pass_series.* events

Someone bought a season ticket and their whole slate was issued.

When this fires

A Pass Series was bought, or comped with an access code, and every date on the slate has been written into the buyer's ledger. They hold all of them from this moment; there is nothing further to claim.

This fires in addition to subscription.activated. A series is a subscription row, so a purchase emits both. An endpoint subscribed to the two receives two deliveries for one purchase and must de-duplicate on subscription_id. That is not a quirk to work around: subscription.activated is what you want for revenue, and this is what you want for the slate. They answer different questions about the same event.

Caveats

  • passes_granted + passes_already_held = passes_total. Buying a date you already own is allowed on purpose; it is de-duplicated at grant time rather than refused, and the buyer is told so on their timeline. A non-zero passes_already_held is normal, not an error.
  • passes_total counts what this buyer received, which on a mid-season purchase is fewer than the slate holds: dates that have already run are never issued. Read the plan if you need the full slate length.
  • The span is the series', not this buyer's. starts_at and ends_at are the plan's cached slate span, so on a mid-season purchase starts_at can precede every date the buyer actually holds. Only the passes_* counts are buyer-scoped.
  • A series absorbing new dates later does not re-emit this. That is pass_series.leg_added.

Related events

  • subscription.activated: the same purchase as revenue. De-duplicate on subscription_id.
  • pass_series.leg_completed: one date of this slate finishing.
  • pass_series.completed: the final date finishing.
  • pass_series.seats_exhausted: when a purchase takes the last seat.
postWebhookpass_series.purchased

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'pass_series.purchased' required

The event name, always pass_series.purchased here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.