pass.* events

A pass holder tapped their invite link and their join request is now held.

When this fires

A holder tapped their invite link for a dated window that has not opened yet. The platform holds the join request, and Subscriby records that they are queued: they will be admitted automatically the moment the window opens, whether or not they are at their phone.

This is the moment a buyer stops being a risk, and it is the one thing about a pass that a creator can still act on beforehand.

Bought is not the same as queued. A purchase and a queued request are different events with different follow-up. Someone who bought but never tapped is relying on noticing a message on the day; someone queued needs nothing at all. Everything in the product that nudges a pass holder (the reminder ladder, the creator's roll call, the manual Send Reminders button) targets the first group and skips the second.

Caveats

  • This fires per join request, not per purchase. A season-ticket holder queues separately for each of their dates, so one series purchase produces at least one of these per date they tap, often spread over weeks, because the link for the next date is sent in the message that ends the previous one. A plan with more than one gated resource produces one per resource they tap, all carrying the same window_id.
  • It does not fire when someone taps a link for a window that is already open. That is an immediate admission, not a queued request, and arrives as member.resource_added.
  • A holder who never taps produces no event at all. Absence is the signal; see pass.holder_missed for the other end of that.
  • Re-queuing does re-emit. The handler re-stamps the queue time and fires this event again on every join request it receives, so treat subscription_id + window_id as the idempotency key on your side.

Related events

  • pass.holder_missed: a holder whose window closed without them joining.
  • pass.window_opened: the moment held requests are approved.
  • member.resource_added: the per-resource grant that follows.
postWebhookpass.holder_queued

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'pass.holder_queued' required

The event name, always pass.holder_queued here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.