Event types

The envelope every Cevoid webhook shares, the catalog of events by resource, and how payloads change over time.

Every webhook request carries one event. type names it, and data holds the resources it concerns, such as the order and its customer's profile, mostly in the shape the API returns them.

Envelope

Every event body has the same top-level fields:

Field	What it holds
`type`	The event type, such as `order.fulfilled`. Switch on it.
`id`	A UUID that identifies the event, the same as the `webhook-id` header. Retries keep it; a replay gets a new one.
`created_at`	When the Flow's webhook action ran, in ISO 8601 UTC. After a Wait step, that is when the wait ended.
`version`	The payload version, `1` today.
`origin`	`origin.flow.id` and `origin.flow.name`: the Flow that sent the event. Absent on test events.
`data`	The resources of the event. Each event page lists its fields.

Envelope

{
  "created_at": "2026-08-03T11:58:05.000Z",
  "data": { "order": { "id": "ord_7k2m4n8p5x9qwe" }, "profile": { "id": "prf_c4n8x2q1m5v7rt" } },
  "id": "4f1c9a2e-7b3d-8e61-9c05-2a8d6f4b1e73",
  "origin": { "flow": { "id": "wfl_3p9v6d2s8k1mqa", "name": "Send fulfilled orders to ERP" } },
  "type": "order.fulfilled",
  "version": 1
}

Cevoid sends the body with its object keys sorted, as above. Parse it as JSON; do not depend on the key order.

Event catalog

Each event has its own page with an example and every field. The trigger with the same name in a Flow sends it.

Order events

order.fulfilledSent when an order's fulfillment status reaches FULFILLED or a later status.
order.deliveredSent when an order's fulfillment status becomes DELIVERED.

Review events

product-review.submittedSent when a customer submits a product review.
company-review.submittedSent when a customer submits a company review.

The test event, cevoid.test, is described in Test a webhook.

Resources in data

The API's own resources. order, profile, points and tier are serialized by the same code as the API, so a webhook and GET /v2/orders/{id} describe an order the same way. product_review and company_review have a shape of their own, listed field by field on each review event page.
Profiles include private fields. Webhooks go from server to server, so profile carries the fields only secret API keys can read, such as email and notes.
Loyalty standing for members. points and tier appear only in workspaces with Loyalty, and only when the profile is a member.
Absent rather than partial. A resource Cevoid cannot read is left out instead of being sent half filled, so check for each key before you use it.
Read at the first attempt. data reflects the records when Cevoid made the first attempt; retries resend that body unchanged.

Versioning

version is 1 for every event today. Read it with type before you process an event.
The API resources in data follow the API's compatibility rules: within v2 they gain optional fields over time, without a change to version. See API versioning.
New event types can appear. Ignore a type your receiver does not handle and still return a 2xx status, so the delivery does not retry.
Ignore fields you do not recognize instead of rejecting the body.