---
title: "Something changed in a workspace you subscribed to"
method: POST
path: "mutation"
---

# Something changed in a workspace you subscribed to

`POST mutation` (webhook)

Delivered at least once, so deduplicate on the payload's `id`, which is the mutation id and is stable across retries. Verify `x-indraft-signature` before trusting the body: it is `t=<unix seconds>,v1=<hex>` where the hex is an HMAC-SHA256 of `<t>.<raw body>` under your endpoint's signing secret, which is shown once when the endpoint is registered. The timestamp is inside the signed material, so a captured delivery cannot be replayed later with a fresh one. Compare in constant time, and reject a timestamp far from your own clock. Respond 2xx to acknowledge; anything else is retried with backoff.

## Payload

- object
  - `id` string, required
  - `operation` 'advance_opportunity' | 'configure_watch' | 'advance_custom_record' | 'archive' | 'restore' | 'archive_custom_record' | 'cancel_task' | 'update_task' | 'complete_task' | 'configure_custom_field' | 'configure_exchange_rate' | 'configure_object_type' | 'configure_pipeline' | 'configure_workspace' | 'set_standing_override_policy' | 'confirm' | 'create_opportunity' | 'create_task' | 'erase_subject' | 'link_contact_company' | 'merge_companies' | 'merge_contacts' | 'merge_object_records' | 'record_interaction' | 'revert_change' | 'unmerge' | 'update_opportunity' | 'upsert_company' | 'upsert_contact' | 'upsert_custom_record', required
  - `outcome` 'created' | 'updated' | 'matched' | 'archived' | 'merged' | 'reverted' | 'noop', required: What the write did. `noop` means it was accepted and changed nothing, because every value it carried already matched what was stored. IT IS NOT METERED: a noop does not count against your monthly change allowance, so a nightly sync that finds nothing new costs nothing. Neither does a write that only REDUCES what a workspace holds. `matched` means an upsert found an existing record on real identity evidence rather than creating a second one; `reverted` and `merged` are the undo and duplicate paths, and both are ordinary writes that count.
  - `targetType` string, required
  - `targetId` string, required
  - `actorId` string, required
  - `accessPath` 'rest' | 'mcp' | 'app' | 'system', required
  - `attributionLabel` string, required
  - `assertionKind` 'observed' | 'inferred' | 'imported' | 'user_supplied', required
  - `occurredAt` string, required
  - `changes` object[], required
    - `objectType` string, required
    - `objectId` string, required
    - `field` string, required
    - `before` unknown
    - `after` unknown

## Acknowledgement `200`

Acknowledged. Anything outside 2xx is retried.

---

[API](https://skmtc.dev/indraft/apis/indraft-api.md) · [All operations](https://skmtc.dev/indraft/apis/indraft-api/llms.txt) · [OpenAPI document](https://skmtc.dev/indraft/apis/indraft-api/revisions/d9bb05346d66?raw)