Requirement created
Sent when a requirement opens: an owner’s identity document, a service-order form, or something Clemta asked for (a company-name change, extra information). The request body is the event resource whose data.object is the requirement. Fulfill it over the API or hand your client a hosted link. Verify the Clemta-Webhook-Signature header before trusting the payload, and respond with any 2xx to acknowledge.
Authorizations
Your API key, e.g. Authorization: Bearer clmt_test_. Live keys use the clmt_live_ prefix.
Body
Entity name. Identifies this object when it arrives without its URL.
event Identifier of the event.
^evt_[0-9A-Za-z]{22}$"evt_0346sFPEvSkJvY8vt14NNw"
What happened, e.g. company.created, company.status.changed, company.verified. Branch on this. New types may be added over time, so treat an unrecognized one as informational rather than an error.
The event's payload: the resource the event is about, embedded as of when the event occurred. This is a point-in-time snapshot, not a live read - a delivery that arrives late still carries the state that triggered it.
False for an event recorded in a test-key stream.
When the fact the event describes occurred, ISO 8601 - the Standard Webhooks envelope field. Usually identical to created_at, because events are recorded in the same transaction as their change. Where a truer stamp exists it is used instead and can PRECEDE created_at: company.incorporated carries the incorporation stamp itself, which can predate when the event was recorded, and calendar.reminder carries the remind moment. Filter and page by created_at (the record clock). Read timestamp for when it happened. The time of a delivery ATTEMPT is a third thing and never appears in the payload - it is the webhook-timestamp header, fresh on every retry.
When the event was recorded.
The company the event is about, when it is about one.
^cmp_[0-9A-Za-z]{22}$Response
Acknowledged. Any 2xx marks the delivery received and stops retries.