Webhook: tokens revoked

POST

Sent to your website’s webhook address (set it in the console) when agent tokens for your site stop working: the person revoked the agent, its company disabled it or rotated its key, or you cut it off. End every session you made from one of token_ids (the tokenId the site SDK gives you). Expired tokens are included, since a session can outlive its token.

Signed in the Standard Webhooks format: webhook-id (the event id, the same on every retry), webhook-timestamp (Unix seconds) and webhook-signature (v1, then base64 HMAC-SHA256 of id.timestamp.body, keyed with the base64 bytes after whsec_ in your secret). Refuse timestamps more than 5 minutes off. The site SDK’s receiveWebhook does all of this. Answer 2xx; anything else is retried after 30 s, 2 min, 10 min, 1 h, 6 h and 24 h.

Request Body^required

Media typeapplication/json

object

id

required

string

type

required

string

Allowed value: tokens.revoked

created_at

required

integer

data

required

object

site

required

Your origin (the tokens’ audience).

string

token_ids

required

Array<string>

person

required

object

id

required

The tokens’ sub.

string

agent

required

object

id

required

string

name

required

string

operator

required

string

reason

required

string

Allowed values: person_revoked agent_disabled agent_key_rotated site_blocked_agent session_ended

revoked_at

required

integer

Responses

200

Received.