token.auth_failed

POST

A request presented an expired or revoked access token.

• Signed with Standard Webhooks (the headers below). Verify the signature over the raw body before parsing it — the recipes are in the developer docs’ Webhooks guide.
• Answer any 2xx within 20 s. Anything else, or no answer, is retried: 8 attempts over about 21 h.
• 410 Gone disables the webhook.

Parameters

Header Parameters

webhook-id

required

string

The delivery id — equal to the body’s id. Dedupe on it (delivery is at-least-once).

Example

WD000001

webhook-timestamp

required

string

Unix seconds when this attempt was signed. Refuse one more than 5 minutes from now (a replay).

Example

1790380800

webhook-signature

required

string

Space-separated v1,<base64> HMAC-SHA256 signatures of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with the base64-decoded part of the secret after whsec_. Two during a rotation’s 24 h grace.

Example

v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

X-TasksMate-Event

required

string

The event type (the body’s type), for routing before parsing.

Example

task.updated

User-Agent

required

string

Identifies TasksMate’s sender.

Example

TasksMate-Webhooks/1

Request Body^required

Media typeapplication/json

WebhookEvent

One webhook delivery’s JSON body. Verify the signature over the raw bytes first (Standard Webhooks; the developer docs’ Webhooks guide has the recipe); delivery is at-least-once, so deduplicate on id.

object

id

required

Id

The delivery id — the same as the webhook-id header (a replay keeps the original’s)

string

type

required

Type

The event: one of the webhooks keys of this document (task.updated, …), or webhook.test for a test send

string

api_version

required

Api Version

The subscription’s API version (the date the body’s shape is pinned to)

string

created_at

required

Created At

When the event happened (the audit row’s time)

string format: date-time

org_id

required

Org Id

string

project_id

required

Any of:

string

string

null

null

actor

required

WebhookActor

Who caused the event.

object

kind

required

Kind

user, service_account (acting through an access token) or system.

string

id

required

Any of:

string

string

null

null

username

required

Any of:

string

string

null

null

data

required

WebhookEventData

What changed: the audit row’s scrubbed diff — never a whole resource, never a secret.

object

resource_type

required

Resource Type

task, project, member, invite, organization, team, webhook, …

string

resource_id

required

Resource Id

The resource’s id — read it with the API for the full object

string

before

required

Any of:

object

object

key

additional properties

any

null

null

after

required

Any of:

object

object

key

additional properties

any

null

null

request_id

required

Any of:

string

string

null

null

Example

{
  "id": "WD000001",
  "type": "token.auth_failed",
  "api_version": "2026-09-25",
  "created_at": "2026-09-25T12:00:00Z",
  "org_id": "O0020",
  "project_id": null,
  "actor": {
    "kind": "user",
    "id": "406670f1-c819-4d27-9552-1747c551cf5c",
    "username": "ada"
  },
  "data": {
    "resource_type": "token",
    "resource_id": "TK142713",
    "before": {
      "name": "Before"
    },
    "after": {
      "name": "After"
    }
  },
  "request_id": "9b2f1c1e-8c1a-4a53-9f9e-0f5f1f2d7c11"
}

Responses

410

Gone — TasksMate disables the webhook and stops sending

2XX

Received — any 2xx within 20 s ends the delivery