group.* events

The set of people in a group changed, with the deltas.

When this fires

The membership of a group is replaced and the result differs from what was there before, via the group members endpoint or the dashboard's group editor.

A group carries permissions, so who is in it decides who can do what. Until this event existed, renaming a group announced itself with group.updated while changing who it granted access to announced nothing at all; an integration mirroring access control could see the label change and miss the membership.

A no-op sync is silent. Syncing the same set that is already there emits nothing. This event means the membership actually moved, so receiving one always implies at least one id in added_ids or removed_ids.

Why the deltas are in the payload

An access-control mirror needs to know who lost the group, and diffing two snapshots on the far side is work it should not have to do: it requires having stored the previous state, and gets the answer wrong the first time it sees a group. added_ids and removed_ids are computed where the truth is, from the membership read immediately before the write and the list written immediately after it.

member_ids is still there for consumers that would rather replace their copy than apply a patch. Both are consistent with each other.

Caveats

  • This is a replace, not an add. Anyone absent from the request is removed. An empty list empties the group.
  • Permissions are not in the payload. What the group grants is a property of the group, not of this event; read it from the group endpoint if your mirror needs the effective permission set.
  • Users, not projects. A group clusters collaborators. It is not a way to bundle projects.
  • Removal from a group does not remove anyone from the team.

Related events

  • group.updated: the group was renamed or re-permissioned.
  • group.created: predecessor.
  • group.deleted: terminal state; everyone loses what it granted at once.
postWebhookgroup.members_synced

Headers

SB-Signaturestring required

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Idstring required

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Namestring required

The event name, the same as the envelope's type.

Content-Typestring required

Always application/json.

User-Agentstring required

Always Subscriby-Webhooks/1.0.

Payload

idstring required

A ULID unique to the event, prefixed evt_. Every retry carries the same id, so it is the key to deduplicate on.

type'group.members_synced' required

The event name, always group.members_synced here.

created_atstring date-time required

When the event was emitted, server time, ISO 8601.

api_versionstring required

The contract version of the payload shape, 2026-05-01 today. A breaking change to a shape ships under a new version.

project_idstring uuid nullable required

The project the event belongs to; null for team-scoped and billing events.

Response

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.