---
title: "Send a mock insurance ref-data webhook"
method: POST
path: "/v1/webhook/insurance-ref-data/mock-request"
tags: ["webhook"]
---

# Send a mock insurance ref-data webhook

`POST /v1/webhook/insurance-ref-data/mock-request`

## Request

- Base URL: `https://api-developer-sandbox.zocdoc.com`
- URL: `https://api-developer-sandbox.zocdoc.com/v1/webhook/insurance-ref-data/mock-request`
- Auth: one of:
  - OAuth 2
    - Client credentials
    - Token URL: `https://auth.zocdoc.com/oauth/token`
  - OAuth 2
    - Authorization code: `https://auth.zocdoc.com/authorize`
    - Token URL: `https://auth.zocdoc.com/oauth/token`

**Sandbox only.** Sends one signed sample insurance reference-data
notification to the `webhook_url` you supply, signed with the
`webhook_key` you supply, and returns the notification it sent. Verify
the signature against the raw bytes your endpoint received, not against
this response: its key order and null fields can differ from the signed body.

Use it to verify your signature check and your parsing of
`changed_entities` before Zocdoc starts delivering real notifications.
The sample carries fixed sandbox plan and carrier ids and a fixed
`event_id`; only `event_time_utc` varies per call.

Pass `event_type` to choose which notification to receive. It defaults to
`insurance_plans_updated`.

A `200` means Zocdoc sent the request, not that your endpoint accepted it.
Whatever status your endpoint returns is not reflected here — check your own
logs for how it handled the delivery.

## Request body

- InsuranceRefDataWebhookMockDataRequest
  - `webhook_url` string, required: A public `https` url to receive the mock webhook request. Redirects are not followed.
  - `webhook_key` string, required: a valid key for the signature in base64 format
  - `event_type` 'insurance_plans_updated' | 'insurance_carriers_updated': Which insurance reference-data entity changed. Every entry in `changed_entities` on a notification shares the notification's type.

## Response `200`

The notification that was sent.

- InsuranceRefDataWebhookNotification: The body Zocdoc `POST`s to your registered insurance reference-data webhook url when plans or carriers change. One notification batches several changed entities of the same `event_type`. Delivery is **at-least-once**: you may receive the same entity more than once, including after a delivery your endpoint already acknowledged. Dedup on the entity id (`insurance_plan_id` / `insurance_carrier_id`), not on `event_id`, and treat handling as idempotent — re-reading the entity from `GET /v1/insurance_plans` is always safe.
  - `event_id` string, required: Correlation id for this delivery, format `evt_<32 hex characters>`. Useful when reporting a delivery to Zocdoc support. **Not a dedup key** — it is derived from the event type, your client, and the set of entities in the delivery, so a redelivery that batches the entities differently carries a different id, and two integrations receiving the same change see different ids. Dedup by entity id instead.
  - `event_type` 'insurance_plans_updated' | 'insurance_carriers_updated', required: Which insurance reference-data entity changed. Every entry in `changed_entities` on a notification shares the notification's type.
  - `event_time_utc` string, instant, required: When Zocdoc emitted the notification, in UTC.
  - `changed_entities` InsuranceChangedEntity[], required: The entities that changed. Always contains at least one entry, and is bounded per notification, so a large upstream change arrives as several notifications rather than one large body.
    - `insurance_plan_id` string: Present on `insurance_plans_updated` notifications only.
    - `insurance_carrier_id` string: Present on `insurance_carriers_updated` notifications only.
    - `changed_attributes` InsuranceChangedAttribute[], required: What changed on this entity. Only fields exposed by the public reference-data endpoints appear here; a change confined to Zocdoc-internal fields produces no notification at all.
      - `attribute_path` string, required: Dot-notation path indicating which reference-data field changed. Allowed values: `insurance_plan.name`, `insurance_plan.status`, `insurance_plan.network_type`, `insurance_plan.program_type`, `insurance_plan.care_categories`, `insurance_plan.coverage_area`, `insurance_plan.carrier`, `insurance_carrier.name`. Treat an unrecognised path as "refetch the entity" rather than an error — new paths are added as new fields become public.

## Other responses

- `400`: Bad request — the url is malformed, not https, resolves to a non-public address or could not be reached, or the key is not valid base64.
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found — this endpoint exists only in Sandbox.

---

[API](https://skmtc.dev/zocdoc/apis/zocdoc-bundle-api.md) - [All operations](https://skmtc.dev/zocdoc/apis/zocdoc-bundle-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zocdoc/apis/zocdoc-bundle-api/revisions/965a6ca4ed12?raw)