Payloads

The headers and JSON body Imploy sends with each webhook delivery.

Imploy sends an HTTP POST with a JSON body to your destination URL. Every request has these headers:

Header	Meaning
`X-Imploy-Event-Id`	A unique id for this delivery.
`X-Imploy-Timestamp`	When the request was sent, as a Unix timestamp.
`X-Imploy-Signature`	The signature, as `sha256=value`. See Verifying signatures.
Your secret header	Sent only if you set one.

Body

If a delivery carries one event, the body is that event. If it carries several, the body is a batch:

{
  "version": 1,
  "event_id": "0f1e2d3c-0000-0000-0000-000000000000",
  "event": "batch",
  "events": [ { "event": "client.created" } ],
  "is_test": false
}

An event looks like this:

{
  "version": 1,
  "event_id": "0f1e2d3c-0000-0000-0000-000000000000",
  "event": "client.created",
  "occurred_at": "2026-01-01T00:00:00+00:00",
  "organisation_id": 1,
  "resource": { "kind": "clients", "id": 123 },
  "changed_fields": [],
  "status": "Active",
  "is_test": false,
  "data": {
    "id": 123,
    "first_name": "Example Client",
    "last_name": "Smith",
    "client_type": "NDIS",
    "status": "Active"
  },
  "company_details": {
    "organisation_id": 1,
    "app_id": 1,
    "unique_name": "example-organisation",
    "business_name": "Example Care"
  },
  "related": {
    "clients": [],
    "staff": [],
    "locations": [],
    "forms": [],
    "sites": []
  }
}

Event fields

Field	Meaning
`event`	The event name, such as `client.created`.
`event_id`	A unique id for this event.
`occurred_at`	When the change happened.
`organisation_id`	Your organisation's id.
`resource`	The record that changed: its kind and id.
`changed_fields`	The fields that changed. Empty for created and deleted events.
`status`	The record's status, when it has one.
`is_test`	`true` only for a test delivery.
`data`	The record's fields. Long values may be shortened, and any shortened field is listed in `truncated_fields`.
`company_details`	Your organisation's id, app id, unique name and business name.
`related`	Linked records that are included, such as the client or staff on an appointment.

data carries only the fields Imploy chooses to share. Sensitive values such as passwords, tokens, bank details and signatures are never included.

Was this page helpful?