Developers · Partner Event Delivery
Receipt lifecycle events
Learn when your partner-bound receipt was issued, is nearing expiry, was revoked, or became invalid—without receiving private evidence.
Notifications, not grants
A lifecycle webhook is not a grant. Verify HMAC, re-fetch the current public receipt, then verify it with Partner Kit before any named partner action.
Event types
- receipt.issued
- receipt.expiring
- receipt.revoked
- receipt.invalidated
Safe envelope
- Opaque event_ref, event type, occurred time, policy/version, validity class, expiry when applicable.
- must_reverify is always true. is_grant is always false.
- HMAC uses the existing Partner Event Delivery signing headers.
- Retries reuse the same idempotency key. A revoked or invalidated receipt cannot become valid through replay.
Holder withdrawal
When a holder withdraws a shared result, that partner receives a terminal revoked event. Derived partner-bound receipts receive an invalidated event. Partners never receive evidence.
Expiry scheduling
Webhook dispatch is scheduled in vercel.json. Expiry notices require configured scheduling of /api/cron/receipt-lifecycle-sweep. That sweep is not listed in the deployed cron set. receipt.expiring never implies the receipt is still valid.
Partner workflow
- Verify webhook HMAC. Validate X-Abraxas-Webhook-Signature on your server. Reject unsigned or stale events.
- Re-fetch the public receipt. Use the receipt reference to GET the current public receipt. The webhook body is not the receipt.
- Verify with Partner Kit. Call Partner Kit verification and evaluate currently_valid on your backend before any named action.
- Apply only the named action. A delivered event never authorizes access, payment, trade, or Production activation by itself.