Webhook events

An event is the record of something that happened in the organization — a token created, a token revoked. When you register an endpoint, you select the events it wants to receive; each time one of them happens, Magic Dashboard sends a delivery to the endpoint.

Available events

Today the events available for webhooks are those of API tokens:

Event	When it happens
api_key.db.created	A token was created — including the new token of a rotation, which carries predecessor_id.
api_key.db.updated	A token's data changed: name, description, expiration, notice emails or status.
api_key.db.deleted	A revoked token was removed from the list.
api_key.status_changed	A token's status changed (active, disabled or revoked).
api_key.rotated	A token was rotated. It carries successor_id and grace_until, the end of the period during which the old token is still valid.
api_key.revoked	A token was revoked.

These events happen when tokens are managed in Magic Dashboard itself (see API tokens). Tokens created in the Kobana Account don't generate events here.

Payload format

Every event arrives in the same envelope, in JSON with snake_case fields:

{
  "id": "9f8b2c14-3a5d-4e77-9b10-2c6e5f0a1d33",
  "type": "api_key.status_changed",
  "created_at": "2026-10-05T10:30:00.000Z",
  "data": { },
  "changes": {
    "status": { "from": "active", "to": "disabled" }
  },
  "environment": "production",
  "version": "2026-03-01"
}

Field	What it is
id	The event ID. Use it to avoid processing the same event twice.
type	The event, such as api_key.status_changed.
created_at	When the event happened, in ISO 8601 (UTC).
data	The resource in its current state, in the same format as the API.
changes	Only in *.status_changed events: what changed, in the format {"field": {"from": old, "to": new}}.
environment	The environment that sent it, such as production or sandbox.
version	The payload format version. New fields may appear; treat them as optional.

The event sent by Test Webhook has type equal to test.webhook and a data with a test message. It is for checking the connection and the signature; don't treat it as a real event.

The full reference — headers, signature and code examples — is in the API webhooks reference.