Webhook events

User-editable profile fields changed (display name, time-zone, locale).

User uploaded or removed their profile picture.

Theme, notification, or accessibility preferences changed.

Per-channel notification preference (email, in-app) toggled.

A personal-access token was issued.

A personal-access token was revoked.

Sign-in alert preferences changed.

Daily aggregate of inbox-read activity (not per-row).

Bulk mark-as-read action against the inbox.

A workspace administrator exported the audit log.

A workspace administrator acknowledged a security alert.

An individual session was revoked.

All sessions for the user were revoked.

User enrolled a multi-factor method (legacy code; new flows emit ACCOUNT_MFA_DEVICE_ENROLLED).

A new authenticator app or hardware key was registered.

An enrolled device successfully completed a challenge.

User renamed an enrolled device.

An enrolled device was revoked.

A revoke attempt was blocked by the last-factor guard.

A new batch of recovery codes was generated.

A recovery code was redeemed for sign-in.

All MFA was disabled on the account.

Disabling MFA was blocked by tenant policy.

A legacy single-device enrollment was promoted to the multi-device model.

Workspace MFA policy was updated by an administrator.

MFA-required signal applied during sign-in.

A grace period was granted to enroll MFA.

An MFA grace period elapsed without enrollment.

The list of acceptable MFA factors was changed (e.g. phishing-resistant-only).

A passkey or hardware credential was registered.

A passkey successfully completed an assertion.

A passkey was renamed.

A passkey was revoked.

A revoke was blocked by the last-factor guard.

Passkey sign-in succeeded.

Passkey sign-in failed verification.

A passkey returned a sign counter that went backward — possible cloning.

Passkey enrollment was blocked by the workspace attestation policy.

A high-impact action requested a fresh-MFA proof.

Step-up challenge succeeded.

Step-up challenge failed.

A step-up token was redeemed twice — possible replay attempt.

A step-up attempt was blocked by tenant policy.

An identity provider was added.

An identity provider's configuration was changed.

An identity provider went live for sign-in.

An identity provider was paused.

An identity provider was deleted.

A SAML sign-in succeeded.

A SAML sign-in attempt was rejected.

A new user was just-in-time provisioned on first SAML sign-in.

A SCIM bearer token was issued.

A SCIM bearer token was revoked.

A user was provisioned via SCIM.

A user was updated via SCIM.

A user was deactivated via SCIM.

A user was reactivated via SCIM.

The workspace network policy (allowlist/blocklist) was changed.

A network rule was added.

A network rule was removed.

A request was blocked by the workspace network policy.

An administrator bypassed the network policy for a one-time action.

The workspace's WebAuthn attestation allowlist was changed.

A webhook subscription was created.

A webhook subscription was updated.

A webhook subscription was disabled.

A webhook subscription was deleted.

A webhook circuit breaker tripped after repeated failures.

A test event was delivered to a webhook endpoint.

Per-category retention windows were changed.

Daily retention prune cron completed; the metadata carries which categories pruned and how many rows fell out.

Daily retention prune cron failed.

The user requested a copy of their data.

A data export is ready to download.

A prepared data export was downloaded.

The user requested account erasure.

An administrator approved the erasure request.

An administrator rejected the erasure request.

An erasure request was cancelled before completion.

An erasure was fully completed.

Erasure could not complete because a module reported a regulatory retention hold.

An administrator overrode retention holds to force completion (10-year retention on this row per SOX § 802).

Completion was blocked because the completer is the same administrator who approved.

Completion was blocked because the cooling-off window had not yet elapsed.

An employee updated their HCM profile (preferred name, pronouns, emergency contact, etc.).

Employee updated their phone, address, or contact preferences.

Employee updated their self-identified demographics (gender, ethnicity, disability, veteran status).

Employee updated their emergency contact.

Employee submitted a time-off request.

A manager approved a time-off request.

A manager rejected a time-off request.

An employee cancelled a time-off request before completion.

An HR administrator adjusted a balance outside the accrual engine — always reviewed.

FMLA / CFRA eligibility evaluated against the rolling 12-month window.

An intermittent FMLA day was recorded against an active claim.

An employee viewed a pay slip.

An employee downloaded a pay slip as PDF.

An HR administrator voided a previously-issued pay slip — always reviewed.

An employee added a bank account to their direct-deposit allocation.

An employee removed a bank account from their direct-deposit allocation.

Direct-deposit percentage / flat-amount split changed.

NACHA prenote (zero-dollar test) sent to a new account.

NACHA prenote came back verified; account is live for direct deposit.

NACHA prenote was rejected by the bank; account stays disabled.

Employee opened the open-enrollment wizard.

Employee submitted their open-enrollment elections.

Employee filed a qualifying life event for mid-year change.

HR approved a life event with documentation review.

HR rejected a life event request.

COBRA continuation was offered after a qualifying event.

Former employee elected COBRA continuation.

FSA / HSA per-pay-period contribution amount changed.

An employee viewed their equity grant detail.

Grantee accepted an equity grant.

A scheduled vest tranche was recorded.

Grantee filed an IRS § 83(b) election — irrevocable, 30-day window from grant.

A W-2 / 1099 / T4 / 1095-C form was generated for an employee.

Employee gave IRS § 31.6051-1(j) electronic-delivery consent.

Employee viewed their year-end form.

Employee downloaded their year-end form.

Learner enrolled in a course.

Learner launched a cmi5 / xAPI course session.

A course completion was recorded (xAPI Completed verb).

A completion certificate was issued.

A learning badge was awarded to the learner.

Employee submitted an expense report.

Manager approved an expense report.

Manager rejected an expense report.

An expense report was reimbursed via payroll.

A line item violated the workspace's expense policy and was flagged for manager review.

An employee or manager created a new goal.

A goal's progress, weight, or due date changed.

A child goal was aligned to a parent goal in the alignment tree.

A goal was marked complete.

A 1:1 check-in series was created between a manager and an employee.

A 1:1 note was saved (shared or private).

A 360-feedback request was sent.

Anonymous 360-feedback was submitted (k-anonymity enforced; reveal blocked below the threshold).

Pulse-survey response submitted (k-anonymity floor n<5).

A calibration session was finalized by an HR administrator (4-eyes from the proposing manager).

Employee viewed their career-path readiness.

AI career-coach surface invoked (PII-anonymised before prompt).

A promotion was proposed during a calibration session.

A promotion was approved via the per-session promo cap.

Manager opened their approval-inbox dashboard.

Manager opened a team-analytics report.

Manager toggled between direct-reports-only and full-subtree scope.

A new employee was provisioned in HCM with their initial position, comp, and benefits class.

An employee's position, title, or reporting line was updated.

A leave of absence was opened (FMLA, military, sabbatical, personal).

A leave of absence ended; the employee returned to active status.

An employee was offboarded — equipment, access, payroll closeout, COBRA notice triggered.

A previously offboarded employee was rehired (history preserved per workspace policy).

A pay run was prepared from the period's time + earnings data; awaits HR review.

Pay slips were generated for the run; ACH file is queued but not yet transmitted.

Step-up-protected ACH transmission of the NACHA file to the bank. Money moves.

A previously-transmitted pay run was voided in part or whole — always reviewed.

A closed pay run was reopened for correction — emits a pair with a closing event.

A garnishment order was applied to a pay slip per CCPA / IRS Pub 1494 priority.

Frozen state tax tables (9 supported states) were refreshed against the publisher catalogue.

An employee's state W-4 was updated.

The reciprocity matrix routed withholding to the appropriate state.

An HR administrator overrode the SUTA rate for a state.

A year-end form-generation run was initiated for a tax year + jurisdiction.

AI reasonableness narrative + manual review completed against the run.

A year-end run was sealed (4-eyes SoD — different admin than the sealer transmits).

Step-up-protected transmission to SSA (EFW2) / IRS (FIRE) / CRA (Internet File Transfer).

A W-2c / 1099-COR / T4-amended correction was issued for an employee.

A pay band was created with min / midpoint / max + market reference.

A pay band's midpoint or range was changed.

Market-data refresh applied to comp bands.

A workspace-wide compensation-review cycle was initiated.

A manager submitted comp proposals for their team.

A comp-review calibration was finalized by HR (4-eyes from proposing manager).

An individual comp change was applied to a pay slip cycle.

A job requisition was opened.

A requisition completed its multi-step approval chain.

A requisition was closed (filled, cancelled, on-hold).

A candidate moved between recruiting stages.

An interviewer submitted a scorecard with rating + rationale.

A candidate was rejected with an EEOC-categorized reason + (optional) AI-assisted note.

An offer was extended to a candidate.

Candidate accepted the offer.

Candidate declined the offer.

A workflow draft was saved by an author.

A workflow draft was published (4-eyes SoD: author ≠ publisher).

A published workflow was deprecated; new runs use the successor version.

A workflow run started for a triggering event.

A workflow run completed successfully.

A workflow run failed; the failure detail is on the run history.

A solid-line reporting relationship changed.

A matrix (dotted-line) reporting edge was added.

A matrix reporting edge was removed.

A reorg simulation was run; results include risk delta + comp shift.

Step-up-protected reorg apply: bulk reporting changes committed under 4-eyes.

Structural risk (overwide span, excessive depth, rank padding, orphaned matrix) was flagged.

An EEO-1 report was generated for a reporting year.

An OFCCP Affirmative Action Plan was generated for a federal-contractor reporting year.

An employee requested an ADA workplace accommodation.

HR made a decision on an ADA accommodation request.

An I-9 record was created for a new hire.

Section 2 I-9 verification completed by HR.

A re-verification (work-permit renewal, etc.) was recorded.

Workspace DEI policy (k-anonymity floor, self-ID categories, reporting cadence) was updated.

DEI what-if simulation was run; outcomes never reveal individuals (k-anon enforced).

AI-assisted DEI narrative was generated for the admin review surface.

A new benefits plan (medical, dental, vision, FSA, etc.) was created.

A benefits plan's premiums, coverage rules, or eligibility changed.

An open-enrollment window was opened.

An open-enrollment window closed; mid-year change now requires a life event.

An ASC X12 834 (v005010X220A1) EDI file was generated for carrier transmission.

Step-up-protected transmission of the 834 file to the carrier.

COBRA election notice was sent to a qualifying event.

A course was published to the catalog.

A course was retired from the catalog.

A peer-authored course was submitted for review (4-eyes SoD).

A peer-authored course was approved (different reviewer than author).

Badge catalog was updated by an admin.

A signing template was drafted by an admin.

A template was activated (4-eyes SoD: drafter ≠ activator). Legally binding for new signers.

A document was delivered to the next signer in the chain.

A signer opened the document (IP + UA recorded).

A signer completed signing.

A signer declined to sign; chain terminates per template policy.

A signing role was reassigned to a different signer.

A time-off policy was created with an accrual method + caps + waiting period.

A time-off policy was updated.

Year-end carry-over processing ran for the workspace.