Partners

Inbound event from partner (user.created, user.deleted)

Partner-to-AgentTax event channel. Body is JSON; the event type is carried in X-AgentTax-Event.

Authentication is HMAC over the raw body (the partnerProvisioningKey scheme does NOT apply here):

  • X-AgentTax-Partner: partner slug (e.g. invoica).
  • X-AgentTax-Signature: t=<unix-seconds>,v1=<hex>. v1 = HMAC-SHA256(secret, body). ±5 min clock skew tolerance.
  • X-AgentTax-Nonce: 8-128 char unique-per-request token. Replay-rejected if seen within the tolerance window.
  • X-AgentTax-Event: one of user.created, user.deleted.

The response NEVER returns the API key — partner must call /partner/provision directly to obtain credentials. This prevents credential leakage via webhook replay attacks.

post/api/v1/partner/webhook

Request

  • Base URL: https://www.agenttax.io
  • URL: https://www.agenttax.io/api/v1/partner/webhook
  • Auth: API key in header X-AgentTax-Signature

Headers

x-agenttax-partnerstring required
Example:invoica
x-agenttax-signaturestring required

HMAC-SHA256 of the raw body, formatted as t=<unix-seconds>,v1=<hex>.

Example:t=1714060800,v1=4f2e3d…
x-agenttax-noncestring required

Unique per-request nonce. Replay-rejected if seen within the 5-minute tolerance window.

x-agenttax-event'user.created' | 'user.deleted' required

Inbound event type. Carried in X-AgentTax-Event header. Body is event-specific; see request schemas below.

Request body

OR

Response

Event processed. Body never returns an api_key — call /partner/provision for credentials.

oktrue required
event'user.created' | 'user.deleted' required

Inbound event type. Carried in X-AgentTax-Event header. Body is event-specific; see request schemas below.

partner_user_idstring
agenttax_account_idstring
already_provisionedboolean
foundboolean
already_deletedboolean
entity_idstring

Changes

No recorded changes to this operation across all 1 revision of this API.