Events · People and access
app.revoked
App authorization revoked
An employee authorization for an OAuth app was revoked (data.app: id, name; data.authorization_id, data.user_id, data.scopes; data.reason: user | admin | app_deleted).
- Object type
- app
- Delivered to
- Endpoints with the admin role
Payload
idstringrequiredEvent ID (
evt_…), also sent as thewebhook-idheader. Use it to drop duplicate deliveries.typestringrequiredAllowed values:
app.revokedcreated_atstring (date-time)requiredWhen the change happened (UTC).
org_idintegerrequiredapi_versionstringrequiredContract version of the
dataschema.sequenceintegerDelivery sequence number within the endpoint (absent for a test event).
payloadstringrequiredthinmeans nodata: read the object through the API.Allowed values:
fullthindataobjectFields
appobjectrequiredThe app: ID and name.
Fields
idstringnamestring
authorization_idintegerrequiredThe employee authorization.
user_idintegerrequiredThe employee who authorized the app.
scopesarray of stringrequiredScopes of the authorization.
reasonstringrequireduser,adminorapp_deleted.
testbooleanrequiredA test event sent by
POST /v1/webhooks/{webhook_id}/test.
Example delivery
{
"id": "evt_0123456789abcdef0123456789abcdef",
"type": "app.revoked",
"created_at": "2026-10-24T10:00:03Z",
"org_id": 1,
"api_version": "1.62.0",
"sequence": 1042,
"object": {
"type": "app",
"id": "app_8f14e45fceea167a5a36dedd4bea2543"
},
"payload": "full",
"data": {
"app": {
"id": "app_8f14e45fceea167a5a36dedd4bea2543",
"name": "CRM sync"
},
"authorization_id": 12,
"user_id": 7,
"scopes": [
"cards:read",
"search"
],
"reason": "user"
},
"test": false
}Receiving events
Each delivery is a POST request with this JSON body to your endpoint. Verify the webhook-signature header (Standard Webhooks) before you trust the body, answer with a 2xx status within a few seconds, and do the work afterwards. Deliveries to one endpoint keep the order of events; a failed delivery is retried with growing pauses.
New event types and new fields can appear at any time: skip the types and fields you do not know.