Webhook event catalog

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 14, 2026

Atlas delivers signed webhooks (Svix-style) for the events below. Every delivery is signed — verify the signature before trusting it — and carries a stable id you should dedupe on (at-least-once delivery). Payload envelope:

{
  "type": "user.created",
  "object": "event",
  "id": "evt_…",
  "timestamp": 1789412514613,
  "data": { "object": "user", "id": "user_…", "...": "the resource" }
}

Failed deliveries retry on a schedule; you can inspect the delivery log and manually redeliver from the dashboard (per endpoint). Subscribe per-event-type or to everything.

User & auth

Event	Fires when
`user.created`	a user is created (sign-up, BAPI, or import)
`user.updated`	profile / metadata / email changes
`user.deleted`	a user is deleted (PII purge follows on the §GDPR schedule)
`user.banned` / `user.unbanned`	a user is banned / unbanned
`user.suspended` / `user.unsuspended`	a policy directive suspends / lifts (cross-property)

Sessions

Event	Fires when
`session.created`	a session is issued (sign-in complete)
`session.pending`	a sign-in is mid-flow (e.g. awaiting a second factor)
`session.revoked`	a session is explicitly revoked (per-session or revoke-all)
`session.ended`	a session ends normally (sign-out / expiry)
`session.removed`	a session record is removed

Policy (cross-property host contract)

Event	Fires when
`policy.imposed`	a directive is imposed on a user (suspend / read-only / forced-logout) — lands cross-property in seconds

Organizations & B2B

Event	Fires when
`organization.created` / `.updated` / `.deleted`	org lifecycle
`organizationMembership.created` / `.updated` / `.deleted`	membership + role changes
`organizationInvitation.created` / `.accepted` / `.revoked`	invitation lifecycle
`organizationDomain.created` / `.updated` / `.deleted`	verified email-domain (auto-join) lifecycle

Roles & permissions (RBAC)

Event	Fires when
`role.created` / `.updated` / `.deleted`	custom role changes
`permission.created` / `.updated` / `.deleted`	permission changes

Enterprise (SSO / SCIM)

Event	Fires when
`ssoConnection.created` / `.updated` / `.deleted`	per-org SAML/OIDC connection changes
`scimToken.created` / `scimToken.revoked`	a per-org SCIM bearer is minted / revoked

Messaging & billing & waitlist

Event	Fires when
`email.created` / `sms.created`	an outbound email / SMS is dispatched
`subscription.created` / `.updated` / `.deleted`	billing subscription lifecycle (from the signature-verified Stripe webhook)
`waitlistEntry.created` / `.updated`	waitlist signups

Verifying a delivery

Read the signature header and verify with your endpoint's signing secret (Svix scheme).
Dedupe on event.id.
Switch on type; data.object names the resource shape.

Reject anything that fails signature verification — never trust an unsigned body.

Was this page helpful?