Skip to main content
WEBHOOK

Headers

Palm-Signature
string
required

HMAC-SHA256 signature of {timestamp}.{body} using the endpoint secret, as t={timestamp},v1={signature}.

Example:

"t=1736937000,v1=5f1c0a8d2b6e4c3f9a7d8e1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d"

Palm-Webhook-Id
string
required

Identifier of the endpoint receiving the delivery.

Example:

"d8f3a621-9c47-4b58-8e02-5a1d7f4c9b36"

Palm-Event-Type
string
required

The event type, duplicated from the body for routing.

Example:

"user.removed"

Body

application/json

A person was removed from your portfolio. data.object is the user as it stands after the change. Status is deleted.

id
string
required

Unique identifier for this event, prefixed evt_. Use it to de-duplicate deliveries.

Example:

"evt_1768473000000_65547cfe82d9"

object
enum<string>
required

Always event.

Available options:
event
type
enum<string>
required

The event type.

Available options:
user.removed
created_at
string<date-time>
required

When the event occurred.

Example:

"2026-01-15T10:30:00.000Z"

mode
enum<string>
required

Whether the event was produced in test or live mode. Matches the endpoint it is delivered to.

Available options:
test,
live
data
object
required

Response

2XX

Return any 2xx status to acknowledge receipt. Any other status, a redirect, or no response within 10 seconds counts as a failed delivery and is retried.