Webhooks

cabinet.affected

POST to your registered URL when a stored cabinet item is affected. Join member_id to your user locally. We never send your inbound member id. Optional: most tenants never subscribe.

postWebhookcabinetAffected

Headers

X-Pillwise-Signaturestring required

Example:t=1767225600,v1=0123456789abcdef

t=<unix seconds>,v1=<hex>: v1 is HMAC-SHA256 of <t>.<raw JSON body> using the full whsec_… secret shown at webhook create (prefix included). Refuse a t more than five minutes old.

Payload

type'cabinet.affected' required

tenant_idstring required

member_idstring uuid required

item_idstring uuid required

codesCodes required(unresolved $ref)

reason'recall.issued' required

recall_idstring required

graph_versionstring required

observed_atstring date-time required

Response

Received. Any 2xx is success.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.