---
title: "Agent account graduated to production"
method: POST
path: "agent.graduated"
---

# Agent account graduated to production

`POST agent.graduated` (webhook)

Sent once when an agent account is promoted to full production (a verified account that is not suspended). After this, the agent may mint a full `sk_live_` key. Delivered to the agent's `default_callback_url`. Outbound POST to the merchant's callback URL, signed with `X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256>` where the HMAC is computed over `"${t}.${raw body}"` with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use `data.event_id` to deduplicate. Respond with any 2xx quickly to acknowledge.

## Headers

- `X-DePix-Signature` string, required
- `X-DePix-Event-Id` string, required

## Payload

- object: Envelope of the agent.graduated event.
  - `event` 'agent.graduated', required: Event name — fixed for this webhook.
  - `data` AgentGraduatedWebhookData, required: agent.graduated event payload. Emitted once, when an agent account is promoted to full production (the account got verified — for an agent, by proving a domain — and the account is not suspended). NEVER contains a key — a webhook is not a secret channel.
    - `username` string, required: The agent account's username (also its public affiliate code).
    - `graduated_at` string, required: Graduation timestamp (RFC 3339 UTC, 'YYYY-MM-DDTHH:MM:SS.sssZ').
    - `event_id` string, required: Stable delivery id (evt_*) — identical across retries of the same event; use it for deduplication. Also sent as the X-DePix-Event-Id header.

## Acknowledgement `200`

Any 2xx acknowledges the delivery; anything else (or a timeout) schedules a retry.

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)