group.* events

A group is renamed or its permission set replaced.

When this fires

A group is renamed, or the permissions attached to it are replaced. Who is in the group is a separate event, group.members_synced, because the two changes have different consequences. A rename is cosmetic; changing the permission set silently re-scopes everyone already in the group.

Caveats

  • The permission set is not in the payload, so this event tells you a group changed without telling you into what. Read the group endpoint for the current permissions.
  • Permissions replace, they do not merge. An update that sends permissions sets them to exactly that list, so everyone in the group can gain and lose access in the same event.
  • code is immutable, so a rename never breaks a reference held elsewhere.
  • Membership is untouched here. See group.members_synced.

Related events

  • group.members_synced: who is in the group changed.
  • group.created: predecessor.
  • group.deleted: terminal state.
postWebhookgroup.updated

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'group.updated' required

The event name, always group.updated here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.