payroll_export.created
A payroll file was made from a period's approved, locked timesheets, in the Console or through the API. Download it from /payroll-exports/{payroll_export_id}/file with the attendance:payroll scope; its SHA-256 is on the object.
Agoo sends this as a signed POST to every enabled endpoint subscribed to payroll_export.created (or *). Verify the
signature, return any 2xx within 15 seconds, and de-duplicate on webhook-id.
webhook-id*stringThe event's ID. It is the same on every attempt and redelivery, so use it to de-duplicate.
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$"evt_01m4ww0ezgf2bryg9gxb2gbewx"webhook-timestamp*stringWhen this attempt was signed, in Unix seconds. Reject the request if it is more than 5 minutes from your clock.
^[0-9]+$webhook-signature*stringOne or more space-separated signatures, each v1,<base64>: the base64 HMAC-SHA256 of
{webhook-id}.{webhook-timestamp}.{raw body}, keyed with the base64-decoded part of your whsec_ secret.
During a secret rotation there are two. Accept the request if any one matches.
application/json- body
An event about a payroll export.
id*EventIdThe event's ID. Webhook deliveries send it as webhook-id.
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$"evt_01m4ww0ezgf2bryg9gxb2gbewx"created_at*stringWhen the event happened.
date-timeorganisation_id*OrganisationIdAn organisation ID (TypeID with the org prefix).
^org_[0-7][0-9a-hjkmnp-tv-z]{25}$"org_01kjpsrza0etzb0a4vf72x8ang"livemode*booleanfalse for events in test mode.
type*"payroll_export.created""payroll_export.created"data*Return any 2xx status within 15 seconds to acknowledge the event. Agoo ignores the response body, so
acknowledge first and do slow work afterwards.
Example Requests
/payroll_export.createdtimesheet.approved Webhook
A timesheet was approved by its last step (or by Agoo, or through the API) and is locked: its days and totals don't change until someone reopens it. This is the event a payroll integration reads hours from. A private type of leave (sick and maternity by default) is counted as `away`. Agoo sends this as a signed `POST` to every enabled endpoint subscribed to `timesheet.approved` (or `*`). Verify the signature, return any `2xx` within 15 seconds, and de-duplicate on `webhook-id`.
timesheet.reopened Webhook
An approved timesheet was reopened with a reason: it's unlocked, its days are worked out again and it goes back through the approval steps. Take back any hours you read from it. A private type of leave (sick and maternity by default) is counted as `away`. Agoo sends this as a signed `POST` to every enabled endpoint subscribed to `timesheet.reopened` (or `*`). Verify the signature, return any `2xx` within 15 seconds, and de-duplicate on `webhook-id`.