Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

An API key (utk_live_...) or an app's OAuth access token (uto_...).

Headers

webhook-id
string
required

The message id (the body's id); the same on every retry and resend.

webhook-timestamp
integer
required

Unix seconds when this attempt was signed.

webhook-signature
string
required

Standard Webhooks: v1, then the base64 HMAC-SHA256 of "{webhook-id}.{webhook-timestamp}.{body}" with the whsec_ secret (decoded). During a secret rotation two signatures, space separated.

X-Usertick-Event
string

The event, as in the body's type.

X-Usertick-Attempt
integer

1 for the first try; retries count up.

Body

application/json

The body of response.status_changed and response.classification_corrected.

id
string
required

The message id: the same value as the webhook-id header, kept on every retry and resend.

type
enum<string>
required
Available options:
response.status_changed,
response.classification_corrected
createdAt
string<date-time>
required

When the change was made.

Example:

"2026-09-30T10:00:00.000Z"

data
object
required

The Response resource as it reads now, with what changed.

Example:

Response

2XX

Received.