Events and payload
Every event type a HotCodePush webhook can deliver, grouped by object, and the JSON payload each one carries with its snapshot of the object.
A webhook subscribes to event types by name, object.action, such as release.created. These are the 45 types it can deliver, with what each one's snapshot carries beside the object's fields.
The rest stay in the audit log and are never delivered: the sign-in and password types, organization.created and organization.limit_overridden, the payment, SSO provider and subscription creation types, and the telemetry export and webhook types themselves. A webhook cannot subscribe to its own deliveries.
Event types
What each type means is in the audit log's table. This page adds the snapshot each one carries.
App
| Type | In the snapshot |
|---|---|
app.created | name, defaultChannelId |
app.deleted | name, lifetimeReleaseCount |
app.restored | deletedForDays |
app.transferred | fromOrganizationId, toOrganizationId, direction (out or in) |
app.updated | the changed fields |
Binary
| Type | In the snapshot |
|---|---|
binary.created | platform, version, build, fingerprint, trigger (create or force) |
binary.expired | platform, version, lastSeenAt |
Bundle
| Type | In the snapshot |
|---|---|
bundle.deleted | number, sizeBytes |
bundle.expired | number, sizeBytes, unusedSince |
bundle.uploaded | number, platforms, version, fingerprint, sizeBytes, isSigned, the git facts |
Channel
| Type | In the snapshot |
|---|---|
channel.created | name, isProtected, isDiscoverable, expiresAt, the auto-pause policy |
channel.deleted | name, releaseCount |
channel.expired | name, expiresAt |
channel.paused | pausedAt |
channel.resumed | pausedForSeconds |
channel.updated | the changed fields |
Device
| Type | In the snapshot |
|---|---|
device.deleted | platform, binaryVersion, lastSeenAt |
Invitation and member
| Type | In the snapshot |
|---|---|
invitation.accepted | role, invitedBy |
invitation.created | email, role |
invitation.revoked | email, role |
member.joined | role, providerType, invitationId |
member.removed | role |
member.role_changed | previousRole, role |
Organization
The organization events are the set for an ops channel: the spending cap, the storage limit, fair use and dormancy.
| Type | In the snapshot |
|---|---|
organization.deleted | ageDays, lifetimeReleaseCount, wasPaying |
organization.dormancy_noticed | lastDeviceReportAt, lastSignInAt |
organization.fair_use_warning | dimension, value, limit, month |
organization.restored | deletedForDays |
organization.spending_cap_changed | previousCapCents, capCents, effectiveFrom |
organization.spending_cap_reached | monthlyActiveDeviceCount, capCents, cappedAt |
organization.spending_cap_warning | monthlyActiveDeviceCount, capCents, thresholdPercent |
organization.storage_limit_reached | storageBytes, storageBytesLimit |
organization.storage_limit_warning | storageBytes, storageBytesLimit |
organization.updated | the changed fields |
Release
| Type | In the snapshot |
|---|---|
release.created | number, trigger (create, from_channel or rollback), bundleId, rolloutPercentage, isMandatory, conditions, hasProgression, isSigned, framework, isDefaultChannel, bundleSizeBytes |
release.failure_rate_exceeded | failureRatePercent, failureThresholdPercent, appliedUpdateCount, topFailureReasons |
release.paused | actor, and from auto-pause reason, failureRatePercent (failed over applied updates), appliedUpdateCount, topFailureReasons |
release.resumed | pausedForSeconds |
release.revoked | actor, reason, deviceCount, and from auto-pause the failure fields above |
release.rollout_changed | previousRolloutPercentage, rolloutPercentage, trigger (person or progression) |
release.updated | the changed fields |
Signing key and subscription
| Type | In the snapshot |
|---|---|
signing_key.created | fingerprint |
signing_key.deleted | fingerprint |
subscription.cancellation_scheduled | reason, comment, endsAt, daysSinceSignup |
subscription.ended | nothing |
subscription.uncanceled | daysSinceSignup |
The payload
A raw delivery posts the event as JSON with Content-Type: application/json:
| Field | What it is |
|---|---|
id | Holds the event's id, and the delivery's id for the test event. It is the key to deduplicate on. |
type | Holds the event's type, release.created. |
createdAt | Holds when the event happened, ISO 8601 in UTC. |
organizationId | Names the organization. |
appId | Names the app, or is null for an organization event. |
objectId | Holds the id of the release, channel, bundle or other object the event is about. |
actorType | Is user for a person, system for an automatic action such as auto-pause or channel expiry. |
userId | Names the acting user, or is null for the system. |
snapshot | Holds the object's fields at the moment of the event, per the tables above. |
{
"actorType": "user",
"appId": "7a1f0c2e-5b7d-4e5a-9f3a-2c8d1e4b6a90",
"createdAt": "2026-10-20T14:03:12.481Z",
"id": "c4d9e0b1-2f3a-4b5c-8d6e-7f8091a2b3c4",
"objectId": "e5f6a7b8-c9d0-4e1f-a2b3-c4d5e6f7a8b9",
"organizationId": "0b1c2d3e-4f50-4617-8293-a4b5c6d7e8f9",
"snapshot": {
"bundleId": "9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a",
"bundleSizeBytes": 4823119,
"conditions": [],
"framework": "capacitor",
"hasProgression": false,
"isDefaultChannel": true,
"isMandatory": false,
"isSigned": true,
"number": 42,
"rolloutPercentage": 10,
"trigger": "create"
},
"type": "release.created",
"userId": "1f2e3d4c-5b6a-4798-8a9b-0c1d2e3f4a5b"
}The payload is additive-only: a field is added, never renamed or removed, so a receiver that ignores unknown fields keeps working. No payload carries data about a single device: the snapshot holds the object's fields, never a device and never a bundle's file list. A raw delivery is signed. Signature and retries has the check.
Last updated on