Event Types

Basis Theory emits an event for every operation listed on this page. The same event object is delivered to your webhook endpoints and returned when you Query Events through the API.

Structure of Events

Every event is one event object with the fields below. Webhooks deliver it inside a request body that adds delivered_at; see Webhook Delivery. Query Events returns the same objects in a paginated data array. Key order is not guaranteed on either channel and can differ from the samples on this page.

Event object

{
  "id": "e99b3bb9-25e4-484f-8a6d-6bc28edbbf39",
  "type": "<TYPE OF EVENT DEFINED BELOW>",
  "timestamp": "2024-04-09T13:56:37.864Z",
  "tenant_id": "869d5b1c-1ae8-4ce6-96c6-73a602b407ff",
  "trace_id": "0f777425-9080-4d82-b557-799f43aefcba",
  "data": {
    "EVENT-SPECIFIC-OBJECT": {...},
    "actor": {
      "id": "...",
      "type": "...",
      "name": "..."
    }
  }
}

Name	Type	Description
id	string	Unique identifier for the event
type	string	Type of event (see details below for each event)
timestamp	string	ISO 8601 timestamp of the reported operation. See Event timestamps.
tenant_id	string	Unique identifier for the tenant associated with the event
trace_id	string	Unique identifier for tracing this event across systems
data.EVENT-SPECIFIC-OBJECT	object	Object containing data specific to the event type. The keys under data vary by event, and each event's sample below shows them. Any event can also carry actor.
data.actor	object	(Optional) Information about the actor who triggered the event. Omitted when the actor is unknown.
data.actor.id	string	Unique identifier for the actor
data.actor.type	string	Type of the actor (application, user, admin, system)
data.actor.name	string	Name or identifier of the actor

Event timestamps

event.timestamp is the time of the operation the event reports. Events that create or change a resource carry the created_at, modified_at or updated_at value written by that same operation. Vulnerability events carry the time the vulnerabilities were discovered or the notification was sent. All other events, including invocation events such as proxy.invoked, http.request, reactor.invoked, reactor.completed and reactor.failed, carry the time the event was emitted.

Timestamps are ISO 8601 strings in UTC at millisecond precision with a Z suffix, for example 2026-10-15T08:00:00.123Z.

Optional fields and nulls

Nested properties with a null value are omitted from the payload, so a missing nested key means its value was null. The keys directly under data are always present and can be null, for example detokenization on proxy.invoked, device_info on http.request and error on an asynchronous reactor.failed. An object whose properties are all null is sent as {}, for example request_transform.response on a proxy.invoked event with no transform error. data.actor is omitted when the actor is unknown. Agentic Payments events are produced by a different service and keep nested null values, so actor.name can be null there.

Fields marked (Optional) in the tables below can be missing from a payload.

The individual data objects are defined below by type. The Events API filters events by exact data.<path> values, using the field names documented here.

3DS Sessions

The created, authenticated, updated, and challenge-result-retrieved events include the credential reference used by the session: session.token_id, session.token_intent_id, or session.network_token_id. Unused references are omitted. session.network_token_id identifies a network token created through POST /network-tokens. See 3DS credential references for the difference between these IDs.

Session Authenticated

3ds.session.authenticated

{
  "session": {
    "id": "...",
    "type": "...",
    "authentication_status": "...",
    "created_at": "...",
    "created_by": "...",
    "device": "...",
    "expires_at": "...",
    "token_id": "...",
    "card_brand": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.authentication_status	String	The status of the authentication.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The Application ID which created the session
session.device	String	The device used to create the session (browser or mobile).
session.expires_at	String	The expiration date of the session in ISO 8601 format.
session.token_id	String	(Optional) The ID of the card or network_token token referenced by this session.
session.token_intent_id	String	(Optional) The ID of the card or network_token token intent referenced by this session.
session.network_token_id	String	(Optional) The ID of the Basis Theory network token referenced by this session.
session.card_brand	String	The brand of the card associated with the session.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Challenge Result Retrieved

Emitted after a successful Get Challenge Result request retrieves and saves a new result. Reading an already stored result does not emit another retrieval event. This event is not an automatic timeout notification; your backend must initiate result retrieval, including when a completion notification is missing.

Treat webhook delivery separately from result retrieval. Use the HTTP response as the result of your request, and handle duplicate webhook deliveries idempotently.

3ds.session.challenge-result-retrieved

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "created_at": "...",
    "created_by": "...",
    "device": "...",
    "expires_at": "...",
    "token_id": "...",
    "card_brand": "...",
    "authentication_status": "...",
    "authentication_status_reason": "...",
    "challenge_cancel_reason": "...",
    "challenge_cancel_reason_code": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The Application ID which created the session
session.device	String	The device used to create the session (browser or mobile).
session.expires_at	String	The expiration date of the session in ISO 8601 format.
session.token_id	String	(Optional) The ID of the card or network_token token referenced by this session.
session.token_intent_id	String	(Optional) The ID of the card or network_token token intent referenced by this session.
session.network_token_id	String	(Optional) The ID of the Basis Theory network token referenced by this session.
session.card_brand	String	The brand of the card associated with the session.
session.authentication_status	String	(Optional) The status of the challenge result.
session.authentication_status_reason	String	(Optional) The reason for the authentication status.
session.challenge_cancel_reason	String	(Optional) The reason the challenge was cancelled. acs-timeout-request-not-received means the ACS never received the challenge request.
session.challenge_cancel_reason_code	String	(Optional) EMV numeric code for the challenge cancel reason.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Session Created

3ds.session.created

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "created_at": "...",
    "created_by": "...",
    "device": "...",
    "expires_at": "...",
    "network_token_id": "...",
    "card_brand": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The Application ID which created the session
session.device	String	The device used to create the session (browser or mobile).
session.expires_at	String	The expiration date of the session in ISO 8601 format.
session.token_id	String	(Optional) The ID of the card or network_token token referenced by this session.
session.token_intent_id	String	(Optional) The ID of the card or network_token token intent referenced by this session.
session.network_token_id	String	(Optional) The ID of the Basis Theory network token referenced by this session.
session.card_brand	String	The brand of the card associated with the session.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Session Updated

3ds.session.updated

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "created_at": "...",
    "created_by": "...",
    "device": "...",
    "expires_at": "...",
    "network_token_id": "...",
    "directory_server_id": "...",
    "card_brand": "...",
    "modified_by": "...",
    "modified_at": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant).
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The Application ID which created the session.
session.device	String	The device used to create the session (browser, app, or merchant).
session.expires_at	String	(Optional) The expiration date of the session in ISO 8601 format.
session.token_id	String	(Optional) The ID of the card or network_token token referenced by this session.
session.token_intent_id	String	(Optional) The ID of the card or network_token token intent referenced by this session.
session.network_token_id	String	(Optional) The ID of the Basis Theory network token referenced by this session.
session.directory_server_id	String	(Optional) The ID of the directory server associated with the session.
session.card_brand	String	The brand of the card associated with the session.
session.modified_by	String	(Optional) The ID of the actor that last updated the session.
session.modified_at	String	(Optional) The last update time of the session in ISO 8601 format.
session.metadata	Object	(Optional) A key-value map of strings containing custom data associated with the session.

Method Request Completed

3ds.session.method-completed

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Challenge Completed

Signals challenge completion, not successful authentication. session.authentication_status can be absent when the completion notification does not contain a mappable status. Preserve a known status, and use Get Challenge Result to retrieve the authorization data. A closed browser or app may never deliver this event; schedule backend recovery independently.

3ds.session.challenge-completed

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "authentication_status": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.authentication_status	String	Optional. The reported challenge status, such as successful or failed; omitted when the completion notification has no mappable status.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Decoupled Challenge Notification

3ds.session.decoupled-challenge-notification

{
  "session": {
    "id": "...",
    "type": "...",
    "tenant_id": "...",
    "metadata": { ... }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.type	String	The session type (customer or merchant)
session.tenant_id	String	The unique identifier of the Tenant associated with the session.
session.metadata	Object	A key-value map of strings containing custom data associated with the session.

Account Updater

Job Completed

account-updater.job.completed

{
  "job": {
    "id": "55256454-c9f9-4e79-bc9e-24bd38af5c21",
    "status": "completed"
  }
}

Name	Type	Description
job.id	String	The unique identifier of the job.
job.status	String	The current status of the job.

Job Created

account-updater.job.created

{
  "job": {
    "id": "55256454-c9f9-4e79-bc9e-24bd38af5c21",
    "status": "pending"
  }
}

Name	Type	Description
job.id	String	The unique identifier of the job.
job.status	String	The current status of the job.

Job Failed

account-updater.job.failed

{
  "job": {
    "id": "55256454-c9f9-4e79-bc9e-24bd38af5c21",
    "status": "failed"
  }
}

Name	Type	Description
job.id	String	The unique identifier of the job.
job.status	String	The current status of the job.

Agentic Payments

Agentic Payments events are triggered during the lifecycle of payment methods, allowances and payment credentials.

These events nest their fields under a fixed payload key on event.data, the same key for every event type rather than a key named after the resource, and include an actor identifying the application whose API key made the request. actor.name is null when the application name could not be resolved, and events triggered without an API key, such as a provider's browser callback, omit actor entirely.

Payment Method Created

agentic.payment-method.created

{
  "payload": {
    "payment_method_id": "...",
    "source_type": "...",
    "rails": ["...", "..."]
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.payment_method_id	String	The unique identifier of the payment method.
payload.source_type	String	The type of source the payment method was created from. Currently always basis_theory_card_token.
payload.rails	Array of Strings	The names of the rails that were provisioned, such as agentic-token or spt. A rail is listed even when its provisioning ended in error, so read the payment method to learn each rail's status before using it.

Payment Method Rail Retried

agentic.payment-method.rail.retried

{
  "payload": {
    "payment_method_id": "...",
    "rail": "...",
    "provider": "...",
    "status": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.payment_method_id	String	The unique identifier of the payment method.
payload.rail	String	The rail that was retried: agentic-token or spt.
payload.provider	String	The provider behind the rail: vic, agentpay or stripe.
payload.status	String	The rail's status after the retry: enabled, pending or error. A retry that failed again is delivered with status set to error, matching the error the API returned.

Payment Method Deleted

agentic.payment-method.deleted

{
  "payload": {
    "payment_method_id": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.payment_method_id	String	The unique identifier of the deleted payment method. The delete also cancels the payment method's allowances, and each cancellation publishes its own agentic.allowance.deleted event.

Allowance Created

agentic.allowance.created

{
  "payload": {
    "allowance_id": "...",
    "payment_method_id": "...",
    "amount": {
      "value": "...",
      "currency": "..."
    },
    "rails": [
      {
        "rail": "...",
        "provider": "...",
        "status": "..."
      }
    ]
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.allowance_id	String	The unique identifier of the allowance.
payload.payment_method_id	String	The unique identifier of the payment method the allowance was created against.
payload.amount.value	String	The amount the allowance authorizes, as a decimal string.
payload.amount.currency	String	The ISO 4217 currency code of the amount.
payload.rails	Array	One entry per allowance rail.
payload.rails[].rail	String	The rail name: agentic-token or spt.
payload.rails[].provider	String	The provider behind the rail: vic, agentpay or stripe.
payload.rails[].status	String	The rail's status: active, pending_verification or error. A rail in pending_verification requires verification before minting.

Allowance Updated

agentic.allowance.updated

{
  "payload": {
    "allowance_id": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.allowance_id	String	The unique identifier of the updated allowance. The event carries no diff, so read the allowance to learn what changed.

Allowance Rail Retried

agentic.allowance.rail.retried

{
  "payload": {
    "allowance_id": "...",
    "rail": "...",
    "provider": "...",
    "status": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.allowance_id	String	The unique identifier of the allowance.
payload.rail	String	The rail that was retried: agentic-token or spt.
payload.provider	String	The provider behind the rail: vic, agentpay or stripe.
payload.status	String	The rail's status after the retry: active, pending_verification or error. A retry that failed again is delivered with status set to error, matching the error the API returned.

Allowance Verification Completed

agentic.allowance.verification.completed

{
  "payload": {
    "allowance_id": "...",
    "rail": "...",
    "provider": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.allowance_id	String	The unique identifier of the allowance whose rail became active. Credentials can now be minted from this rail.
payload.rail	String	The verified rail: agentic-token or spt.
payload.provider	String	The provider behind the rail: vic, agentpay or stripe.

This event fires on whichever verification action reached active, for every provider's ceremony, so a backend can rely on it as the activation signal without knowing which ceremony the frontend drove.

Allowance Deleted

agentic.allowance.deleted

{
  "payload": {
    "allowance_id": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.allowance_id	String	The unique identifier of the cancelled allowance. No credential can be minted from it afterwards. This event is also published for each allowance cancelled by a payment method delete.

Payment Credential Created

agentic.payment-credential.created

{
  "payload": {
    "credential_id": "...",
    "allowance_id": "...",
    "rail": "...",
    "provider": "...",
    "format": "..."
  },
  "actor": {
    "id": "...",
    "type": "application",
    "name": "..."
  }
}

Name	Type	Description
payload.credential_id	String	The unique identifier of the payment credential.
payload.allowance_id	String	The unique identifier of the allowance the credential was minted from.
payload.rail	String	The rail the credential was minted on: agentic-token or spt.
payload.provider	String	The provider that issued the credential: vic, agentpay or stripe.
payload.format	String	The credential format: card, network-token, identifier or mpp.

The event marks that a mint committed allowance spend, which makes it a natural hook for ledger reconciliation. It deliberately carries neither the credential value nor the minted amount; the value is returned once in the API response and never again.

Apple Pay

Resource Created

apple-pay.created

{
  "apple_pay": {
    "id": "...",
    "type": "...",
    "status": "...",
    "ingest_source": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "..."
  }
}

Name	Type	Description
apple_pay.id	String	The unique identifier of the resource.
apple_pay.type	String	The type of the resource. See Token Types.
apple_pay.status	String	The status of the resource.
apple_pay.ingest_source	String	How the resource was ingested. device_decrypted for POST /apple-pay; stripe_forward for Stripe Forward.
apple_pay.created_by	String	The creator of the resource.
apple_pay.created_at	String	The creation date of the resource in ISO 8601 format.
apple_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.

Resource Deleted

apple-pay.deleted

{
  "apple_pay": {
    "id": "...",
    "type": "...",
    "status": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
apple_pay.id	String	The unique identifier of the resource.
apple_pay.type	String	The type of the resource.
apple_pay.status	String	The status of the resource.
apple_pay.created_by	String	The creator of the resource.
apple_pay.created_at	String	The creation date of the resource in ISO 8601 format.
apple_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.
apple_pay.modified_at	String	The modification date of the resource in ISO 8601 format.
apple_pay.modified_by	String	The user or application that modified the resource.

Resource Retrieved

apple-pay.retrieved

{
  "apple_pay": {
    "id": "...",
    "type": "..."
  }
}

Name	Type	Description
apple_pay.id	String	The unique identifier of the resource.
apple_pay.type	String	The type of the resource.

Resource Unlinked

apple-pay.unlinked

{
  "apple_pay": {
    "id": "...",
    "type": "...",
    "status": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
apple_pay.id	String	The unique identifier of the resource.
apple_pay.type	String	The type of the resource.
apple_pay.status	String	The status of the resource.
apple_pay.created_by	String	The creator of the resource.
apple_pay.created_at	String	The creation date of the resource in ISO 8601 format.
apple_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.
apple_pay.modified_at	String	The modification date of the resource in ISO 8601 format.
apple_pay.modified_by	String	The user or application that modified the resource.

Resource Updated

apple-pay.updated

{
  "apple_pay": {
    "id": "...",
    "type": "...",
    "status": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
apple_pay.id	String	The unique identifier of the resource.
apple_pay.type	String	The type of the resource.
apple_pay.status	String	The status of the resource.
apple_pay.created_by	String	The creator of the resource.
apple_pay.created_at	String	The creation date of the resource in ISO 8601 format.
apple_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.
apple_pay.modified_at	String	The modification date of the resource in ISO 8601 format.
apple_pay.modified_by	String	The user or application that modified the resource.

Applications

Application Created

application.created

{
  "application": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "...",
    "name": "...",
    "created_by": "...",
    "created_at": "...",
    "permissions": [
      "..."
    ],
    "rules": [
      {
        "description": "...",
        "priority": 1,
        "container": "...",
        "transform": "...",
        "conditions": [
          {
            "attribute": "...",
            "operator": "...",
            "value": "..."
          }
        ],
        "permissions": [
          "..."
        ]
      }
    ]
  }
}

Name	Type	Description
application.id	String	The unique identifier of the Application.
application.type	String	The type of the application.
application.name	String	The name of the application.
application.created_by	String	The user or application that created the application.
application.created_at	String	The creation date of the application in ISO 8601 format.
application.permissions	Array	An array of Permissions granted to the application
application.rules	Array	An array of Access Rules granted to the application
application.rules[].description	String	A description of the rule.
application.rules[].priority	Number	The priority level of the rule.
application.rules[].container	String	The container associated with the rule.
application.rules[].transform	String	The transform applied by the rule.
application.rules[].conditions	Array	List of conditions to be satisfied for the rule to be used. Only applies to sessions
application.rules[].conditions[].attribute	String	The attribute evaluated in the condition.
application.rules[].conditions[].operator	String	The operator used in the condition.
application.rules[].conditions[].value	String	The value to compare against in the condition.
application.rules[].permissions	Array	An array of permissions granted by the rule.

Application Updated

application.updated

{
  "application": {
    "id": "...",
    "name": "...",
    "type": "...",
    "permissions": [
      "..."
    ],
    "rules": [
      {
        "description": "...",
        "priority": 0,
        "container": "...",
        "transform": "...",
        "conditions": [
          {
            "attribute": "...",
            "operator": "...",
            "value": "..."
          }
        ],
        "permissions": [
          "..."
        ]
      }
    ],
    "created_at": "...",
    "created_by": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
application.id	String	The unique identifier of the Application.
application.name	String	The name of the application.
application.type	String	The type of the application.
application.permissions	Array	An array of Permissions granted to the application
application.rules	Array	An array of Access Rules granted to the application
application.rules[].description	String	A description of the rule.
application.rules[].priority	Number	The priority level of the rule (0 indicates the highest priority).
application.rules[].container	String	The container associated with the rule.
application.rules[].transform	String	The transform applied by the rule.
application.rules[].conditions	Array	List of conditions to be satisfied for the rule to be used. Only applies to sessions
application.rules[].conditions[].attribute	String	The attribute evaluated in the condition.
application.rules[].conditions[].operator	String	The operator used for the evaluation.
application.rules[].conditions[].value	String	The value to compare against in the condition.
application.rules[].permissions	Array	List of permissions granted on this Access Rule
application.created_at	String	The creation date of the application in ISO 8601 format.
application.created_by	String	The user or system that created the application.
application.modified_at	String	The last modified date of the application in ISO 8601 format.
application.modified_by	String	The last user or system that modified the application.

Application Deleted

application.deleted

{
  "application": {
    "id": "..."
  }
}

Name	Type	Description
application.id	String	The unique identifier of the application.

Application Keys

Application Key Created

application.key.created

{
  "application_key": {
    "id": "...",
    "application_id": "...",
    "version": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
application_key.id	String	The unique identifier of the application key.
application_key.application_id	String	The unique identifier of the associated Application.
application_key.version	String	The version of the application key.
application_key.created_at	String	The creation date of the application key in ISO 8601 format.
application_key.created_by	String	The user or application that created the application key.

Application Key Deleted

application.key.deleted

{
  "application_key": {
    "id": "...",
    "application_id": "..."
  }
}

Name	Type	Description
application_key.id	String	The unique identifier of the application key.
application_key.application_id	String	The unique identifier of the associated Application.

Enrichments

Bank Account Verification

token.bank-account.verified

{
    "token": {
        "id": "...",
        "type": "..."
    },
    "bank_account": {
        "status": "..."
    }
}

Name	Type	Description
token.id	String	The unique identifier of the token.
token.type	String	The token type
bank_account.status	String	The status of the bank account

Http

Request

http.request

{
  "request": {
    "method": "POST",
    "path": "/tokens",
    "headers": {
      "Host": [
        "localhost:5090"
      ],
      "Content-Type": [
        "application/json; charset=utf-8"
      ],
      "Content-Length": [
        "279"
      ],
      "BT-TRACE-ID": [
        "6f100e49-b64b-4747-9049-78d44f1ceb13"
      ],
      "BT-API-KEY": [
        "ke***f2 (length 75)"
      ]
    }
  },
  "response": {
    "status": 201,
    "headers": {
      "Content-Type": [
        "application/json; charset=utf-8"
      ],
      "Content-Length": [
        "633"
      ],
      "BT-TRACE-ID": [
        "6f100e49-b64b-4747-9049-78d44f1ceb13"
      ],
      "Date": [
        "Fr***MT (length 29)"
      ],
      "Server": [
        "*******"
      ],
      "Location": [
        "ht***3d (length 65)"
      ]
    }
  },
  "elapsed_ms": 12.345678,
  "device_info": null
}

Name	Type	Description
request.method	String	The HTTP method used for the request (e.g., POST).
request.path	String	The path of the request (e.g., /tokens).
request.headers	Object	A map of header name to a list of values for the headers included in the request. Infrastructure headers are removed and values outside an allowlist are masked.
request.headers.Host	Array	The host header of the request.
request.headers.Content-Type	Array	The content type of the request.
request.headers.Content-Length	Array	The length of the request body.
request.headers.BT-TRACE-ID	Array	The trace ID for tracking the request.
request.headers.BT-API-KEY	Array	The API key used for the request (partially masked).
response.status	Number	The HTTP status code returned in the response (e.g., 201).
response.headers	Object	A map of header name to a list of values for the headers returned in the response, filtered and masked like request.headers.
response.headers.Content-Type	Array	The content type of the response.
response.headers.Content-Length	Array	The length of the response body.
response.headers.BT-TRACE-ID	Array	The trace ID for tracking the response.
response.headers.Date	Array	The date header of the response (partially masked).
response.headers.Server	Array	The server information returned in the response (partially masked).
response.headers.Location	Array	The location header indicating where to find the resource (partially masked).
elapsed_ms	Number	The time taken to process the request in milliseconds. Can include a fractional part.
device_info	Object	The device information sent in the BT-DEVICE-INFO request header. null when the request did not include the header.
actor	Object	(Optional) The actor who made the request. See Structure of Events.

Proxies

Proxy Created

proxy.created

{
  "proxy": {
    "id": "...",
    "name": "...",
    "application_id": "...",
    "destination_url": "...",
    "require_authentication": ...,
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
proxy.id	String	The unique identifier of the proxy.
proxy.name	String	The name of the proxy.
proxy.application_id	String	The unique identifier of the associated Application.
proxy.destination_url	String	The destination URL that the proxy forwards requests to.
proxy.require_authentication	Boolean	Indicates whether authentication is required for the proxy.
proxy.created_at	String	The creation date of the proxy in ISO 8601 format.
proxy.created_by	String	The user or application that created the proxy.

Proxy Deleted

proxy.deleted

{
  "proxy": {
    "id": "..."
  }
}

Name	Type	Description
proxy.id	String	The unique identifier of the proxy.

Proxy Invoked

proxy.invoked

{
  "proxy": {
    "id": "...",
    "name": "...",
    "response": {
      "elapsed_ms": 120,
      "error": { ... },
      "status": 401
    },
    "type": "..."
  },
  "destination": {
    "request": {
      "body": "...",
      "headers": {
        "...": [
          "..."
        ]
      },
      "method": "...",
      "query": "",
      "url": "..."
    },
    "response": {
      "body": "...",
      "elapsed_ms": 105,
      "headers": {
        "...": [
          "..."
        ]
      },
      "status": 200
    }
  },
  "request_transform": {
    "response": {
      "error": { ... }
    }
  },
  "response_transform": {
    "response": {
      "error": { ... }
    }
  },
  "detokenization": {
    "expressions_substituted": 3
  },
  "request": { // DEPRECATED; Use `destination.request` instead
    "headers": { "...": ["..."] },
    "method": "...",
    "url": "..."
  },
  "response": { // DEPRECATED; Use `destination.response` instead
    "headers": { "...": ["..."] },
    "status_code": "...",
    "elapsed_ms": ...
  }
}

Name	Type	Description
proxy.id	String	The unique identifier of the proxy
proxy.name	String	The name of the proxy.
proxy.type	String	The type of the proxy.
proxy.response.error	Error	(Optional) Present when the invocation ended with an error or a custom response. See Proxy Invoked Errors.
proxy.response.elapsed_ms	Number	The total time taken for the proxy to respond, in whole milliseconds.
proxy.response.status	Number	(Optional) The HTTP status code returned to the caller of the proxy. Omitted when the proxy produced no response, for example when the caller disconnected before the proxy responded. See Events without a status or destination.
destination.request.body	String	(Optional) Sanitized body of the request sent to the destination. This is the output of a successful request transform. Omitted when empty. See Destination bodies.
destination.request.headers	Key:List of Strings	(Optional) An object containing the request headers sent to the destination. Omitted when the request was never forwarded.
destination.request.method	String	HTTP method used to call the destination. When the request was never forwarded, this is the method of the request the proxy received.
destination.request.query	String	(Optional) The URL query parameters. Omitted when the request was never forwarded.
destination.request.url	String	(Optional) The destination URL. Omitted when the request was never forwarded. See Events without a status or destination.
destination.response.body	String	(Optional) Sanitized body of the response from the destination when it returned a 2xx status. Omitted when empty or when the status is not 2xx. See Destination bodies.
destination.response.error	String	(Optional) Sanitized body of the response from the destination when the status is not 2xx, including 3xx. Omitted when empty or when the status is 2xx. See Destination bodies.
destination.response.elapsed_ms	Number	The length of time for the destination to respond. 0 when the request was never forwarded.
destination.response.headers	Key:List of Strings	(Optional) An object containing the response headers returned by the destination. Omitted when no response was received.
destination.response.status	Number	(Optional) The HTTP status code sent by the destination. Omitted when no response was received, whether the request timed out, the connection failed, or the request was never forwarded.
request_transform.response.error	Error	If the request transform fails. See below
response_transform.response.error	Error	If the response transform fails. See below
detokenization.expressions_substituted	Number	The number of expressions Basis Theory replaced with vaulted data in the request body. 0 when the request contained none. detokenization is null when no detokenization ran, for example when the request failed before it was forwarded. See Counted expressions.
request.headers	Key:List of Strings	(Deprecated) The headers included in the request.
request.method	String	(Deprecated) The HTTP method used for the request (e.g., GET, POST).
request.url	String	(Deprecated) The URL to which the request is sent.
response.headers	Key:List of Strings	(Deprecated) The headers returned in the response.
response.status_code	String	(Deprecated) The HTTP status code returned by the destination, as a string. "" when no response was received.
response.elapsed_ms	Number	(Deprecated) The time taken to process the request in milliseconds.

Events without a status or destination

A proxy.invoked event is emitted for every invocation, including ones that end before the proxy responds or before the request reaches the destination. Webhook consumers should treat the fields below as optional.

• No proxy.response.status: the proxy produced no response. The most common cause is a caller that disconnects while the request is still being processed, for example during a request transform. No status code was returned to the caller, so none is reported.
• No destination.request.url, destination.request.headers or destination.response.status: the request was never forwarded to the destination. This happens when the proxy rejects the request, when a request transform fails or returns a custom response, or when the caller disconnects before the request is forwarded. proxy.response.status and proxy.response.error describe what the caller received.

proxy.invoked when the caller disconnects during the request transform

{
  "proxy": {
    "id": "...",
    "name": "...",
    "response": {
      "elapsed_ms": 3224
    },
    "type": "pre-configured"
  },
  "destination": {
    "request": {
      "method": "GET"
    },
    "response": {
      "elapsed_ms": 0
    }
  }
}

The other blocks are left out of this example for brevity.

Destination bodies

destination.request.body, destination.response.body and destination.response.error are sanitized before delivery. In a JSON body, every scalar value is masked and null values are kept. In a form-urlencoded body, every value is masked. Any other body is masked as a single value. A body larger than 25 KB (25,600 bytes) is replaced in full by its first two characters followed by *** (length N), where N is the original length in bytes, for example {"*** (length 48213). Empty bodies are omitted.

The destination's response body is delivered in destination.response.body only when the destination returned a 2xx status. For any other status, including 3xx, it is delivered in destination.response.error and destination.response.body is omitted.

Counted expressions

expressions_substituted counts the expressions in the request body that Basis Theory replaced with vaulted data:

• Detokenization expressions, {{ <token_id> }} or {{ token: <token_id> }}
• Token intent expressions, {{ token_intent: <token_intent_id> }}
• Network token expressions, {{ network_token: <network_token_id> }}
• Apple Pay expressions, {{ apple_pay: <token_id> }}
• Google Pay expressions, {{ google_pay: <token_id> }}
• Encrypted expressions, {{ encrypted }}, optionally followed by filters

Configuration expressions, {{ config: <key> }}, are substituted but not counted, because they inject a value from the Proxy's own configuration rather than vaulted data. {{ proxy }} and {{ tokenize_transform: <id> }} expressions are evaluated at a different stage of the Proxy pipeline and are also not counted.

Only the request body is inspected. Expressions in request headers or in the destination URL are not counted.

Proxy Invoked Errors

proxy.response.error is the standard problem-details object with status, title, detail and errors, where title defaults to "One or more validation errors occurred." There are two exceptions. When a transform ended the request with a custom response, it is the custom response body itself. When a synchronous Reactor res response ended the request, it is a string containing that response's body.

request_transform.response.error and response_transform.response.error are either the standard problem-details object or a custom-response object with status, body and headers. status is the HTTP status the transform set and body is whatever the transform returned. headers maps each header name to a single string, unlike the other headers maps on this page, which map to a list of strings. Content-Length is removed.

Custom response bodies, in proxy.response.error and in the transform-level body, are delivered as the JSON the transform returned. The same body appears in both places: bare at proxy.response.error, and wrapped with its status and headers at the transform level. Objects, arrays, strings and numbers keep their structure at every depth. Any string value larger than 25 KB, including a header value in the custom-response object, is replaced by its first two characters followed by *** (length N), where N is the original length.

See Proxy Transform Error Handling and Reactor Error Handling.

Standard proxy error

"error": {
  "errors": {
      "error": [
          "MY-CUSTOM-API-KEY header is required"
      ]
  },
  "title": "One or more validation errors occurred.",
  "status": 401,
  "detail": "Authentication Failed"
}

Custom response in proxy.response.error

"error": {
  "myCustomError": "My custom error message"
}

Custom response in request_transform.response.error

"error": {
  "status": 400,
  "body": {
    "myCustomError": "My custom error message"
  },
  "headers": {
    "Custom-Response-Header-1": "custom-value-1",
    "Custom-Response-Header-2": "custom-value-2"
  }
}

Proxy Updated

proxy.updated

{
  "proxy": {
    "id": "...",
    "name": "...",
    "proxy_host": "...",
    "timeout": ...,
    "destination_url": "...",
    "require_authentication": ...,
    "client_certificate": "...",
    "created_at": "...",
    "created_by": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
proxy.id	String	The unique identifier of the proxy.
proxy.name	String	The name of the proxy.
proxy.proxy_host	String	The host address of the proxy server.
proxy.timeout	Number	(Optional) Custom timeout in seconds. Omitted when unset.
proxy.destination_url	String	The destination URL that the proxy forwards requests to.
proxy.require_authentication	Boolean	Indicates whether authentication is required for the proxy.
proxy.client_certificate	String	(Optional) The public client certificate, in PEM format, the proxy presents to the destination. The private key is never included. Omitted when unset.
proxy.created_at	String	The creation date of the proxy in ISO 8601 format.
proxy.created_by	String	The user or system that created the proxy.
proxy.modified_at	String	The last modified date of the proxy in ISO 8601 format.
proxy.modified_by	String	The last user or system that modified the proxy.

Proxy Vulnerabilities Discovered

proxy.vulnerabilities_discovered

{
  "proxy": {
    "id": "...",
    "name": "..."
  },
  "transform": {
    "type": "request"
  },
  "vulnerabilities": {
    "count": 2,
    "severity_summary": {
      "critical": 0,
      "high": 1,
      "medium": 1,
      "low": 0
    },
    "packages_affected": [
      "jsonwebtoken",
      "express"
    ]
  },
  "discovered_at": "2026-03-09T00:14:21Z"
}

Name	Type	Description
proxy.id	String	The unique identifier of the proxy.
proxy.name	String	The name of the proxy.
transform.type	String	The transform type where vulnerabilities were discovered (request or response).
vulnerabilities.count	Number	Total number of detected vulnerabilities.
vulnerabilities.severity_summary	Object	Severity breakdown of the detected vulnerabilities.
vulnerabilities.severity_summary.critical	Number	Number of CRITICAL vulnerabilities.
vulnerabilities.severity_summary.high	Number	Number of HIGH vulnerabilities.
vulnerabilities.severity_summary.medium	Number	Number of MEDIUM vulnerabilities.
vulnerabilities.severity_summary.low	Number	Number of LOW vulnerabilities.
vulnerabilities.packages_affected	Array	Distinct package names affected by vulnerabilities (up to 20 values).
discovered_at	String	ISO 8601 timestamp indicating when vulnerabilities were discovered.

Reactors

Reactor Completed

reactor.completed

{
  "reactor": {
    "id": "...",
    "name": "..."
  },
  "request": {
    "id": "...",
    "invocation_type": "..."
  },
  "elapsed_ms": ...
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
request.id	String	(Optional) The unique identifier of the request if the invocation_type is async. Can be used to retrieve the results of the invocation.
request.invocation_type	String	Either sync or async
elapsed_ms	Number	The time taken to process the request in milliseconds.

Reactor Created

reactor.created

{
  "reactor": {
    "id": "...",
    "name": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
reactor.created_at	String	The creation date of the reactor in ISO 8601 format.
reactor.created_by	String	The user or application that created the reactor.

Reactor Deleted

reactor.deleted

{
  "reactor": {
    "id": "..."
  }
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.

Reactor Failed

reactor.failed

{
  "reactor": {
    "id": "...",
    "name": "..."
  },
  "request": {
    "id": "...",
    "invocation_type": "..."
  },
  "error": { ... },
  "elapsed_ms": ...
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
request.id	String	(Optional) The unique identifier of the request if the invocation_type is async. Can be used to retrieve the results of the invocation.
request.invocation_type	String	Either sync or async
error	Any JSON value	The error that ended the invocation. Synchronous invocations carry a problem-details object with title, status, detail and errors, or {"title": "Reactor failed", "detail": "An unexpected error occurred"} for an unexpected failure. Asynchronous invocations carry whatever JSON the reactor returned, or null when it returned nothing. Reactor-returned error bodies are subject to the same 25 KB cap as proxy custom response bodies.
elapsed_ms	Number	The time taken to process the request in milliseconds.

Reactor Invoked

reactor.invoked

{
  "reactor": {
    "id": "...",
    "name": "..."
  },
  "request": {
    "id": "...",
    "invocation_type": "..."
  }
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
request.id	String	(Optional) The unique identifier of the request if the invocation_type is async. Can be used to retrieve the results of the invocation.
request.invocation_type	String	Either sync or async

Reactor Updated

reactor.updated

{
  "reactor": {
    "id": "...",
    "name": "...",
    "created_at": "...",
    "created_by": "...",
    "modified_by": "...",
    "modified_at": "..."
  }
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
reactor.created_at	String	The creation date of the reactor in ISO 8601 format.
reactor.created_by	String	The user or application that created the reactor.
reactor.modified_by	String	The last user or application that modified the reactor.
reactor.modified_at	String	The last modified date of the reactor in ISO 8601 format.

Reactor Vulnerabilities Discovered

reactor.vulnerabilities_discovered

{
  "reactor": {
    "id": "...",
    "name": "..."
  },
  "vulnerabilities": {
    "count": 3,
    "severity_summary": {
      "critical": 1,
      "high": 1,
      "medium": 1,
      "low": 0
    },
    "packages_affected": [
      "axios",
      "lodash",
      "minimist"
    ]
  },
  "discovered_at": "2026-03-09T00:14:21Z"
}

Name	Type	Description
reactor.id	String	The unique identifier of the reactor.
reactor.name	String	The name of the reactor.
vulnerabilities.count	Number	Total number of detected vulnerabilities.
vulnerabilities.severity_summary	Object	Severity breakdown of the detected vulnerabilities.
vulnerabilities.severity_summary.critical	Number	Number of CRITICAL vulnerabilities.
vulnerabilities.severity_summary.high	Number	Number of HIGH vulnerabilities.
vulnerabilities.severity_summary.medium	Number	Number of MEDIUM vulnerabilities.
vulnerabilities.severity_summary.low	Number	Number of LOW vulnerabilities.
vulnerabilities.packages_affected	Array	Distinct package names affected by vulnerabilities (up to 20 values).
discovered_at	String	ISO 8601 timestamp indicating when vulnerabilities were discovered.

Runtime Logs

reactor.log and proxy.log events contain ordered application and lifecycle records from one Reactor or Proxy code-transform invocation.

reactor.log uses this data shape:

reactor.log

{
  "invocation_id": "...",
  "reactor": {
    "id": "..."
  },
  "sequence_start": 0,
  "sequence_end": 2,
  "records": [
    ...
  ]
}

proxy.log uses this data shape:

proxy.log

{
  "invocation_id": "...",
  "proxy": {
    "id": "..."
  },
  "transform_type": "request_transform",
  "sequence_start": 0,
  "sequence_end": 2,
  "records": [
    ...
  ]
}

Runtime Log Event Data Fields

Runtime-log event batches have these data fields:

Name	Type	Presence	Applies to	Description
invocation_id	String	Required	reactor.log, proxy.log	Invocation identity shared by every batch from one invocation.
reactor	Object	Required	reactor.log	Customer-visible Reactor resource.
reactor.id	String	Required	reactor.log	Reactor identifier.
proxy	Object	Required	proxy.log	Customer-visible Proxy resource.
proxy.id	String	Required	proxy.log	Proxy identifier.
transform_type	String	Required	proxy.log	request_transform or response_transform.
sequence_start	Number	Required	reactor.log, proxy.log	Sequence of the first record in this batch.
sequence_end	Number	Required	reactor.log, proxy.log	Sequence of the last record in this batch.
records	Array	Required	reactor.log, proxy.log	Non-empty ordered array. Each item follows the runtime-log record fields.

Runtime Log Record Fields

Each runtime-log record has this shape:

Name	Type	Presence	Description
occurred_at	String	Required	ISO 8601 timestamp when the record occurred.
sequence	Number	Required	Invocation-local record order.
source	String	Required	application for logger output or platform for runtime lifecycle records.
record_type	String	Required	log for application records or lifecycle for platform records.
event	String	Lifecycle only	execution.started or execution.completed.
level	String	Application only	debug, info, warn, or error.
message	String	Application only	Sanitized application message. If no message argument is supplied, this is the direct Error's message when present, otherwise an empty string.
attributes	Object	Optional application field	Sanitized structured attributes supplied to the logger.
error	Object	Optional application field	Sanitized details from a direct JavaScript Error.
error.type	String	When error is present	Error type or name.
error.message	String	When error is present	Error message.
error.stack_trace	String	Optional when error is present	Sanitized stack trace.
outcome	String	Completed lifecycle only	success, timeout, out_of_memory, application_error, or platform_error.
duration_ms	Number	Optional completed lifecycle field	Elapsed execution time in milliseconds.

The event fields, including trace_id, follow the common event structure. Related events can share this request-level correlation identifier, while data.invocation_id identifies one runtime execution. Deduplicate repeated deliveries by id. timestamp describes event creation, occurred_at describes an individual record, and the delivered_at on a webhook delivery describes one delivery attempt. None of these timestamps defines record order.

See Runtime Logs for complete Reactor, request-transform, and response-transform examples, batching, and ordering. See Sanitization, Truncation and Capture Limitations for runtime-log processing and capture behavior. See Webhook Delivery for the request format, retries, and idempotent processing.

Sessions

Session Authorized

session.authorized

{
  "session": {
    "id": "...",
    "created_at": "...",
    "created_by": "...",
    "expires_at": "...",
    "permissions": [
      "..."
    ],
    "rules": [
      {
        "description": "...",
        "priority": 0,
        "container": "...",
        "transform": "...",
        "conditions": [
          {
            "attribute": "...",
            "operator": "...",
            "value": "..."
          }
        ],
        "permissions": [
          "..."
        ]
      }
    ],
    "issued_to_application": {
      "id": "...",
      "name": "..."
    }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The user or system that created the session.
session.expires_at	String	The expiration date of the session in ISO 8601 format.
session.permissions	Array	An array of Permissions associated with the session.
session.rules	Array	An array of Access Rules defined for the session.
session.rules[].description	String	A description of the rule.
session.rules[].priority	Number	The priority level of the rule.
session.rules[].container	String	The container associated with the rule.
session.rules[].transform	String	The transform applied by the rule.
session.rules[].conditions	Array	An array of conditions that must be met for the rule.
session.rules[].conditions[].attribute	String	The attribute evaluated in the condition.
session.rules[].conditions[].operator	String	The operator used in the condition.
session.rules[].conditions[].value	String	The value to compare against in the condition.
session.rules[].permissions	Array	An array of Permissions granted by the rule.
session.issued_to_application.id	String	The unique identifier of the Application to which the session is issued.
session.issued_to_application.name	String	The name of the application to which the session is issued.

Session Created

session.created

{
  "session": {
    "id": "...",
    "created_at": "...",
    "created_by": "...",
    "expires_at": "...",
    "issued_to_application": {
      "id": "...",
      "name": "..."
    }
  }
}

Name	Type	Description
session.id	String	The unique identifier of the session.
session.created_at	String	The creation date of the session in ISO 8601 format.
session.created_by	String	The user or application that created the session.
session.expires_at	String	The expiration date of the session in ISO 8601 format.
session.issued_to_application.id	String	The unique identifier of the application to which the session is issued.
session.issued_to_application.name	String	The name of the application to which the session is issued.

Tenants

Tenant Created

tenant.created

{
  "tenant": {
    "id": "...",
    "name": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
tenant.id	String	The unique identifier of the Tenant.
tenant.name	String	The name of the tenant.
tenant.created_at	String	The creation date of the tenant in ISO 8601 format.
tenant.created_by	String	The user or application that created the tenant.

Tenant Updated

tenant.updated

{
  "tenant": {
    "id": "...",
    "name": "...",
    "created_at": "...",
    "created_by": "...",
    "modified_at": "...",
    "modified_by": "..."
  }
}

Name	Type	Description
tenant.id	String	The unique identifier of the Tenant.
tenant.name	String	The name of the tenant.
tenant.created_at	String	The creation date of the tenant in ISO 8601 format.
tenant.created_by	String	The creator of the tenant.
tenant.modified_at	String	The last modified date of the tenant in ISO 8601 format.
tenant.modified_by	String	The user or application that modified the tenant.

Tenant Deleted

tenant.deleted

{
  "tenant": {
    "id": "..."
  }
}

Name	Type	Description
tenant.id	String	The unique identifier of the Tenant.

Tenant Vulnerabilities Notified

tenant.vulnerabilities_notified

{
  "tenant": {
    "id": "...",
    "name": "..."
  },
  "notification": {
    "email_address": "security@example.com",
    "notified_at": "2026-03-10T09:00:00Z"
  },
  "affected_resources": {
    "reactors": [
      {
        "id": "...",
        "name": "..."
      }
    ],
    "proxies": [
      {
        "id": "...",
        "name": "..."
      }
    ]
  }
}

Name	Type	Description
tenant.id	String	The unique identifier of the tenant.
tenant.name	String	The name of the tenant.
notification.email_address	String	Email address used for the vulnerability notification.
notification.notified_at	String	ISO 8601 timestamp indicating when the notification was sent.
affected_resources.reactors	Array	Reactors included in the vulnerability notification email.
affected_resources.reactors[].id	String	The unique identifier of an affected reactor.
affected_resources.reactors[].name	String	The name of an affected reactor.
affected_resources.proxies	Array	Proxies included in the vulnerability notification email.
affected_resources.proxies[].id	String	The unique identifier of an affected proxy.
affected_resources.proxies[].name	String	The name of an affected proxy.

Tenant Invitations

Invitation Accepted

tenant.invitation.accepted

{
  "invitation": {
    "id": "...",
    "email": "...",
    "role": "...",
    "expires_at": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
invitation.id	String	The unique identifier of the invitation.
invitation.email	String	The email address of the invitee.
invitation.role	String	The role assigned to the invitee.
invitation.expires_at	String	The expiration date of the invitation in ISO 8601 format.
invitation.created_at	String	The creation date of the invitation in ISO 8601 format.
invitation.created_by	String	The user or application that created the invitation.

Invitation Created

tenant.invitation.created

{
  "invitation": {
    "id": "...",
    "email": "...",
    "role": "...",
    "expires_at": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
invitation.id	String	The unique identifier of the invitation.
invitation.email	String	The email address associated with the invitation.
invitation.role	String	The role assigned to the invitation.
invitation.expires_at	String	The expiration date of the invitation in ISO 8601 format.
invitation.created_at	String	The creation date of the invitation in ISO 8601 format.
invitation.created_by	String	The user or application that created the invitation.

Invitation Deleted

tenant.invitation.deleted

{
  "invitation": {
    "id": "...",
    "email": "...",
    "role": "...",
    "expires_at": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
invitation.id	String	The unique identifier of the invitation.
invitation.email	String	The email address associated with the invitation.
invitation.role	String	The role assigned to the invitation, formatted for readability.
invitation.expires_at	String	The expiration date of the invitation in ISO 8601 format.
invitation.created_at	String	The creation date of the invitation in ISO 8601 format.
invitation.created_by	String	The user or application that created the invitation.

Invitation Resent

tenant.invitation.resent

{
  "invitation": {
    "id": "...",
    "email": "...",
    "role": "...",
    "expires_at": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
invitation.id	String	The unique identifier of the invitation.
invitation.email	String	The email address associated with the invitation.
invitation.role	String	The role assigned to the invitation, formatted for readability.
invitation.expires_at	String	The expiration date of the invitation in ISO 8601 format.
invitation.created_at	String	The creation date of the invitation in ISO 8601 format.
invitation.created_by	String	The user or application that created the invitation.

Tenant Members

Member Created

tenant.member.created

{
  "member": {
    "id": "...",
    "user_id": "...",
    "role": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
member.id	String	The unique identifier of the tenant member.
member.user_id	String	The unique identifier of the user associated with the member.
member.role	String	The role assigned to the member, formatted for readability.
member.created_at	String	The creation date of the member in ISO 8601 format.
member.created_by	String	The user or application that created the member.

Member Deleted

tenant.member.deleted

{
  "member": {
    "id": "..."
  }
}

Name	Type	Description
member.id	String	The unique identifier of the tenant member.

Tenant Merchants

Merchant Created

tenant.merchant.created

{
  "merchant": {
    "id": "...",
    "name": "...",
    "created_at": "...",
    "created_by": "..."
  }
}

Name	Type	Description
merchant.id	String	The unique identifier of the tenant merchant.
merchant.name	String	The name of the merchant.
merchant.created_at	String	The creation date of the merchant in ISO 8601 format.
merchant.created_by	String	The user or application that created the merchant.

Merchant Updated

tenant.merchant.updated

{
  "merchant": {
    "id": "...",
    "name": "...",
    "updated_at": "...",
    "updated_by": "..."
  }
}

Name	Type	Description
merchant.id	String	The unique identifier of the tenant merchant.
merchant.name	String	The name of the merchant.
merchant.updated_at	String	The last modified date of the merchant in ISO 8601 format. Merchant events use updated_at where other events use modified_at.
merchant.updated_by	String	The user or application that last modified the merchant. Merchant events use updated_by where other events use modified_by.

Merchant Deleted

tenant.merchant.deleted

{
  "merchant": {
    "id": "...",
    "name": "...",
    "updated_at": "...",
    "updated_by": "..."
  }
}

Name	Type	Description
merchant.id	String	The unique identifier of the deleted tenant merchant.
merchant.name	String	The name of the merchant.
merchant.updated_at	String	The last modified date of the merchant in ISO 8601 format. Merchant events use updated_at where other events use modified_at.
merchant.updated_by	String	The user or application that last modified the merchant. Merchant events use updated_by where other events use modified_by.

Tokens

Token Created

token.created

{
  "token": {
    "id": "...",
    "type": "...",
    "metadata": { "...": "..." },
    "containers": ["..."],
    "fingerprint": "...",
    "fingerprint_expression": "...",
    "search_indexes": ["..."],
    "created_by": "...",
    "created_at": "...",
    "expires_at": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.
token.type	String	The type of the token.
token.metadata	map<string, string>	Additional metadata associated with the token.
token.containers	Array	An array containing the container associated with the token.
token.fingerprint	String	The fingerprint of the token.
token.fingerprint_expression	String	The expression used to generate the fingerprint.
token.search_indexes	Array	An array of search index expressions associated with the token.
token.created_by	String	The creator of the token.
token.created_at	String	The creation date of the token in ISO 8601 format.
token.expires_at	String	The expiration date of the token in ISO 8601 format.

Token Deleted

token.deleted

{
  "token": {
    "id": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.

Token Expired

token.expired

{
  "token": {
    "id": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.

Token Property Expired

token.property.expired

{
  "token": {
    "id": "...",
    "property_name": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.
token.property_name	String	The name of the property associated with the token.

Token Read

token.read

{
  "token": {
    "id": "...",
    "type": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.
token.type	String	The type of the token.

Token Updated

token.updated

{
  "token": {
    "id": "...",
    "type": "...",
    "metadata": { "...": "..." },
    "containers": ["..."],
    "fingerprint": "...",
    "fingerprint_expression": "...",
    "search_indexes": ["..."],
    "modified_by": "...",
    "modified_at": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "..."
  }
}

Name	Type	Description
token.id	String	The unique identifier of the token.
token.type	String	The type of the token.
token.metadata	map<string, string>	Additional metadata associated with the token.
token.containers	Array	An array containing the container associated with the token.
token.fingerprint	String	The fingerprint of the token.
token.fingerprint_expression	String	The expression used to generate the fingerprint.
token.search_indexes	Array	An array of search index expressions associated with the token.
token.modified_by	String	The last user who modified the token.
token.modified_at	String	The last modified date of the token in ISO 8601 format.
token.created_by	String	The creator of the token.
token.created_at	String	The creation date of the token in ISO 8601 format.
token.expires_at	String	The expiration date of the token in ISO 8601 format.

Token Intents

Token Intent Created

token-intent.created

{
  "token_intent": {
    "id": "...",
    "type": "...",
    "fingerprint": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "..."
  }
}

Name	Type	Description
token_intent.id	String	The unique identifier of the token intent.
token_intent.type	String	The type of the token intent.
token_intent.fingerprint	String	The fingerprint of the token intent.
token_intent.created_by	String	The creator of the token intent.
token_intent.created_at	String	The creation date of the token intent in ISO 8601 format.
token_intent.expires_at	String	The expiration date of the token intent in ISO 8601 format.

Token Intent Deleted

token-intent.deleted

{
  "token_intent": {
    "id": "..."
  }
}

Name	Type	Description
token_intent.id	String	The unique identifier of the token intent.

Token Intent Converted

token-intent.converted

{
  "token_intent": {
    "id": "...",
    "type": "..."
  },
  "token": {
    "id": "...",
    "type": "..."
  }
}

Name	Type	Description
token_intent.id	String	The unique identifier of the token intent.
token_intent.type	String	The type of the token intent.
token.id	String	The unique identifier of the token.
token.type	String	The type of the token.

Google Pay™

As mentioned in the Google Pay™ API documentation either a Google Pay™ resource or a Basis Theory's Token Intent can be created based on the provided encrypted token. Please refer to Token Intent events documentation for information about token intents created through the Google Pay™ API.

Resource Created

google-pay.created

{
  "google_pay": {
    "id": "...",
    "type": "...",
    "status": "...",
    "ingest_source": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "..."
  }
}

Name	Type	Description
google_pay.id	String	The unique identifier of the resource.
google_pay.type	String	The kind of network token. Currently always dpan.
google_pay.status	String	The status of the resource.
google_pay.ingest_source	String	How the resource was ingested. device_decrypted for POST /google-pay; stripe_forward for Stripe Forward.
google_pay.created_by	String	The creator of the resource.
google_pay.created_at	String	The creation date of the resource in ISO 8601 format.
google_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.

Resource Deleted

google-pay.deleted

{
  "google_pay": {
    "id": "...",
    "status": "...",
    "created_by": "...",
    "created_at": "...",
    "expires_at": "...",
    "modified_by": "...",
    "modified_at": "..."
  }
}

Name	Type	Description
google_pay.id	String	The unique identifier of the resource.
google_pay.status	String	The status of the resource.
google_pay.created_by	String	The creator of the resource.
google_pay.created_at	String	The creation date of the resource in ISO 8601 format.
google_pay.expires_at	String	The expiration date of the resource in ISO 8601 format.
google_pay.modified_by	String	The user who deleted the resource.
google_pay.modified_at	String	The delete date of the resource in ISO 8601 format.

Resource Retrieved

google-pay.retrieved

{
  "google_pay": {
    "id": "..."
  }
}

Name	Type	Description
google_pay.id	String	The unique identifier of the resource.

Network Tokens

Network Token events are triggered during the lifecycle of network tokens, which are secure, network-issued tokens that convert raw card details and automatically update on card reissues. These events include creation, updates, deletion, and cryptogram generation activities.

Network Token Created

network-token.created

{
  "network_token": {
  "id": "...",
  "tenant_id": "...",
  "created_by": "...",
  "created_at": "...",
  "status": "...",
  "token_id": "...",
  "token_intent_id": "...",
  "cryptogram": {
    "value": "...",
    "eci": "..."
  }
  }
}

Name	Type	Description
network_token.id	String	The unique identifier of the network token.
network_token.tenant_id	String	The unique identifier of the tenant associated with the network token.
network_token.created_by	String	The user or application that created the network token.
network_token.created_at	String	The creation date of the network token in ISO 8601 format.
network_token.status	String	The status of the network token.
network_token.token_id	String	(Optional) The unique identifier of the token associated with the network token.
network_token.token_intent_id	String	(Optional) The unique identifier of the token intent associated with the network token.
network_token.deduplicated	Boolean	(Optional) true when asynchronous provisioning from a card token matched an existing network token instead of creating a new one. A synchronous provisioning request that deduplicates emits no event. See Deduplication. Omitted otherwise and not shown in the sample.
network_token.cryptogram	Object	(Optional) A single-use cryptogram issued with the network token when it was provisioned asynchronously from a card token. Delivered only through Webhooks; the Events API never returns it. Treat it as an ephemeral credential: use it immediately for exactly one transaction and never persist or log it, even when the surrounding event is queued or stored.
network_token.cryptogram.value	String	The cryptogram value.
network_token.cryptogram.eci	String	The ECI indicator for the cryptogram.
network_token.cryptogram_error	Object	(Optional) Present instead of cryptogram when asynchronous provisioning could not produce one; the two never appear together. Not shown in the sample.
network_token.cryptogram_error.reason	String	The failure reason code, such as MERCHANT_NOT_CONFIGURED or RETRIES_EXHAUSTED.
network_token.cryptogram_error.message	String	A description of the failure.

Network Token Updated

network-token.updated

{
  "network_token": {
    "id": "...",
    "tenant_id": "...",
    "created_by": "...",
    "created_at": "...",
    "modified_by": "...",
    "modified_at": "...",
    "status": "...",
    "token_id": "...",
    "token_intent_id": "...",
    "update_reason": "..."
  }
}

Name	Type	Description
network_token.id	String	The unique identifier of the network token.
network_token.tenant_id	String	The unique identifier of the tenant associated with the network token.
network_token.created_by	String	The user or application that created the network token.
network_token.created_at	String	The creation date of the network token in ISO 8601 format.
network_token.modified_by	String	The user or application that last modified the network token.
network_token.modified_at	String	The last modified date of the network token in ISO 8601 format.
network_token.status	String	The status of the network token.
network_token.token_id	String	(Optional) The unique identifier of the token associated with the network token.
network_token.token_intent_id	String	(Optional) The unique identifier of the token intent associated with the network token.
network_token.update_reason	String	(Optional) The reason the network token was updated, when the producer supplied one.

Network Token Deleted

network-token.deleted

{
  "network_token": {
    "id": "..."
  }
}

Name	Type	Description
network_token.id	String	The unique identifier of the network token.

Network Token Cryptogram Created

network-token.cryptogram.created

{
  "network_token": {
    "id": "..."
  }
}

Name	Type	Description
network_token.id	String	The unique identifier of the network token.