Developer portal

Event types

Every event type QEHS emits via webhooks, with payload schema, emitting conditions, and a sample payload. Subscribe to any combination from Settings → Webhooks.

All events share a common envelope: eventId, event, tenantId, firedAt, and a data object specific to the event type. Deliveries are HMAC-signed, see the webhooks docs for signature verification.

Event	Summary	Fires when
record.created.v1	A record was created in a module.	On successful record creation — via the QEHS UI, REST API, bulk import, or a public intake form submission.
record.updated.v1	One or more fields on a record were changed.	After any save that mutates field values on an existing record. Fires once per save, not once per changed field.
record.transitioned.v1	A record advanced between workflow states.	After all workflow guards pass and the state machine advances. Not fired if a guard rejects the transition.
record.deleted.v1	A record was soft-deleted.	On any deletion that sets deletedAt — GDPR deletion workflow or an admin delete action. Hard deletes (purge) fire record.purged.v1 instead.
module.published.v1	A Composer module version was published to production.	When a super-admin or tenant admin publishes a Composer draft, making it the active version for all users.
user.provisioned.v1	A new user was added to the tenant.	On SCIM POST /Users, self-sign-up invitation acceptance, or admin-created user — any path that creates a new tenant membership.
user.deprovisioned.v1	A user was removed from the tenant.	On SCIM DELETE /Users, admin disable, or offboarding workflow completion. User record is soft-deleted; audit trail is preserved.
attachment.uploaded.v1	An attachment was uploaded and passed virus scanning.	After the signed-URL upload completes and the async virus scan clears. Not fired if the scan flags the file.
export.completed.v1	An async export job finished and a download is ready.	When a tenant data export or evidence bundle job reaches the succeeded state. The downloadUrl is pre-signed and expires after 24 hours.
billing.subscription.updated.v1	The tenant plan, seat count, or trial state changed.	On plan upgrade/downgrade, seat count change, trial activation, or trial expiry. Scoped to tenant-owner role. Not fired for per-feature-flag toggles.
webhook.test.v1	Synthetic test event fired from the webhook settings UI.	Manually, when an admin clicks "Send test" on a configured webhook endpoint. Use to verify your receiver parses the envelope correctly.

Versioning policy

Additive changes (new optional fields, new enum values) stay on the current version. Structural changes (field removal, rename, type narrowing, required-flag flip) create a new version, for example record.created.v2. Subscribers opt in to the new version by updating the event name on their webhook; the old version keeps firing until they migrate. Deprecation gives at minimum 6 months notice.

Delivery envelope

{
  "eventId":  "11111111-2222-3333-4444-555555555555",  // unique per delivery attempt
  "event":    "record.created.v1",                      // fully-qualified event name
  "tenantId": "00000000-1111-2222-3333-444444444444",   // tenant that owns the resource
  "firedAt":  "2026-04-18T12:34:56.000Z",               // ISO-8601 UTC emission time
  "data": { ... }                                        // event-specific payload
}