "When created — RFC 3339, UTC." }, "updated_at": { "type": "string", "format": "date-time", "description": "When updated — RFC 3339, UTC." }, "previous": { "description": "The fields that changed, with their values before the change. On `*.updated` events; an empty diff is sent as `[]`, and some payloads omit the key when nothing changed.", "oneOf": [ { "type": "object", "additionalProperties": true }, { "type": "array", "maxItems": 0 } ] } }, "required": [ "id", "tenant_id", "number", "vehicle_id", "vendor_id", "assigned_to", "status", "priority", "scheduled_at", "started_at", "completed_at", "cancelled_at", "total_cost_minor", "currency", "created_at", "updated_at" ] }, "WorkOrderPage": { "type": "object", "description": "One page of work orders, newest first.", "required": [ "data", "next_cursor", "has_more" ], "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/WorkOrder" } }, "next_cursor": { "type": [ "string", "null" ], "description": "Pass as `cursor` to get the next page. `null` on the last page." }, "has_more": { "type": "boolean", "description": "Whether another page exists." } } } } } }