{
"id": "<string>",
"type": "app/scopes_updated",
"apiVersion": "2026-10",
"createdAt": "2023-11-07T05:31:56Z",
"businessId": "<string>",
"storeId": "<string>",
"appId": "<string>",
"installationId": "<string>",
"changed": [],
"data": {
"installation": {
"id": "<string>",
"appId": "<string>",
"appVersionId": "<string>",
"grantedScopes": [
"<string>"
],
"storeIds": [
"<string>"
],
"installedAt": "2023-11-07T05:31:56Z",
"uninstalledAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}
}Appscopes updated
The merchant granted a new set of scopes.
About the installation itself: sent to that installation only.
At least once, no ordering guarantee. data is read when the body is built (seconds after the event), masked for the installation.
{
"id": "<string>",
"type": "app/scopes_updated",
"apiVersion": "2026-10",
"createdAt": "2023-11-07T05:31:56Z",
"businessId": "<string>",
"storeId": "<string>",
"appId": "<string>",
"installationId": "<string>",
"changed": [],
"data": {
"installation": {
"id": "<string>",
"appId": "<string>",
"appVersionId": "<string>",
"grantedScopes": [
"<string>"
],
"storeIds": [
"<string>"
],
"installedAt": "2023-11-07T05:31:56Z",
"uninstalledAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}
}Headers
dlv_<delivery id>: one per event per installation, the same on every retry. Deduplicate on it. A test delivery from the developer console is dlv_test_<24 hex>.
^dlv_(\d+|test_[0-9a-f]{24})$Unix seconds of this attempt.
^\d+$v1a,<base64 Ed25519 signature> of {webhook-id}.{webhook-timestamp}.{raw body}, one per active key, space-separated during a key rotation. Keys: GET /apps/webhook-keys.
The topic, e.g. orders/created.
The installation's business.
The version the body follows (the installation's pinned version's).
true on a test delivery sent from the developer console (a sample body, envelope id evt_0); absent on every real delivery.
"true"Body
The merchant granted a new set of scopes.
Event id. Deduplicate on the webhook-id header.
^evt_\d{1,25}$"app/scopes_updated""2026-10"When the event happened.
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$A resource id (a snowflake id, as a string).
1 - 64A resource id (a snowflake id, as a string).
1 - 64Check it is yours.
1 - 64Check it is yours.
1 - 64Top-level fields of the resource that changed; may be empty.
appId, appVersionId, status, grantedScopes, storeAccess, storeIds, installedAt, uninstalledAt, updatedAt The resource as it was when the body was built, masked for this installation. Re-read it when unsure.
Show child attributes
Show child attributes
Response
Gone: the installation's webhooks are disabled at once, every topic.